Containerization Technologies and Security Challenges NDE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A containerized application requires access to the host's GPU for machine learning workloads. The security team is concerned about the increased attack surface. Which mitigation is most appropriate?

   • AGrant the container access to the GPU device and run it with a seccomp profile that restricts unnecessary syscalls.
   • BUse a VM with GPU passthrough instead of a container.
   • CDisable the GPU and use CPU-only processing to avoid the risk.
   • DRun the container in privileged mode to ensure the GPU driver works correctly.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A development team wants to standardize the runtime environment for a Node.js application across development, test, and production. They need to ensure that the exact same dependencies and OS-level libraries are used everywhere, while minimizing the attack surface. Which approach best meets these requirements?

   • ABuild the application from source on each environment to ensure compatibility.
   • BUse a full-featured base image with all common libraries preinstalled to avoid missing dependencies, and tag it as 'latest' for easy updates.
   • CCreate a VM template with the application installed and clone it for each environment.
   • DCreate a Docker image from a minimal base image, pin the base image digest, install only required dependencies, and run the same image in all environments.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A developer needs to pass a database password to a containerized application. The current Dockerfile contains the password as an environment variable in plain text. Which approach should be used instead?

   • AUse a random password that changes on every container start, and store it in a file inside the container.
   • BKeep the password in the Dockerfile but use a comment to mark it as sensitive.
   • CHardcode the password in the application source code and compile it into the binary.
   • DStore the password in a secrets management solution and inject it into the container at runtime via environment variables or mounted secrets.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A development team is deciding between using virtual machines and containers for a new application. The application is a stateless web service that needs to be deployed quickly and scale horizontally. Which advantage of containers over VMs is MOST relevant to this requirement?

   • AContainers have their own dedicated operating system
   • BContainers provide stronger isolation than VMs
   • CContainers share the host OS kernel, making them lightweight and faster to start
   • DContainers require a hypervisor to run
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a common feature of container orchestration platforms?

   • AAutomated rollback of failed application updates
   • BReplacement of the container runtime on all nodes
   • CCompilation of application source code into binaries
   • DGeneration of SSL/TLS certificates for all external services
   Reveal Solution Discussion Select an answer first