Serverless and Container Security (Docker, Kubernetes) CSE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which Kubernetes resource is used to restrict network traffic between pods?

   • AServiceAccount
   • BSecret
   • CNetworkPolicy
   • DConfigMap
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is designing a container security strategy. They have a mix of legacy applications that require root privileges and new applications that can run as non-root. The security team wants to minimize the risk of container escape while maintaining operational compatibility. Which approach should they take?

   • ARun all containers with the same security context, using root for compatibility, and rely on the host OS to isolate containers.
   • BRefuse to run legacy applications that require root and force all applications to run as non-root.
   • CRun all containers with the same security context, using non-root for all, and hope the legacy applications work.
   • DUse a container runtime that provides strong isolation, such as gVisor or Kata Containers, for the legacy applications that require root.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company wants to secure its container supply chain. They currently build images in a CI/CD pipeline and push them to a private registry. They want to ensure that only images that have passed security scanning and are signed by the CI/CD system can be deployed. They also want to prevent developers from manually pushing images to the registry. Which set of controls should they implement?

   • AConfigure the registry to only accept signed images, and use admission control in Kubernetes to reject unsigned images.
   • BUse a NetworkPolicy to block all traffic to the registry except from the CI/CD system.
   • CUse a strong password for the registry and share it with all developers.
   • DScan images after deployment and alert on vulnerabilities.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A serverless application processes sensitive personal data. The compliance team requires that data be encrypted at rest and in transit, and that access to the data be logged. The application uses a managed database service. Which combination of controls should the team implement?

   • AEnable multi-factor authentication for all database users.
   • BEnable encryption at rest for the database, use TLS for all connections, and enable database audit logging.
   • CStore the database credentials in a secrets manager.
   • DUse a VPC and security groups to restrict network access to the database.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A Kubernetes cluster is shared by multiple teams. One team has a workload that requires access to a specific external API, but the security team wants to enforce least privilege and minimize the risk of lateral movement. They also want to ensure that the workload can only access the API and not other internal services. Which set of controls should they implement?

   • AUse a NetworkPolicy that allows all egress traffic and rely on the API's authentication to restrict access.
   • BCreate a NetworkPolicy that allows egress only to the API's IP address and a ServiceAccount with permissions limited to the required API calls.
   • CDisable all egress traffic and use a proxy for all external communication.
   • DGrant the workload a cluster-admin role to ensure it can access the API.
   Reveal Solution Discussion Select an answer first