CCSE Cloud Application Security & DevSecOps 2

Question 1

Which security control is most effective at preventing container breakout attacks where a compromised container attempts to access the host OS?

Accepted Answer

Running containers as non-root with read-only filesystems and seccomp profiles

Answer

Encrypting container volumes at rest

Answer

Using multi-stage Docker builds to reduce image size

Answer

Enabling container image signing with Notary

Question 2

In Kubernetes security, what is the function of a Network Policy?

Accepted Answer

It controls which pods can communicate with each other and external endpoints

Answer

It encrypts etcd data to protect cluster secrets

Answer

It enforces resource quotas (CPU/memory) per namespace

Answer

It automatically rotates TLS certificates for cluster components

Question 3

What is the primary security concern with using publicly available base container images from registries like Docker Hub?

Accepted Answer

Images may contain known vulnerabilities, malware, or backdoors in their layers

Answer

Public images are incompatible with private cloud registry caching

Answer

Public images cannot be signed with container image signing tools

Answer

Using public images violates most cloud provider compliance frameworks

Question 4

Which Kubernetes RBAC object binds a Role or ClusterRole to a user, group, or service account?

Accepted Answer

RoleBinding or ClusterRoleBinding

Answer

RolePolicy

Answer

ServiceAccountToken

Answer

PodSecurityPolicy

Question 5

What is the security advantage of using an Admission Controller in Kubernetes?

Accepted Answer

It intercepts API requests to enforce policies before objects are persisted in the cluster

Answer

It performs end-to-end encryption of all pod-to-pod communication

Answer

It monitors running workloads for anomalous system calls in real time

Answer

It automatically applies the latest CVE patches to running containers

Question 6

In a microservices cloud architecture, what is the primary security role of a service mesh (e.g., Istio, Linkerd)?

Accepted Answer

To provide mutual TLS (mTLS) encryption and policy enforcement for service-to-service communication

Answer

To replace the need for an API gateway by handling all external traffic routing

Answer

To scan container images for vulnerabilities before deployment

Answer

To manage cloud provider IAM roles assigned to microservices

Question 7

Which scanning approach should be integrated into a CI/CD pipeline to detect known CVEs in container images before they are deployed to production?

Accepted Answer

Container image vulnerability scanning using tools like Trivy, Clair, or Snyk

Answer

Penetration testing of the container orchestration platform

Answer

Static code analysis of Dockerfile instructions

Answer

Manual review of container runtime logs for error patterns