Container Security Concepts and Best Practices ECDE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company runs a multi-tenant Kubernetes cluster where each tenant's workloads are isolated in separate namespaces. The security team wants to prevent containers from running as root, restrict the capabilities they can use, and ensure that pods cannot communicate with pods in other namespaces. Which set of controls should be implemented?

   • ASet the securityContext in each pod spec to run as a non-root user and use a service mesh to encrypt all traffic.
   • BDefine a Pod Security Admission policy that requires runAsNonRoot and drops all capabilities, and create NetworkPolicies that deny ingress/egress from other namespaces.
   • CUse a custom admission webhook to enforce a read-only root filesystem and rely on the default Kubernetes network policy that blocks cross-namespace traffic.
   • DApply a seccomp profile to all pods and use RBAC to limit which users can create pods in each namespace.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What does 'image provenance' refer to in container supply chain security?

   • AThe list of vulnerabilities found in the image by a scanner.
   • BThe number of layers in the image and their sizes.
   • CThe documented origin and chain of custody of a container image, including who built it and from what source.
   • DThe performance benchmarks of the image when running in production.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which monitoring metric is most important for detecting a container that is compromised and running a cryptocurrency miner?

   • ANumber of replicas
   • BContainer image size
   • CCPU usage
   • DStorage capacity
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which practice is essential for ensuring container deployments meet compliance standards?

   • ARunning regular vulnerability scans and policy checks on images and clusters.
   • BDisabling all logging to protect sensitive data from exposure.
   • CUsing the latest container runtime version without testing.
   • DAllowing developers to bypass security checks to speed up deployment.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which threat is most directly associated with the ephemeral nature of containers?

   • AContainers are immune to malware because they are short-lived.
   • BForensic investigation is harder because containers and their logs may be destroyed when they are removed.
   • CContainers cannot be patched, so they always run outdated software.
   • DContainers are automatically exposed to the internet when created.
   Reveal Solution Discussion Select an answer first