Serverless and Container Security (Docker, Kubernetes) CSE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company runs containers on a shared Kubernetes cluster. The security team is evaluating whether to use a container runtime with stronger isolation, such as gVisor or Kata Containers, for untrusted workloads. However, these runtimes have performance overhead. Which approach best balances security and performance?

   • AUse a stronger isolation runtime only for untrusted workloads, and keep the default runtime for trusted workloads.
   • BUse the default runtime for all workloads and rely on network policies.
   • CDisable all untrusted workloads.
   • DUse the stronger isolation runtime for all workloads to maximize security.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is a primary purpose of runtime security monitoring for containers?

   • ATo automatically update container images
   • BTo detect anomalous behavior and potential threats in running containers
   • CTo manage container lifecycle events
   • DTo identify vulnerabilities in the image before deployment
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a recommended best practice for securing serverless function code?

   • AStore secrets directly in the function code for simplicity
   • BDisable logging to reduce the attack surface
   • CUse the highest-privilege IAM role for all functions
   • DValidate and sanitize all input from event sources
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company runs a serverless function that processes user-uploaded images. The function currently uses an admin AWS IAM role that can access all S3 buckets and DynamoDB tables. During a review, the security team finds that the function only needs to read from one S3 bucket and write to one DynamoDB table. The team also wants to ensure that the function's dependencies are scanned for known vulnerabilities before deployment. Which combination of actions best addresses the principle of least privilege and the dependency risk?

   • AKeep the admin role but add a resource-based policy to the S3 bucket that restricts access to the function's ARN.
   • BEnable AWS Config rules to detect when the function's IAM role is used outside of expected hours.
   • CMove the function to a VPC and use security groups to restrict network access to S3 and DynamoDB.
   • DCreate a new IAM role with permissions limited to the specific S3 bucket and DynamoDB table, and integrate a dependency scanner into the CI/CD pipeline.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which practice is essential for detecting security incidents in serverless functions?

   • AStoring logs in the function's local filesystem
   • BUsing the same IAM role for all functions
   • CDisabling logging to reduce data exposure
   • DEnabling detailed logging and monitoring of function invocations
   Reveal Solution Discussion Select an answer first