CCSE Cloud Application Security & DevSecOps 2 — Questions and Answers
Question 1: Which security control is most effective at preventing container breakout attacks where a compromised container attempts to access the host OS?
- Encrypting container volumes at rest
- Running containers as non-root with read-only filesystems and seccomp profiles (Correct answer)
- Using multi-stage Docker builds to reduce image size
- Enabling container image signing with Notary
Correct answer: Running containers as non-root with read-only filesystems and seccomp profiles
Running containers as non-root users combined with read-only filesystems and seccomp system call filtering significantly limits a container's ability to interact with or escape to the host.
Question 2: In Kubernetes security, what is the function of a Network Policy?
- It encrypts etcd data to protect cluster secrets
- It controls which pods can communicate with each other and external endpoints (Correct answer)
- It enforces resource quotas (CPU/memory) per namespace
- It automatically rotates TLS certificates for cluster components
Correct answer: It controls which pods can communicate with each other and external endpoints
Kubernetes Network Policies define rules that restrict ingress and egress traffic between pods and external endpoints, implementing microsegmentation at the pod level.
Question 3: What is the primary security concern with using publicly available base container images from registries like Docker Hub?
- Public images are incompatible with private cloud registry caching
- Images may contain known vulnerabilities, malware, or backdoors in their layers (Correct answer)
- Public images cannot be signed with container image signing tools
- Using public images violates most cloud provider compliance frameworks
Correct answer: Images may contain known vulnerabilities, malware, or backdoors in their layers
Publicly available base images may include unpatched CVEs, malicious layers, or supply chain compromises, making image scanning and trusted registry policies essential.
Question 4: Which Kubernetes RBAC object binds a Role or ClusterRole to a user, group, or service account?
- RolePolicy
- RoleBinding or ClusterRoleBinding (Correct answer)
- ServiceAccountToken
- PodSecurityPolicy
Correct answer: RoleBinding or ClusterRoleBinding
A RoleBinding grants the permissions defined in a Role to a subject (user, group, or service account) within a namespace; a ClusterRoleBinding does so cluster-wide.
Question 5: What is the security advantage of using an Admission Controller in Kubernetes?
- It performs end-to-end encryption of all pod-to-pod communication
- It intercepts API requests to enforce policies before objects are persisted in the cluster (Correct answer)
- It monitors running workloads for anomalous system calls in real time
- It automatically applies the latest CVE patches to running containers
Correct answer: It intercepts API requests to enforce policies before objects are persisted in the cluster
Admission Controllers intercept Kubernetes API requests after authentication and authorization but before persistence, allowing enforcement of security policies such as blocking privileged containers.
Question 6: In a microservices cloud architecture, what is the primary security role of a service mesh (e.g., Istio, Linkerd)?
- To replace the need for an API gateway by handling all external traffic routing
- To provide mutual TLS (mTLS) encryption and policy enforcement for service-to-service communication (Correct answer)
- To scan container images for vulnerabilities before deployment
- To manage cloud provider IAM roles assigned to microservices
Correct answer: To provide mutual TLS (mTLS) encryption and policy enforcement for service-to-service communication
A service mesh provides automatic mTLS between services, ensuring encrypted and mutually authenticated communication without requiring changes to application code.
Question 7: Which scanning approach should be integrated into a CI/CD pipeline to detect known CVEs in container images before they are deployed to production?
- Penetration testing of the container orchestration platform
- Static code analysis of Dockerfile instructions
- Container image vulnerability scanning using tools like Trivy, Clair, or Snyk (Correct answer)
- Manual review of container runtime logs for error patterns
Correct answer: Container image vulnerability scanning using tools like Trivy, Clair, or Snyk
Container image vulnerability scanners like Trivy, Clair, and Snyk analyze image layers against CVE databases to identify known vulnerabilities before images reach production.
CCSE Cloud Application Security & DevSecOps 2
Which security control is most effective at preventing container breakout attacks where a compromised container attempts to access the host OS?