Serverless and Container Security (Docker, Kubernetes) CSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An organization uses a private container registry for all production images. The security team wants to ensure that only images signed by the CI/CD pipeline can be deployed to Kubernetes, and that any image with critical vulnerabilities is blocked. Which approach best achieves this?

   • AUse a policy controller (e.g., OPA/Gatekeeper or Kyverno) in the cluster to verify image signatures and vulnerability scan results before admitting pods.
   • BManually review each image's signature and vulnerability report before deploying.
   • CStore all images in a private registry and rely on the registry's access controls.
   • DUse Kubernetes Secrets to store image credentials and require developers to use them.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In the shared responsibility model for serverless computing, which security aspect is the customer primarily responsible for?

   • AEnsuring the availability of the serverless platform across multiple regions
   • BPatching the underlying operating system of the serverless runtime
   • CManaging the function code, its dependencies, and the configuration of the serverless service
   • DSecuring the physical data centers that host the serverless infrastructure
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   How can an organization enforce the use of trusted container registries?

   • ABy using admission controllers to validate image provenance
   • BBy configuring the container runtime to allow pulls from any registry
   • CBy disabling image pull secrets
   • DBy scanning images only after deployment
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security operations center (SOC) is monitoring a Kubernetes cluster and a set of serverless functions. They have noticed unusual behavior in a pod that is making connections to an IP address that is not on any allowlist. They also see a serverless function that is accessing a database that it normally does not access. The SOC wants to determine if this is a security incident and respond appropriately. Which action should they take first?

   • ADisable all network egress from the cluster and the serverless functions.
   • BCorrelate the pod's network connections with the serverless function's database access to see if they are part of the same attack campaign.
   • CImmediately terminate the pod and the serverless function to contain the potential breach.
   • DIgnore the behavior because it might be a false positive.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the role of admission controllers in Kubernetes security?

   • ATo intercept requests to the API server and enforce security policies
   • BTo store secrets securely in etcd
   • CTo manage network traffic between nodes
   • DTo automatically patch vulnerabilities in running containers
   Reveal Solution Discussion Select an answer first