Containerization Technologies and Security Challenges NDE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security operations team wants to detect anomalous behavior in a containerized environment, such as unexpected process execution or network connections. Which approach is most effective?

   • ARely on the container image scan results to ensure that no vulnerabilities exist.
   • BRegularly restart containers to clear any potential malware.
   • CUse a network firewall to block all inbound traffic to the containers.
   • DEnable container runtime monitoring that captures process, network, and file system activity and feeds it to a SIEM.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a common security risk associated with container images?

   • AThe image being stored in a public registry
   • BThe image being too small to run the application
   • CThe image containing a Dockerfile
   • DVulnerabilities in the application dependencies included in the image
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security audit of a containerized application reveals that the base image used for production containers contains several known high-severity vulnerabilities and that the image was pulled from a public registry without verification. Which combination of actions should be taken to remediate the immediate risk?

   • AApply runtime patches to the running containers and update the image tag to 'latest'.
   • BRebuild the image using a patched base image, scan the image for vulnerabilities, and sign the image to ensure integrity.
   • CSwitch to a different public registry and pull the same image from there.
   • DIncrease the logging level on the containers to detect exploitation attempts.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company runs a stateful application in containers using Kubernetes. They need to ensure that the application data is persistent and that the application can be restarted without data loss. They also want to minimize the risk of unauthorized access to the data. Which configuration is most appropriate?

   • AUse a Deployment with ephemeral storage and rely on the container image to store data.
   • BUse a Job to run the application once and store data in a ConfigMap.
   • CUse a DaemonSet to run the application on every node and store data on the host filesystem.
   • DUse a StatefulSet with persistent volumes and configure RBAC to restrict access to the volumes.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A financial institution must comply with a regulation that requires all container images to be scanned for vulnerabilities before deployment and that the scan results be retained for audit. Which practice should be implemented?

   • AScan images manually once a month and keep no records
   • BScan only images that are deployed to production, not development images
   • CIntegrate a vulnerability scanner into the CI/CD pipeline and store scan reports in a central repository
   • DUse a base image that is known to be secure and skip scanning
   Reveal Solution Discussion Select an answer first