Container Security Concepts and Best Practices ECDE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of signing a container image?

   • ATo verify the image's integrity and authenticity, ensuring it was produced by a trusted source and not tampered with.
   • BTo compress the image layers to reduce storage and network transfer time.
   • CTo encrypt the image so that only authorized users can pull it from the registry.
   • DTo automatically fix vulnerabilities found in the image's base layers.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An organization runs a Kubernetes cluster with multiple teams. The security team wants to ensure that each team can only access resources in their own namespace and that any unauthorized access attempts are logged. What should they implement?

   • ACreate RBAC roles and role bindings that grant permissions only within each namespace, and enable audit logging for the API server.
   • BEnable TLS for all communication and rely on the cloud provider's monitoring.
   • CUse cluster-admin role for all teams to simplify management.
   • DUse network policies to restrict pod-to-pod communication between namespaces.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of centralized logging in a container environment?

   • ATo aggregate logs from all containers into a single location for analysis and incident response.
   • BTo automatically block malicious IP addresses.
   • CTo reduce the number of containers running in the cluster.
   • DTo encrypt log data at rest.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A development team frequently pushes new builds of a Node.js application to a private registry. A security review found that several images contain outdated OS packages and that developers sometimes overwrite tags like 'latest'. The team wants to ensure that only verified, up-to-date images are deployed to production. Which combination of practices should be enforced?

   • AEnable image scanning on push, enforce immutable tags, and require signed images from the CI pipeline.
   • BStore images in a public registry and use a webhook to trigger a scan after deployment.
   • CUse only the 'latest' tag and rely on the registry's built-in vulnerability scanner.
   • DRequire developers to manually review each image before tagging it as 'stable'.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security operations team is investigating a potential container escape. They need to determine whether a process in a container accessed a host file. The container has already been terminated, and the team has access to the host's audit logs and the container's previous logs. Which data source would provide the most reliable evidence?

   • AThe Kubernetes event log, which records pod lifecycle events.
   • BThe container's application logs, which may include file access attempts.
   • CThe container image's layer history, which shows files added during the build.
   • DThe host's audit logs, which record syscalls and file access events with the container's process ID.
   Reveal Solution Discussion Select an answer first