2.4 Explain the Process of Container Registry Integration (e.g., JFrog, Docker, GitLab) CLOUD-SECURITY-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a key step in the JFrog Artifactory integration process?

   • ACreating a new user account for each security analyst
   • BMigrating all images to a public registry for easier access
   • CEnabling the Artifactory API and generating an access token for the security platform
   • DDisabling authentication on the Artifactory registry to allow scanning
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security engineer is integrating JFrog Artifactory with their cloud security platform. The Artifactory instance has multiple repositories, and the engineer wants to ensure that only images from the 'stable' repository are scanned. However, the integration only allows for a single Artifactory connection. What is the most effective way to achieve this?

   • ASet up a separate Artifactory instance for the 'stable' repository.
   • BUse a webhook in Artifactory to send only 'stable' repository images to the platform.
   • CIntegrate the entire Artifactory instance and then create a policy to ignore images from other repositories.
   • DCreate a token in Artifactory that has read access only to the 'stable' repository and use it for the integration.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which configuration is typically required when integrating JFrog Artifactory as a container registry with a security platform?

   • AInstalling a plugin on every container host that pulls images
   • BCreating a new Docker repository for each image to be scanned
   • CConfiguring a VPN tunnel between Artifactory and the security platform
   • DProviding the Artifactory URL and API token for authentication
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A team uses GitLab Container Registry to store images built in their CI/CD pipeline. They have integrated it with their cloud security platform. Now they want to automatically block a deployment if the image has a high-severity vulnerability. What should they configure in the cloud security platform?

   • ASet up a webhook in GitLab to fail the CI/CD pipeline if a vulnerability is found.
   • BConfigure GitLab to require two approvals for any merge request that changes a Dockerfile.
   • CCreate a policy that evaluates the image's scan results and blocks the deployment if a high-severity vulnerability is found.
   • DManually check the vulnerability report in the platform before deploying.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company uses GitLab Container Registry. They have integrated it with their cloud security platform and are using a personal access token for authentication. The integration was working, but now it has stopped. The security engineer discovers that the developer who created the token has left the company and their account has been deactivated. What is the most likely cause and the best solution?

   • AThe token was tied to the deactivated user account; the engineer should create a dedicated service account with a token for the integration.
   • BThe cloud security platform has changed its API; the engineer should update the platform.
   • CThe container registry has reached its storage limit; the engineer should clean up old images.
   • DThe GitLab instance has been restarted; the engineer should restart the integration.
   Reveal Solution Discussion Select an answer first