Serverless and Container Security (Docker, Kubernetes) CSE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An organization is deploying a Kubernetes cluster and wants to ensure that only approved container images are used. Which admission control mechanism should they implement?

   • ASet resource limits on all pods.
   • BUse an admission controller that validates image signatures against a trusted registry.
   • CEnable Role-Based Access Control (RBAC) for all users.
   • DConfigure a NetworkPolicy that blocks traffic to external registries.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company uses a private container registry for all its images. The security team wants to ensure that only images built by the company's CI/CD pipeline can be deployed to production. Which combination of controls should they implement?

   • AUse a strong password for the registry and share it with all developers.
   • BSign images with a private key during the CI/CD build and configure the cluster to reject unsigned images.
   • CScan images for vulnerabilities after deployment.
   • DRestrict access to the registry using network policies.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A Kubernetes cluster hosts multiple applications from different teams. The security team wants to ensure that one compromised application cannot access another application's data. Which Kubernetes security control should they implement?

   • AEnable audit logging on the API server.
   • BUse the same service account for all pods to simplify authentication.
   • CDisable the Kubernetes dashboard to reduce the attack surface.
   • DDefine NetworkPolicies that restrict ingress and egress traffic between pods.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A development team is building a Docker image for a web application. The team wants to reduce the attack surface and improve the image's security posture. They plan to use a minimal base image, run the application as a non-root user, and scan the image for vulnerabilities. Which additional practice should they adopt to further harden the container?

   • AUse the latest tag for the base image to ensure all updates are applied.
   • BSet resource limits (CPU and memory) on the container at runtime.
   • CExpose all necessary ports in the Dockerfile to simplify network configuration.
   • DStore secrets as environment variables in the Dockerfile for easy access by the application.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A healthcare organization must comply with data protection regulations that require encryption of personal data at rest and in transit, as well as audit logging of all access to that data. They use a combination of serverless functions and containers to process patient data. Which approach should they implement to meet these requirements?

   • AEnable encryption on all data stores and communication channels, and implement centralized logging with access to logs restricted to authorized personnel.
   • BRely on the cloud provider to handle all encryption and logging.
   • CLog all access to data but do not encrypt the logs to ensure they are readable.
   • DUse a single encryption key for all data to simplify management.
   Reveal Solution Discussion Select an answer first