CDP CDP Container & Kubernetes Security 1 — Questions and Answers
Question 1: Which Docker best practice reduces the attack surface of a container image?
- Using a full OS base image like ubuntu:latest
- Using minimal base images such as Alpine or distroless (Correct answer)
- Running the container as the root user
- Installing all development tools in the production image
Correct answer: Using minimal base images such as Alpine or distroless
Minimal base images contain fewer packages and binaries, reducing the number of potential vulnerabilities present in the image.
Question 2: What does a Kubernetes NetworkPolicy resource control?
- Resource CPU and memory limits for pods
- Which pods can communicate with each other and with external endpoints (Correct answer)
- The number of pod replicas in a deployment
- TLS certificate issuance for services
Correct answer: Which pods can communicate with each other and with external endpoints
NetworkPolicy enforces micro-segmentation by defining ingress and egress rules at the pod level, limiting lateral movement in the cluster.
Question 3: Running containers as a non-root user is important because:
- It improves container startup time
- It limits the damage an attacker can cause if the container is compromised (Correct answer)
- It allows sharing volumes across namespaces
- It enables GPU acceleration
Correct answer: It limits the damage an attacker can cause if the container is compromised
A non-root process cannot modify system files or install packages, containing the impact of a container escape or code execution vulnerability.
Question 4: Image scanning in a container registry is used to:
- Compress images before pushing
- Detect known CVEs in OS packages and application libraries within the image (Correct answer)
- Sign images with a developer GPG key
- Replicate images across geographic regions
Correct answer: Detect known CVEs in OS packages and application libraries within the image
Registry-integrated scanners check image layers against vulnerability databases and block or alert on images that exceed policy thresholds.
Question 5: A Kubernetes PodSecurityContext setting `readOnlyRootFilesystem: true` helps security by:
- Preventing the pod from reading secrets
- Stopping attackers from writing malicious files to the container filesystem (Correct answer)
- Limiting the number of processes the container can spawn
- Disabling network access from the pod
Correct answer: Stopping attackers from writing malicious files to the container filesystem
A read-only root filesystem prevents post-exploitation techniques that rely on dropping or modifying binaries inside the container.
Question 6: Which Kubernetes object stores sensitive data such as passwords and tokens?
- ConfigMap
- Secret (Correct answer)
- Ingress
- PersistentVolumeClaim
Correct answer: Secret
Kubernetes Secrets are designed to hold sensitive key-value data and can be mounted into pods or accessed via environment variables with RBAC controls.
CDP CDP Container & Kubernetes Security 1
Which Docker best practice reduces the attack surface of a container image?