Container Security Concepts and Best Practices ECDE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A development team builds a Python application image. The Dockerfile uses 'python:latest' as the base image and installs packages with pip without version pinning. The security team wants to reduce the risk of supply chain attacks. Which change should be made?

   • AUse a larger base image to include more security tools.
   • BInstall packages with 'pip install --no-cache-dir' but do not pin versions.
   • CContinue using 'latest' but scan the image after every build.
   • DUse a specific, minimal base image with a known digest and pin all dependency versions.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of a Kubernetes NetworkPolicy?

   • ATo load balance traffic across multiple replicas of a pod.
   • BTo assign IP addresses to pods dynamically.
   • CTo encrypt all traffic between pods automatically.
   • DTo control traffic flow between pods and from external sources based on labels and IP blocks.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which characteristic of containerized environments introduces a unique security challenge compared to traditional virtual machines?

   • AContainers have their own isolated kernel, eliminating the need for host OS patching.
   • BContainers are immutable by default, so any runtime change is automatically rolled back.
   • CContainers require a hypervisor to run, which adds an extra layer that must be secured.
   • DContainers share the host operating system kernel, expanding the attack surface between containers and the host.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company uses a public container registry to store images. A security audit found that some images were pulled from a public repository that was later compromised. The company wants to prevent the use of untrusted images in their CI/CD pipeline. Which measure should be implemented?

   • ARely on the public registry's reputation and do not change the pipeline.
   • BConfigure the pipeline to only pull images from an approved internal registry and verify image signatures.
   • CUse a public registry but scan images after deployment.
   • DDisable the use of all registries and build images from scratch in every pipeline run.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A Kubernetes cluster hosts multiple applications from different teams. The security team wants to ensure that a developer from Team A cannot access secrets belonging to Team B, and that pods from Team A cannot read Team B's secrets. Which set of controls should be implemented?

   • AUse Kubernetes RBAC to restrict secret access per namespace and configure pod security policies to prevent privileged access.
   • BUse a third-party secrets manager but do not configure RBAC in Kubernetes.
   • CGive all developers cluster-admin access so they can manage their own secrets.
   • DStore all secrets in a single namespace and rely on network policies to protect them.
   Reveal Solution Discussion Select an answer first