Containerization Technologies and Security Challenges NDE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security engineer is investigating a suspected container breakout. The container was running with default settings: root user, all capabilities, and a writable root filesystem. The host kernel is up-to-date. Which factor is most likely to have contributed to the breakout?

   • AThe container had a vulnerable application that allowed remote code execution, and the attacker exploited a kernel vulnerability to escape.
   • BThe container was running with a non-root user, which allowed the attacker to escalate to root on the host.
   • CThe container was using a read-only root filesystem, which prevented the attacker from writing to the host.
   • DThe container was using seccomp and AppArmor profiles, which blocked the necessary syscalls.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Why is using a minimal base image considered a security best practice?

   • AIt reduces the attack surface by including fewer packages and tools
   • BIt guarantees the image has no vulnerabilities
   • CIt speeds up the container runtime
   • DIt makes the image easier to read and understand
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the purpose of signing container images?

   • ATo verify the integrity and origin of the image
   • BTo compress the image for faster download
   • CTo encrypt the image so only authorized users can pull it
   • DTo automatically update the image when vulnerabilities are found
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company runs a microservices application with dozens of containers across multiple hosts. They need to automate deployment, scaling, and health monitoring, and they want to enforce security policies such as restricting which images can run. Which solution is most appropriate?

   • AAdopt Kubernetes with pod security admission and image policy webhooks to manage workloads and enforce security constraints.
   • BRun all containers in a single Docker container using a process supervisor to simplify management.
   • CDeploy each container as a systemd service on each host and use a central configuration management tool.
   • DUse Docker Compose on a single host to define the services and restart them manually if they fail.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security engineer is explaining to management why a containerized application is not as isolated as a virtual machine. Which statement accurately describes the key difference?

   • AContainers cannot be compromised because they run in user space
   • BContainers share the host kernel, so a kernel vulnerability can affect all containers on the host
   • CContainers have their own dedicated hardware resources, so they are more isolated than VMs
   • DContainers are isolated at the hypervisor level, providing the same isolation as VMs
   Reveal Solution Discussion Select an answer first