Containerization Technologies and Security Challenges NDE Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A security engineer is explaining container isolation to a colleague. The colleague asks: 'If a container is compromised, can the attacker affect other containers on the same host?' Which response is most accurate?

   • ANo, because containers are isolated by hardware virtualization.
   • BNo, because each container has its own kernel and is fully isolated from others.
   • COnly if the attacker has root privileges inside the container, which is impossible by default.
   • DYes, because containers share the host kernel, a kernel exploit could potentially affect other containers and the host.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A company wants to ensure that only approved container images are deployed in production. They have a private registry and use a CI/CD pipeline. Which combination of controls provides the STRONGEST assurance that only approved images are used?

   • AUse a naming convention to identify approved images and enforce it with a policy
   • BScan images for vulnerabilities and block deployment if critical vulnerabilities are found
   • CSign images with a private key, configure the cluster to only pull signed images, and scan images before signing
   • DUse a private registry and rely on access controls to prevent unauthorized pushes
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A security operations team wants to detect a container that is mining cryptocurrency. The container is running a legitimate application, but the team suspects that an attacker has injected a mining process. Which monitoring approach is most likely to detect this?

   • ACheck the container's file system for mining software.
   • BScan the container image for malware before deployment.
   • CMonitor CPU usage and process execution within the container, and alert on unexpected processes or high CPU consumption.
   • DMonitor only network traffic for connections to known mining pools.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A financial institution is required to comply with PCI DSS and needs to ensure that container images used for cardholder data processing are free of known vulnerabilities and that secrets are not stored in images. Which governance controls should be implemented?

   • ARequire developers to manually review their images before pushing to production.
   • BStore secrets in the image labels so they are easy to find during audits.
   • CEnforce a policy that all images must be scanned and approved before deployment, and use a secrets management solution for credentials.
   • DUse only images from the official Docker Hub library without scanning.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   What is the main benefit of using a container orchestration platform like Kubernetes?

   • AEliminating the need for container images
   • BAutomating deployment, scaling, and management of containerized applications
   • CProviding a graphical interface for writing application code
   • DReplacing the host operating system on each node
   Reveal Solution Discussion Select an answer first