Serverless and Container Security (Docker, Kubernetes) CSE Practice Questions (Page 11)

Questions 51–54

1. 51application · medium

   A DevOps team is building a Docker image for a web application. They want to ensure the image is as secure as possible. Which Dockerfile practice should they follow?

   • ACopy the entire source directory into the image to ensure all files are available.
   • BInstall all packages in a single layer to reduce the number of layers.
   • CUse a multi-stage build to keep the final image small and free of build tools.
   • DRun the container as root to avoid permission errors.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A company is migrating a legacy application to a serverless architecture. The security team is assessing the shared responsibility model. They want to know which security aspects remain the customer's responsibility in a serverless environment. Which of the following is the customer's responsibility?

   • AManaging the hypervisor that isolates serverless functions.
   • BPatching the underlying operating system of the serverless runtime.
   • CSecuring the physical data center hosting the serverless platform.
   • DWriting secure function code and managing dependencies.
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   A healthcare organization is deploying a containerized application that processes protected health information (PHI). The compliance team requires that all container images be scanned for vulnerabilities, that runtime activity be logged, and that only authorized personnel can deploy to production. Which combination of controls should be implemented?

   • AEnable network policies to restrict pod-to-pod communication.
   • BIntegrate image scanning into the CI/CD pipeline, enable Kubernetes audit logging, and use RBAC to restrict deployment permissions.
   • CUse a secrets management service to store PHI-related credentials.
   • DUse a private registry and require all developers to have push access.
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   Which principle should be applied when assigning IAM roles to serverless functions?

   • AGrant the function the same permissions as the most privileged user
   • BAssign a single role with broad permissions to simplify management
   • CGrant only the permissions required for the function to perform its task
   • DUse the root account credentials for the function
   Reveal Solution Discussion Select an answer first