Container Security Concepts and Best Practices ECDE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which approach is commonly used to encrypt container-to-container communication in a microservices architecture?

   • AA service mesh with mutual TLS (mTLS) between services.
   • BUsing a NetworkPolicy to allow only HTTPS traffic.
   • CStoring encryption keys in a ConfigMap for all services to share.
   • DSetting the container's network mode to 'host' to use the host's encryption.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company runs a microservices application on Kubernetes where the frontend service needs to communicate with the backend service, but the backend should not be reachable from the internet. The security team wants to enforce this segmentation and also encrypt traffic between the services. What should they do?

   • ACreate a NetworkPolicy that allows ingress to the backend only from the frontend, and use a service mesh with mutual TLS for inter-service communication.
   • BUse a NetworkPolicy that allows all ingress to the backend and rely on the frontend's authentication to protect it.
   • CPlace the backend in a separate namespace and use RBAC to restrict which users can access it.
   • DExpose the backend via a LoadBalancer service and rely on the cloud provider's security group to restrict access.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A DevOps team is building a CI/CD pipeline that builds container images from source code. The security team requires that only images that pass vulnerability scanning and are signed by the CI system can be deployed to production. What should the team configure in the pipeline?

   • AAdd a step that scans the image for vulnerabilities and fails the build if critical vulnerabilities are found, then sign the image with a private key.
   • BUse a base image that is known to be secure and skip scanning to save time.
   • CSign the image before scanning to ensure the signature is valid.
   • DScan the image after deployment and alert the security team if vulnerabilities are found.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A containerized application is running in a Kubernetes cluster. The security team wants to ensure that if a container is compromised, the attacker cannot escalate privileges or access the host. Which configuration should be applied?

   • ASet 'allowPrivilegeEscalation: false', run as non-root, and use a read-only root filesystem.
   • BUse a hostPath volume for the application's data directory.
   • CDisable the container runtime's security features to improve performance.
   • DSet 'privileged: true' but add a seccomp profile.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company is required to comply with a regulation that mandates all container images be traceable to a specific build job and that the image content has not been altered since the build. The current pipeline builds images and pushes them to a registry, but there is no mechanism to verify the image's origin. Which control should be implemented?

   • AUse a vulnerability scanner to verify the image's contents.
   • BUse a tag like 'latest' and rely on the registry's timestamp.
   • CGenerate a signed attestation in the CI pipeline that records the build job ID and image digest, and store it in the registry.
   • DStore the Dockerfile in a separate repository and link it manually.
   Reveal Solution Discussion Select an answer first