Container Security Concepts and Best Practices ECDE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the function of a seccomp profile in container runtime security?

   • AIt restricts the system calls a container can make to the host kernel.
   • BIt limits the container's CPU and memory usage.
   • CIt controls which files the container can read and write on the host.
   • DIt encrypts network traffic between containers.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which runtime security measure is specifically used to enforce mandatory access control on container processes?

   • ANetwork policies
   • BImage signing
   • CAppArmor or SELinux profiles
   • DResource quotas
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A compliance auditor requires that all changes to the container orchestration platform be logged with the identity of the user who made the change, and that the logs be retained for at least one year. The current Kubernetes cluster has audit logging enabled, but logs are stored in a local file on the control plane node. Which improvement is necessary?

   • AForward the audit logs to a centralized, tamper-proof storage system with a retention policy of at least one year.
   • BDisable audit logging to reduce performance overhead.
   • CStore the logs in a different local directory with more disk space.
   • DIncrease the verbosity of the audit logs to capture more details.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A software company distributes its container images publicly. To ensure that customers can verify the images have not been tampered with, the company wants to implement a mechanism that allows customers to confirm the image's origin and integrity. What should the company implement?

   • AProvide a Dockerfile and let customers build the image themselves.
   • BUse a vulnerability scanner and display the scan results on the registry.
   • CHost the images on a public registry and rely on the registry's checksums.
   • DSign the images with a private key and publish the public key so customers can verify the signature.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Why is using a trusted container registry important for supply chain security?

   • AIt automatically updates images to the latest version.
   • BIt reduces the risk of pulling images that have been tampered with or contain malicious code.
   • CIt guarantees that images are free of all vulnerabilities.
   • DIt speeds up image pull times by caching images locally.
   Reveal Solution Discussion Select an answer first