CDP Container & Kubernetes Security Flashcards

Which Docker best practice reduces the attack surface of a container image?

Answer: Using minimal base images such as Alpine or distroless

Minimal base images contain fewer packages and binaries, reducing the number of potential vulnerabilities present in the image.

What does a Kubernetes NetworkPolicy resource control?

Answer: Which pods can communicate with each other and with external endpoints

NetworkPolicy enforces micro-segmentation by defining ingress and egress rules at the pod level, limiting lateral movement in the cluster.

Running containers as a non-root user is important because:

Answer: It limits the damage an attacker can cause if the container is compromised

A non-root process cannot modify system files or install packages, containing the impact of a container escape or code execution vulnerability.

Image scanning in a container registry is used to:

Answer: Detect known CVEs in OS packages and application libraries within the image

Registry-integrated scanners check image layers against vulnerability databases and block or alert on images that exceed policy thresholds.

A Kubernetes PodSecurityContext setting `readOnlyRootFilesystem: true` helps security by:

Answer: Stopping attackers from writing malicious files to the container filesystem

A read-only root filesystem prevents post-exploitation techniques that rely on dropping or modifying binaries inside the container.

Which Kubernetes object stores sensitive data such as passwords and tokens?

Answer: Secret

Kubernetes Secrets are designed to hold sensitive key-value data and can be mounted into pods or accessed via environment variables with RBAC controls.