Containerization Technologies and Security Challenges NDE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A security team is investigating a breach where an attacker gained access to a container and then moved laterally to other containers on the same host. The attacker exploited a misconfigured container that had the CAP_SYS_ADMIN capability and was running in privileged mode. Which preventive measure would have MOST LIKELY stopped this attack?

   • AIncrease the number of replicas to distribute the load
   • BUse a stronger password for the container's root account
   • CDisable the container's network interface to prevent lateral movement
   • DRun containers with a non-root user, drop all capabilities, and enable a default seccomp profile
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company runs a containerized application in a Kubernetes cluster. They need to ensure that only the frontend pods can communicate with the backend pods, and that traffic between pods is encrypted. They also want to avoid the overhead of a service mesh. Which approach best meets these requirements?

   • AUse a service mesh with mutual TLS and rely on its default policies.
   • BEncrypt traffic using IPsec between nodes, but do not restrict pod-to-pod communication.
   • CPlace all pods in the same network and use a firewall on the host to filter traffic.
   • DUse Kubernetes NetworkPolicies to restrict traffic and enable TLS at the application layer for encryption.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the primary purpose of a container registry?

   • ATo store and distribute container images
   • BTo execute container runtimes on a host
   • CTo isolate containers from the host kernel
   • DTo provide a virtual network for containers
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A company is migrating from Docker Swarm to Kubernetes. They have a legacy application that relies on Docker Swarm's built-in load balancing and service discovery. During the migration, they need to maintain the same level of network security and observability. Which Kubernetes features should they use to replace these Swarm capabilities?

   • ARely on the container runtime's built-in networking and skip Kubernetes networking
   • BUse a third-party service mesh but disable all Kubernetes networking features
   • CKubernetes Deployments only, without Services or DNS
   • DKubernetes Services for load balancing and DNS for service discovery, combined with NetworkPolicies and monitoring tools
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security operations team wants to detect anomalous network traffic between containers in a Kubernetes cluster. Which approach should they use?

   • ARely solely on the container runtime's built-in audit logs
   • BUse only the host's system logs to monitor network traffic
   • CDisable all network policies to allow unrestricted traffic and then analyze it
   • DEnable network policy logging and use a monitoring tool that captures container-to-container traffic flows
   Reveal Solution Discussion Select an answer first