Container Lifecycle Security GCSA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company wants to enforce a policy that no container image with critical vulnerabilities can be deployed to production. They have a CI/CD pipeline that builds images and pushes them to a registry. What is the most effective way to automate this enforcement?

   • ASet the registry to delete any image with a critical vulnerability.
   • BUse a Kubernetes Secret to store the vulnerability scan results and mount it into the cluster.
   • CManually review the vulnerability scan report before each deployment.
   • DUse a policy engine like OPA/Gatekeeper in the Kubernetes cluster to reject pods using images with critical vulnerabilities.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A Kubernetes cluster runs a critical application. The security team wants to detect anomalous behavior such as a container spawning a shell or making unexpected network connections. They also want to retain audit logs for compliance. What should they implement?

   • AUse only Kubernetes NetworkPolicies to restrict traffic and rely on the container runtime's default logging.
   • BEnable Kubernetes RBAC to restrict who can exec into containers.
   • CDeploy Falco to monitor runtime behavior and enable Kubernetes audit logging.
   • DUse a container image scanner to check for vulnerabilities before deployment.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team is reviewing their container supply chain. They want to ensure that the base images used in their Dockerfiles are from trusted sources and that the build process is reproducible. They also want to detect if a base image has been tampered with. Which set of controls should they implement?

   • AUse a private registry as a pull-through cache and disable signature verification.
   • BUse a multi-stage build and copy only the necessary binaries.
   • CUse the latest tag for base images and rely on the registry's scanning.
   • DPin base images by digest and verify signatures using a trusted key.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security analyst is investigating a potential container compromise. They need to determine which process inside the container executed a suspicious command and what network connections were made. They have access to the container runtime and the Kubernetes cluster. What is the best way to gather this forensic data?

   • AUse the Kubernetes events to see if any pods were restarted.
   • BUse a runtime security tool like Falco that was deployed before the incident to capture system calls and network activity.
   • CUse the container runtime's logs and the Kubernetes audit logs.
   • DUse the container image's history to determine what commands were run.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is designing a container supply chain security program. The team wants to ensure that all images are built from verified source code, that the build process is reproducible, and that the images are signed. The team also wants to be able to trace any image back to the exact source commit and build environment. Which combination of controls should be implemented?

   • AUse a private Git repository and require that all developers use two-factor authentication.
   • BUse a container image scanner that checks for known vulnerabilities and records the scan results in the registry.
   • CUse signed commits, a reproducible build system that records the source commit and build environment in the image label, and sign the image with a key stored in a hardware security module (HSM).
   • DUse a CI pipeline that builds images on a shared build server and signs the images with a key stored in the CI system's environment variables.
   Reveal Solution Discussion Select an answer first