Azure Functions and Windows Containers GCPN Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which isolation level provides the strongest security boundary for Windows containers in Azure?

   • AHyper-V isolation
   • BContainer isolation
   • CProcess isolation
   • DNamespace isolation
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   You are conducting a security assessment of an AKS cluster that runs Windows containers. The cluster uses Windows Server 2019 nodes and the containers are configured to run as administrator. You have identified that the cluster's network policy is not enforced, and the kubelet is accessible from the internet. What is the most critical risk to prioritize?

   • AAn attacker can create new pods in the cluster.
   • BAn attacker can modify the cluster's Kubernetes secrets.
   • CAn attacker can directly access the Windows host's file system through the kubelet.
   • DAn attacker can access the kubelet API and execute commands in containers without authentication.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   You are performing a penetration test on an AKS cluster running Windows containers. The cluster uses Windows Server 2019 nodes with process isolation. You have gained code execution inside a container as the container's admin user. Which technique would be the most likely to successfully escape to the host?

   • AMount the host's filesystem via a misconfigured volume.
   • BExploit a known Windows kernel vulnerability that affects the host OS version.
   • CUse the container's admin privileges to enable SeDebugPrivilege and inject into a host process.
   • DAbuse the container's network namespace to access the host's network services.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A Windows container is configured to run with a non-admin user but has the 'SeAssignPrimaryTokenPrivilege' enabled. The container is running on a host with other containers. Which security concern is most directly associated with this configuration?

   • AThe non-admin user prevents the privilege from being used, so there is no concern.
   • BThe container can access other containers' files because of the privilege.
   • CThe privilege could allow the container to impersonate other tokens and potentially access other containers' resources.
   • DThe container can directly modify the host's kernel because of the privilege.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   Your team is deploying an Azure Function that processes sensitive data from a blob storage account. The function uses a blob trigger and writes results to another blob container. You need to ensure that the function can only access the specific containers it needs and cannot access other resources in the subscription. What should you configure?

   • AEnable Azure Defender for Storage to monitor for suspicious activity.
   • BPlace the function and storage account in the same virtual network and disable public access.
   • CUse a connection string with the account key in the function's application settings.
   • DAssign the function's managed identity only the Storage Blob Data Reader role on the source container and Storage Blob Data Contributor on the destination container.
   Reveal Solution Discussion Select an answer first