Containerization Technologies and Security Challenges NDE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A development team uses Kubernetes Secrets to store database credentials. They notice that the secrets are stored in etcd in plain text and that any user with access to the cluster can read them. They want to improve security without disrupting the application. Which action is most effective?

   • ADelete the secrets from etcd and hardcode them in the container image.
   • BBase64-encode the secrets before storing them in the Secret object.
   • CEnable encryption at rest for etcd and use RBAC to restrict access to secrets.
   • DStore secrets in a ConfigMap instead of a Secret.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the primary purpose of monitoring container metrics like CPU, memory, and network usage?

   • ATo enforce network segmentation policies
   • BTo automatically update container images
   • CTo replace the need for container logging
   • DTo detect anomalies that may indicate a security issue or resource abuse
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A development team is containerizing an application that needs to connect to a database. The database credentials are currently hardcoded in the application source code. Which approach is the MOST SECURE way to manage these credentials in the containerized environment?

   • AUse a secrets management solution and inject the credentials as environment variables at runtime
   • BStore the credentials in a plain text file mounted as a volume
   • CPut the credentials in the Dockerfile as build arguments
   • DEmbed the credentials in the container image so they are always available
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company's CI/CD pipeline builds a container image for a web application. The security team wants to ensure that only approved, vulnerability-free images are deployed to production. Which set of controls should be integrated into the pipeline?

   • ARun the image in a sandboxed environment before deployment to check for malicious behavior.
   • BScan the image for vulnerabilities, sign the image, and enforce a policy in the production cluster to only allow signed images.
   • CUse a minimal base image and rely on the developer's local build to ensure security.
   • DStore the image in a private registry and restrict access to the registry.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Why should secrets like passwords and API keys not be stored directly in container images?

   • ABecause images are often shared and stored in registries, making secrets accessible to unauthorized parties
   • BBecause secrets cannot be used by applications running in containers
   • CBecause secrets increase the image size and slow down deployment
   • DBecause secrets are encrypted by default in images
   Reveal Solution Discussion Select an answer first