Container Security Concepts and Best Practices ECDE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A microservices application runs in Kubernetes with a frontend service, a backend API, and a database. The security team wants to ensure that the frontend can only communicate with the backend API, and the backend API can only communicate with the database. Which configuration should be implemented?

   • APlace all pods in the same network namespace and rely on the cloud provider's security groups.
   • BEncrypt all traffic with TLS and assume that encryption prevents unauthorized access.
   • CDefine Kubernetes NetworkPolicies that allow ingress/egress only on the required ports between the specific pods.
   • DUse a service mesh but do not configure any authorization policies.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A healthcare organization must comply with HIPAA, which requires maintaining an audit trail of access to protected health information (PHI). The organization runs containerized applications that process PHI. What should they implement to meet this requirement?

   • AUse network policies to restrict access to the containers and rely on the cloud provider's compliance certifications.
   • BConduct periodic vulnerability scans and document the results.
   • CEnable comprehensive audit logging for the container platform and applications, and store logs in a tamper-evident, centralized location.
   • DEncrypt all data in transit and at rest, and use RBAC to limit access.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company is migrating a legacy monolithic application to containers. The security team is concerned about the increased attack surface due to the use of privileged containers and shared kernel. They want to reduce the risk of a container breakout. What should they do?

   • ADisable all network connectivity to the containers to prevent external attacks.
   • BRun containers with the least privilege necessary, drop all capabilities, and use a seccomp profile that blocks dangerous system calls.
   • CRun containers in privileged mode to ensure compatibility with the legacy application.
   • DUse a container runtime that does not use a shared kernel, such as gVisor.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security team is troubleshooting a containerized application that is failing to start after a seccomp profile was applied. The application logs show 'Operation not permitted' when trying to bind to a socket. The team needs to fix the issue while maintaining the security posture. Which action should they take?

   • AChange the application to use a different port that does not require the blocked syscall.
   • BRun the container in privileged mode to bypass the seccomp restriction.
   • CReview the seccomp profile and add the required syscalls for socket binding, then test in a staging environment.
   • DRemove the seccomp profile entirely to allow the application to run.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A development team at a financial services company builds a Java application and packages it into a container image. The image is based on a public base image that includes a shell, build tools, and several unused libraries. The team wants to minimize the attack surface and ensure the image is tamper-evident before it is pushed to the internal registry. Which two actions should the team take?

   • AUse a full-featured base image and rely on runtime scanning to detect vulnerabilities after deployment.
   • BBuild the image with the latest tag and rely on the registry's access controls to prevent unauthorized changes.
   • CUse a minimal base image and remove unnecessary packages, then sign the image with a private key and verify it in the CI pipeline.
   • DScan the image with a vulnerability scanner and, if no critical vulnerabilities are found, push it without signing.
   Reveal Solution Discussion Select an answer first