Serverless and Container Security (Docker, Kubernetes) CSE Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A company has a serverless function that is triggered by messages from a queue. The function processes the messages and writes results to a database. Recently, the function has been failing due to unexpected input that causes it to crash. The security team suspects that the input is malicious and wants to protect the function. Which approach should they take?

   • AUse a WAF to filter the messages before they reach the function.
   • BIncrease the function's timeout to allow it to process the input.
   • CAdd input validation and error handling to the function, and monitor the function's logs for anomalies.
   • DDisable the queue trigger and manually process messages.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A financial services company must comply with a regulation that requires logging all access to customer data. They use serverless functions to process this data. Which configuration should they implement to meet this requirement?

   • AEnable detailed audit logging on the data store and the serverless function, and store logs in an immutable, tamper-evident location.
   • BLog only failed access attempts to reduce storage costs.
   • CDisable logging for the function to protect customer data from being exposed in logs.
   • DUse a third-party logging service but allow developers to delete logs to manage storage.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A company is designing a serverless application that will be publicly accessible. The security team is concerned about denial-of-service (DoS) attacks that could exhaust the function's concurrency limits. They want to implement controls to mitigate this risk. Which approach is most effective?

   • AIncrease the function's memory and timeout settings.
   • BDisable the function's public endpoint and require a VPN.
   • CUse a WAF to block malicious requests.
   • DSet a reserved concurrency limit for the function and use a rate-limiting API gateway in front of it.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Why is using a minimal base image recommended for Docker containers?

   • AIt reduces the attack surface by including fewer packages and tools
   • BIt automatically enables security features like SELinux
   • CIt makes the container run faster by using a smaller kernel
   • DIt eliminates the need for image scanning
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A company runs a serverless application that processes financial transactions. The security team wants to detect anomalous behavior, such as unusual invocation patterns or unexpected data access, and also maintain an audit trail for compliance. Which approach should they implement?

   • AUse AWS CloudTrail only to log API calls made by the function.
   • BEnable detailed logging and metrics for the function, and integrate with a monitoring/alerting service that uses anomaly detection.
   • CStore all function logs in a centralized log bucket and review them monthly.
   • DSet up a VPC flow log to monitor network traffic to and from the function.
   Reveal Solution Discussion Select an answer first