Container Security Concepts and Best Practices ECDE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which Kubernetes resource is designed to securely store sensitive data such as passwords and API keys?

   • AServices
   • BPods
   • CSecrets
   • DConfigMaps
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A multi-tenant Kubernetes cluster hosts applications from different business units. The security team must ensure that a compromised pod in one namespace cannot reach pods in another namespace, but they also need to allow the monitoring team's pod to access metrics from all namespaces. Which approach best balances security and operational needs?

   • APlace all pods in a single namespace and use network policies to segment them.
   • BDisable network policies and use a service mesh with mTLS.
   • CUse a flat network and rely on RBAC to control access.
   • DApply a default-deny NetworkPolicy in each namespace and create specific allow rules for the monitoring pod.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which practice is most effective for minimizing a container image's attack surface?

   • AUsing a minimal base image such as distroless or Alpine and installing only required packages.
   • BStoring secrets directly in the image for easy access at runtime.
   • CKeeping all default packages and tools in the image to ensure compatibility.
   • DRunning the container as the root user to avoid permission errors.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An organization uses a managed Kubernetes service and stores sensitive configuration data, such as database credentials, in Kubernetes Secrets. The security team is concerned about unauthorized access to these secrets and wants to ensure that only specific service accounts can read them, while also maintaining an audit trail of access. What should they implement?

   • AStore secrets in etcd with encryption at rest and rely on the cloud provider's access logs.
   • BConfigure RBAC roles that grant get/list on secrets only to the required service accounts, and enable audit logging on the API server.
   • CUse a secrets management tool like HashiCorp Vault and grant all service accounts access to the Vault.
   • DEnable TLS for all pod-to-API-server communication and use network policies to restrict access to the API server.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security operations team wants to detect anomalous behavior in their containerized environment, such as a container spawning a shell or making unexpected network connections. They need a solution that provides real-time visibility into container activity and can trigger alerts. What should they implement?

   • AUse a vulnerability scanner to continuously scan running containers for known CVEs.
   • BCollect container logs with a logging agent and search for error messages.
   • CEnable Kubernetes audit logging and review the logs periodically.
   • DDeploy a runtime security tool like Falco that monitors system calls and container events, and integrate it with an alerting system.
   Reveal Solution Discussion Select an answer first