A security team wants to ensure that container images are free of known vulnerabilities before they are deployed. They also want to enforce this check in the CI/CD pipeline. Which practice should they implement?

Use the latest base image without pinning versions.

Run a vulnerability scanner on the image during the build stage and fail the pipeline if critical vulnerabilities are found.

Rely on the container runtime to block vulnerable images.

Scan the image only after deployment to production.

A security team is reviewing a Dockerfile. The application needs to read a secret from an environment variable at runtime. The team wants to avoid storing the secret in the image. Which approach is best?

Pass the secret as an environment variable at runtime using docker run -e SECRET=...

Use ENV SECRET=... in the Dockerfile.

Hard-code the secret in the application code.

Use ARG SECRET=... in the Dockerfile and pass it at build time.

A DevOps engineer needs to temporarily stop a running container named 'web-app' to perform maintenance on the host, then bring it back with the same configuration. Which set of commands should the engineer use?

docker rm -f web-app and then docker run -d --name web-app

docker stop web-app and then docker start web-app

docker pause web-app and then docker unpause web-app

docker kill web-app and then docker start web-app

EC-CouncilCertified DevSecOps Engineer

Domain 6Objective 2

Docker Container Deployment ECDE Practice Questions (Page 5)

Part of the Operate and Monitor Stage domain, which makes up ~21% of our current practice bank.

41questions here

9free pages

7concepts

Questions 21–25

21application · medium
A security team wants to ensure that container images are free of known vulnerabilities before they are deployed. They also want to enforce this check in the CI/CD pipeline. Which practice should they implement?
Select an answer first
22expert · medium
A security team is reviewing a Dockerfile. The application needs to read a secret from an environment variable at runtime. The team wants to avoid storing the secret in the image. Which approach is best?
Select an answer first
23foundation · medium
Which Docker command scans a local image for known vulnerabilities?
Select an answer first
24application · medium
A DevOps engineer needs to temporarily stop a running container named 'web-app' to perform maintenance on the host, then bring it back with the same configuration. Which set of commands should the engineer use?
Select an answer first
25expert · hard
A containerized application is running out of memory and the container is being killed by the OOM killer. The administrator needs to determine which process inside the container is consuming the most memory. Which command should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECDE” is a trademark of its owner, used for identification only.

Docker Container Deployment ECDE Practice Questions (Page 5)

Questions 21–25

A security team wants to ensure that container images are free of known vulnerabilities before they are deployed. They also want to enforce this check in the CI/CD pipeline. Which practice should they implement?

A security team is reviewing a Dockerfile. The application needs to read a secret from an environment variable at runtime. The team wants to avoid storing the secret in the image. Which approach is best?

Which Docker command scans a local image for known vulnerabilities?

A DevOps engineer needs to temporarily stop a running container named 'web-app' to perform maintenance on the host, then bring it back with the same configuration. Which set of commands should the engineer use?

A containerized application is running out of memory and the container is being killed by the OOM killer. The administrator needs to determine which process inside the container is consuming the most memory. Which command should they use?

Keep studying — Operate and Monitor Stage