Containerization Technologies and Security Challenges NDE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company runs a multi-tier application in Kubernetes. The frontend must be accessible from the internet, the backend should only communicate with the frontend, and the database should only communicate with the backend. They also need to detect any lateral movement between tiers. Which network security approach BEST satisfies these requirements?

   • APlace all tiers in the same network and rely on the host firewall to restrict traffic
   • BDefine Kubernetes NetworkPolicies that allow ingress to the frontend from the internet, frontend-to-backend, and backend-to-database, and enable flow logging for the cluster
   • CDisable network policies and use application-level authentication only
   • DUse a single NetworkPolicy that allows all traffic between pods
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company must comply with GDPR and needs to ensure that personal data processed in containers is protected. They are considering using a public cloud container service. Which statement is accurate regarding GDPR compliance?

   • AGDPR requires that all personal data be stored on-premises, so public cloud cannot be used.
   • BUsing containers automatically ensures GDPR compliance because they are isolated.
   • CPublic cloud container services are inherently GDPR-compliant and require no additional configuration.
   • DUsing a public cloud container service in a specific region can satisfy data residency requirements, but additional controls like encryption and access controls are still needed.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company runs a microservices application in Docker Swarm. The frontend service must communicate with the backend service, but the backend should not be reachable from the public internet. Which network security measure should be implemented?

   • AUse host networking for both services and rely on the host firewall
   • BPlace each service on a separate bridge network and publish both ports to the host
   • CDisable all networking and use shared volumes for communication
   • DPlace both services on the same overlay network and publish only the frontend port to the host
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is a security implication of containers sharing the host kernel?

   • AA kernel vulnerability could be exploited to compromise the host and other containers
   • BContainers are automatically protected from all host-level attacks
   • CEach container requires its own operating system license
   • DContainers cannot run on Linux hosts
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a runtime threat in a container environment?

   • AA container being stopped by an administrator
   • BA misconfigured Dockerfile that fails to build
   • CAn attacker exploiting a vulnerability in a running application to escape the container
   • DAn image being pulled from a registry
   Reveal Solution Discussion Select an answer first