Container Security Concepts and Best Practices ECDE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company runs a Kubernetes cluster with a mix of legacy and modern applications. The security team wants to enforce that only images from the approved internal registry are deployed, but some legacy applications require images that are not signed. The team also needs to ensure that the policy does not break the existing workloads. Which approach should be taken?

   • ADisable the admission controller and manually review each deployment.
   • BImmediately enforce the policy in blocking mode and update all legacy applications at once.
   • CUse an admission controller that verifies the image registry and signature, but configure it in audit mode initially.
   • DAllow all images from public registries and rely on runtime scanning.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A financial services company must demonstrate compliance with PCI DSS for its containerized payment application. The auditor requires evidence of who accessed the container platform and what changes were made. Which control should be implemented?

   • AStore all container logs in the container's local filesystem.
   • BEnable Kubernetes audit logging and integrate it with a log management system that prevents tampering.
   • CRely on the cloud provider's activity logs without integrating them into the company's SIEM.
   • DUse a container image scanner and generate a report after each deployment.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of maintaining an audit trail in a containerized environment?

   • ATo provide a record of actions and changes for security reviews and compliance verification.
   • BTo automatically remediate security vulnerabilities in running containers.
   • CTo encrypt all data in transit between containers.
   • DTo reduce the storage footprint of container images.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of Role-Based Access Control (RBAC) in a container orchestration platform like Kubernetes?

   • ATo automatically scale container replicas based on CPU usage.
   • BTo encrypt data stored in etcd.
   • CTo isolate containers at the network level.
   • DTo restrict what actions users and service accounts can perform on cluster resources.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is reviewing a containerized environment and notices that all containers share the host's network namespace and run with the default Docker bridge. The analyst is concerned about the attack surface. Which change should be recommended?

   • AKeep the host network mode to simplify troubleshooting.
   • BDisable the container runtime's firewall to improve performance.
   • CUse the default bridge but do not configure any network policies.
   • DUse a dedicated network namespace for each container and restrict inter-container communication with network policies.
   Reveal Solution Discussion Select an answer first