4.3 Identify Potential Security Issues — Such as Malware Presence, High-Severity Common Vulnerabilities and Exposures (CVEs), Detected Leaked Secrets and Docker File Misconfigurations — from the Image Assessment Report CCCS Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In an image assessment report, a CVE is listed with a CVSS score of 9.8. How should this finding be interpreted?

   • AIt is a medium-severity vulnerability that can be accepted if the container is not exposed to the internet.
   • BIt is a low-severity vulnerability that can be remediated at the next scheduled maintenance.
   • CIt is a high-severity vulnerability that should be prioritized for remediation.
   • DIt is a false positive because CVSS scores above 9.0 are not valid.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   A security analyst opens the CrowdStrike image assessment report for a container image. Where in the report would the analyst find a summary of all detected security issues, such as malware, CVEs, and leaked secrets?

   • AIn the 'Findings' or 'Issues' section, which lists each detected problem with its severity and location.
   • BIn the 'Image Layers' section, which shows the base image and each layer's size and creation date.
   • CIn the 'Registry Credentials' section, which lists the authentication details used to pull the image.
   • DIn the 'Runtime Events' section, which shows real-time activity from running containers.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An image assessment report for a CI/CD runner image flags a hardcoded database password in an environment variable definition. The image is used by multiple pipelines. What is the most immediate action the team should take?

   • AChange the environment variable name to avoid detection
   • BIgnore the finding because the image is only used internally
   • CRestrict network access to the database to the CI/CD subnet
   • DRotate the database password and remove the secret from the image
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a common Dockerfile misconfiguration that would be flagged in an image assessment report?

   • ARunning the container as the root user.
   • BCopying application code into the image.
   • CUsing a small base image.
   • DExposing a port for the application.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of the CrowdStrike image assessment report?

   • ATo compare the image against other images in the same registry.
   • BTo identify potential security issues in the image before it is deployed.
   • CTo provide a detailed inventory of all packages and files in the image.
   • DTo monitor the image for runtime threats after deployment.
   Reveal Solution Discussion Select an answer first