Serverless and Container Security (Docker, Kubernetes) CSE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the purpose of signing container images?

   • ATo encrypt the image so only authorized users can pull it
   • BTo verify the image's origin and ensure it has not been tampered with
   • CTo automatically fix vulnerabilities in the image
   • DTo compress the image for faster deployment
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A financial institution is adopting serverless and container technologies. The compliance team requires that all code changes be traceable to a developer, that images be scanned for vulnerabilities, and that runtime activity be logged for audit purposes. Which combination of practices satisfies these requirements?

   • AEnable Kubernetes audit logging only.
   • BUse a CI/CD pipeline that records the developer who triggered the build, integrate image scanning, and enable runtime logging for both serverless functions and containers.
   • CUse a secrets management service to store all credentials.
   • DUse a private registry and restrict access to the registry.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the recommended way to manage secrets (e.g., API keys, database passwords) for serverless functions?

   • AEmbed them in the function code and commit to the repository
   • BShare them with all developers for easy access
   • CUse a dedicated secrets management service (e.g., AWS Secrets Manager, Azure Key Vault)
   • DStore them in environment variables in plain text
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security architect is explaining container isolation to a new team member. The team uses Docker on a shared Linux host. The architect wants to emphasize that containers share the host kernel and that isolation is not as strong as a VM. Which statement is accurate?

   • AContainers are completely secure and cannot affect each other.
   • BContainers have their own kernel, making them as isolated as VMs.
   • CContainers share the host kernel, so a kernel vulnerability can affect all containers on the host.
   • DContainers are isolated using hardware virtualization, similar to VMs.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is migrating a legacy application to a serverless architecture. The application has a function that processes user input and stores results in a database. The security team is concerned about the shared responsibility model and wants to ensure that the function is protected against injection attacks and that the database credentials are secure. Which approach best addresses these concerns?

   • ARely on the cloud provider's security to handle all aspects of the function's security.
   • BUse an API gateway to validate input and store credentials in the function's environment variables.
   • CUse parameterized queries in the function code and store database credentials in a secrets manager.
   • DEncrypt the database connection string and include it in the function code.
   Reveal Solution Discussion Select an answer first