What is a common method to encrypt traffic between containers?

Setting the container's network mode to 'host'

Assigning each container a static IP address

Using a service mesh with mutual TLS (mTLS)

A security team is hardening a container runtime. They want to reduce the risk of kernel exploits while maintaining application functionality. They are considering seccomp, AppArmor, and running as a non-root user. Which statement correctly describes the trade-offs?

Running as non-root eliminates the need for seccomp and AppArmor.

AppArmor is only useful for VMs, not containers.

Seccomp and AppArmor are mutually exclusive, so only one can be used at a time.

Seccomp restricts syscalls, AppArmor restricts file and network access, and non-root reduces the impact of a compromise; all can be used together.

A security analyst at a software company discovers that a container image used in production was built from a base image that has known critical vulnerabilities. The image is currently running in several containers. Which action should the analyst take FIRST to reduce immediate risk?

Enable verbose logging on the running containers to capture any attack attempts

Quarantine the running containers and investigate the exploitability of the vulnerabilities

Rebuild the image using a patched base image and redeploy the containers

Delete the vulnerable image from the registry and hope no new containers are started

What is the purpose of seccomp in container runtime security?

To encrypt network traffic between containers

To provide a firewall for container ports

To restrict the system calls a container can make to the host kernel

To limit the amount of CPU and memory a container can use

A company is designing a new application and must choose between a VM-based and a container-based deployment. The application has strict compliance requirements that mandate a dedicated operating system per workload and the ability to run different operating system versions on the same host. Which deployment approach should they choose?

A hybrid approach using containers for all workloads

EC-CouncilNetwork Defense Essentials

Domain 4Objective 2

Containerization Technologies and Security Challenges NDE Practice Questions (Page 2)

Part of the Virtualization and Cloud Computing Security domain, which makes up ~12% of our current practice bank.

54questions here

11free pages

10concepts

10 Concepts in This Objective

Containerization fundamentals
Container orchestration basics
Container security challenges
Container isolation and kernel security
Securing container images
Container runtime security
Container network security
Container secrets management
Container monitoring and logging
Compliance and governance for containers

Questions 6–10

6foundation · easy
What is a common method to encrypt traffic between containers?
Select an answer first
7expert · hard
A security team is hardening a container runtime. They want to reduce the risk of kernel exploits while maintaining application functionality. They are considering seccomp, AppArmor, and running as a non-root user. Which statement correctly describes the trade-offs?
Select an answer first
8application · medium
A security analyst at a software company discovers that a container image used in production was built from a base image that has known critical vulnerabilities. The image is currently running in several containers. Which action should the analyst take FIRST to reduce immediate risk?
Select an answer first
9foundation · easy
What is the purpose of seccomp in container runtime security?
Select an answer first
10expert · hard
A company is designing a new application and must choose between a VM-based and a container-based deployment. The application has strict compliance requirements that mandate a dedicated operating system per workload and the ability to run different operating system versions on the same host. Which deployment approach should they choose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “NDE” is a trademark of its owner, used for identification only.