Serverless and Container Security (Docker, Kubernetes) CSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security operations team wants to detect anomalous behavior in their Kubernetes cluster, such as a pod making unusual network connections or a container trying to access files outside its expected path. Which tool or approach should they use?

   • AEnable Kubernetes audit logging and review the logs manually once a week.
   • BSet restrictive NetworkPolicies to block all egress traffic.
   • CUse a vulnerability scanner to check images for known CVEs.
   • DDeploy a runtime security agent that monitors system calls and network activity on each node.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the purpose of Role-Based Access Control (RBAC) in Kubernetes?

   • ATo encrypt network traffic between pods
   • BTo automatically scale pods based on CPU usage
   • CTo control what actions users and service accounts can perform on Kubernetes resources
   • DTo isolate containers at the kernel level
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A Kubernetes cluster has a critical application that must remain available. The security team wants to enforce that all pods run with a read-only root filesystem and drop all Linux capabilities. However, the application currently needs to write to a temporary directory. The team is considering using an emptyDir volume for the writable directory. Which approach best balances security and functionality?

   • AEnforce a Pod Security Standard that requires read-only root filesystem and drop all capabilities, and mount an emptyDir volume at the writable path.
   • BDisable the Pod Security Standard for this application only.
   • CRelax the Pod Security Standard to allow the application to run as root and write to the root filesystem.
   • DUse a hostPath volume for the writable directory.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary isolation mechanism used by containers?

   • AHardware virtualization with a hypervisor
   • BSeparate operating systems for each container
   • CEncryption of the container filesystem
   • DKernel namespaces and cgroups
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company runs a serverless function that processes user-uploaded images. The function currently stores the images in a cloud storage bucket and uses a shared database connection string stored in the function's environment variables. During a security review, the team wants to reduce the risk of credential leakage and ensure the function only accesses the specific bucket it needs. Which combination of actions should the team implement?

   • AMove the connection string to a secrets manager, grant the function's identity least-privilege access to the bucket, and remove the environment variable.
   • BCreate a new bucket for each user and grant the function full access to all buckets.
   • CKeep the connection string in the environment variable but encrypt it with a customer-managed key.
   • DStore the connection string in the function code as a constant and restrict the bucket to the function's IP address.
   Reveal Solution Discussion Select an answer first