Malicious Code Execution and Compromised Applications in Containers KCSA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company is planning to use a container image from a third-party vendor. The image is not signed, and the vendor has a poor security track record. The application will process sensitive data. Which approach best mitigates the risk?

   • AUse the image but restrict its network access.
   • BUse the image as-is and rely on runtime monitoring.
   • CRebuild the image from source code and verify the build process.
   • DUse the image but run it as non-root.
   Reveal Solution Discussion Select an answer first
2. 17expert · medium · select all that apply

   A security analyst is investigating a potential compromise of a containerized application. Which of the following are indicators of compromise? (Select all that apply.)

   • AThe container is using more CPU than usual.
   • BThe container's logs show normal activity.
   • CThe container is making DNS queries to a domain that is not in the application's expected behavior.
   • DThe container's root filesystem has been modified.
   • EThe container is spawning new processes that are not part of its normal operation.
   Check answers Discussion Select an answer first
4. 18application · medium

   A company uses a public container image that has been pulled millions of times. They want to ensure it hasn't been compromised. Which approach provides the strongest assurance?

   • ATrust the image because it is from a well-known organization.
   • BScan the image once at the time of first use.
   • CUse image signing and verify the signature before deployment.
   • DRely on the image's popularity as a sign of trustworthiness.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a common technique used by attackers to escape a container and gain access to the host system?

   • AReading environment variables that contain secrets
   • BUsing a misconfigured network policy to allow external traffic
   • CExploiting a vulnerability in the container runtime or kernel
   • DExecuting a process inside the container with a non-root user
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team wants to harden a container that only needs to listen on a TCP port and write logs to stdout. They want to reduce the risk of container escape. Which configuration should they apply?

   • ASet securityContext.capabilities to only add NET_BIND_SERVICE and set readOnlyRootFilesystem: true.
   • BSet securityContext.allowPrivilegeEscalation: true to allow the container to gain more privileges if needed.
   • CRun with privileged: true to ensure the container has all necessary capabilities.
   • DMount the host's /proc directory to allow the container to see host processes.
   Reveal Solution Discussion Select an answer first