Container Lifecycle Security GCSA Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A company uses a private registry with multiple repositories. The security team wants to enforce that images in the 'production' repository are signed and have no critical vulnerabilities. The team also wants to ensure that developers can push images to a 'staging' repository without these restrictions, but only after passing a basic scan. Which approach should be used?

   • AUse a registry webhook that enforces signing and critical vulnerability scanning on all repositories.
   • BUse a manual approval process for all images pushed to the production repository, and rely on the registry's built-in scanning for staging.
   • CUse a CI pipeline that scans images, signs images destined for the production repository, and uses a registry webhook to enforce the policy on the production repository only.
   • DUse a Kubernetes admission controller that verifies signatures and vulnerability scans for all images deployed from any repository.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security engineer is building a container image for a Go application. They want to minimize the number of vulnerabilities in the final image. Which approach is most effective?

   • AUse a full base image like ubuntu and install only the required packages.
   • BUse a base image with the latest tag and run a vulnerability scan after build.
   • CUse a container image with a shell for debugging and remove it later.
   • DUse a multi-stage build: compile in a full builder image, then copy only the static binary into a scratch or distroless base.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A security engineer is troubleshooting a container that fails to start with a 'permission denied' error when trying to mount a filesystem. The container runs with a custom seccomp profile and has dropped all capabilities. What is the most likely cause?

   • AThe container runtime is not configured to allow mounts.
   • BThe container image does not include the mount utility.
   • CThe container is running as a non-root user and lacks the CAP_SYS_ADMIN capability.
   • DThe seccomp profile is blocking the mount system call.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   In container runtime security, what is the effect of dropping all capabilities from a container process?

   • AThe container runs with no special privileges, reducing the potential impact of a compromise
   • BThe container cannot read or write any files
   • CThe container is automatically isolated from the host network
   • DThe container cannot perform privileged operations such as binding to ports below 1024
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A company is migrating to a new container registry. They want to ensure that all images are scanned for vulnerabilities and signed before they are promoted to production. They also want to prevent developers from pushing directly to the production repository. Which architecture should they implement?

   • AUse two registries: a development registry where developers push, and a production registry that only accepts images promoted by the CI/CD pipeline after scanning and signing.
   • BUse a registry that automatically signs all images and does not require RBAC.
   • CUse a single registry with a production repository that requires signed images and has RBAC to restrict write access.
   • DUse a single registry and rely on the CI/CD pipeline to scan and sign images after they are pushed.
   Reveal Solution Discussion Select an answer first