CDP CDP Container & Kubernetes Security

Question 1

Which Docker best practice reduces the attack surface of a container image?

Accepted Answer

Using minimal base images such as Alpine or distroless

Answer

Using a full OS base image like ubuntu:latest

Answer

Running the container as the root user

Answer

Installing all development tools in the production image

Question 2

What does a Kubernetes NetworkPolicy resource control?

Accepted Answer

Which pods can communicate with each other and with external endpoints

Answer

Resource CPU and memory limits for pods

Answer

The number of pod replicas in a deployment

Answer

TLS certificate issuance for services

Question 3

Running containers as a non-root user is important because:

Accepted Answer

It limits the damage an attacker can cause if the container is compromised

Answer

It improves container startup time

Answer

It allows sharing volumes across namespaces

Answer

It enables GPU acceleration

Question 4

Image scanning in a container registry is used to:

Accepted Answer

Detect known CVEs in OS packages and application libraries within the image

Answer

Compress images before pushing

Answer

Sign images with a developer GPG key

Answer

Replicate images across geographic regions

Question 5

A Kubernetes PodSecurityContext setting `readOnlyRootFilesystem: true` helps security by:

Accepted Answer

Stopping attackers from writing malicious files to the container filesystem

Answer

Preventing the pod from reading secrets

Answer

Limiting the number of processes the container can spawn

Answer

Disabling network access from the pod

Question 6

Which Kubernetes object stores sensitive data such as passwords and tokens?

Accepted Answer

Secret

Answer

ConfigMap

Answer

Ingress

Answer

PersistentVolumeClaim