Serverless and Container Security (Docker, Kubernetes) CSE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is a key hardening technique for protecting the Kubernetes control plane?

   • ADisabling TLS on the API server for performance
   • BRestricting access to the API server using authentication and authorization
   • CEnabling anonymous access to the API server
   • DExposing the API server to the internet for easy access
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A Kubernetes cluster has a misconfigured RBAC policy that grants a service account 'cluster-admin' privileges. The security team wants to limit the blast radius of a potential compromise. They plan to replace the service account with one that has only the permissions needed for the application. Which additional control should they implement to reduce the risk of privilege escalation?

   • ASet the service account's token to never expire.
   • BEnable Kubernetes audit logging and monitor for suspicious API calls.
   • CUse a network policy to block all traffic from the service account.
   • DDisable the service account entirely.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   How can an organization demonstrate compliance with regulatory standards for serverless applications?

   • ABy relying on the cloud provider's compliance certifications without additional controls
   • BBy keeping audit logs for a defined retention period and making them accessible to auditors
   • CBy using a single region for all deployments
   • DBy deleting logs after 30 days to reduce storage costs
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A serverless function is experiencing unusual behavior: it is invoking itself in a loop, causing high costs. The security team suspects that the function's credentials were compromised. They want to stop the loop, revoke the compromised credentials, and prevent recurrence. Which sequence of actions should they take?

   • AInvestigate the logs first to understand the attack, then rotate credentials.
   • BDisable the function's logging to reduce noise.
   • CImmediately delete or rotate the function's IAM credentials, disable the function's trigger, and then investigate the logs to identify the root cause.
   • DIncrease the function's memory limit to handle the load.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is a key governance practice for container deployments?

   • AAllowing developers to deploy any image without review
   • BUsing different security standards for each environment
   • CStoring audit logs only on local nodes
   • DImplementing policy-as-code to enforce security and compliance standards
   Reveal Solution Discussion Select an answer first