Serverless and Container Security (Docker, Kubernetes) CSE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team is hardening a Kubernetes cluster. They want to ensure that pods cannot run with privileged containers, that the host filesystem is not accessible, and that only images from a trusted registry are used. They also want to minimize the impact on developers. Which admission control policy should they implement?

   • AUse a NetworkPolicy to block traffic to untrusted registries and rely on developers to follow best practices.
   • BDisable the Kubernetes API server to prevent unauthorized changes.
   • CGrant all developers cluster-admin rights so they can self-police.
   • DEnforce a Pod Security Standard that denies privileged containers and host filesystem access, and use an admission controller to validate image provenance.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Kubernetes cluster hosts multiple microservices. The security team wants to ensure that only the 'payments' service can communicate with the 'database' service, and that all other services are blocked. They also want to enforce that containers run as non-root and read-only root filesystems. Which two Kubernetes features should they use together?

   • ASecrets and ConfigMaps.
   • BNodeSelectors and Taints/Tolerations.
   • CNetworkPolicies and Pod Security Standards (or admission controllers like OPA/Gatekeeper).
   • DRBAC roles and NetworkPolicies.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which Docker security practice helps limit the impact of a compromised container?

   • ARunning the container as the root user
   • BSetting resource limits on CPU and memory
   • CDisabling the container's network interface
   • DUsing the latest tag for all images
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Kubernetes cluster is being hardened. The security team wants to ensure that the API server is not exposed to the public internet, that only authenticated users can access it, and that all changes to the cluster are logged. Which set of controls should they implement?

   • AEnable TLS for all API server communications and use a firewall.
   • BRestrict API server access to a private network, enable RBAC, and enable audit logging.
   • CEnable pod security standards to enforce non-root containers.
   • DUse network policies to restrict pod-to-pod traffic.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is adopting containers for a new microservices application. The security team wants to ensure that the container images are built securely and that the runtime environment is isolated. Which set of practices should they adopt?

   • AUse minimal base images, scan images for vulnerabilities, and run containers as non-root users.
   • BUse a large base image with all dependencies pre-installed to avoid runtime errors.
   • CDisable image scanning to speed up the CI/CD pipeline.
   • DRun containers with root privileges to simplify permission management.
   Reveal Solution Discussion Select an answer first