DCA Regulatory Compliance & Legal Framework 4 — Questions and Answers
Question 1: Which Docker capability should be dropped to comply with CIS Docker Benchmark recommendations for minimizing container attack surface?
- CAP_NET_BIND_SERVICE when the container does not need to bind privileged ports (Correct answer)
- CAP_CHOWN when the container needs to change file ownership
- ALL capabilities should be retained by default for application compatibility
- Only kernel-level capabilities need to be dropped
Correct answer: CAP_NET_BIND_SERVICE when the container does not need to bind privileged ports
The CIS Benchmark recommends dropping unneeded capabilities; CAP_NET_BIND_SERVICE is often unnecessary and should be removed when containers don't bind to ports below 1024.
Question 2: A healthcare organization uses Docker for a telehealth platform. Under HITECH Act provisions, breach notification timelines apply when PHI is exposed. What Docker control helps detect a potential breach quickly?
- Runtime security monitoring with anomaly detection for unexpected container behaviors (Correct answer)
- Weekly manual review of container logs
- Using bridge networking for all containers
- Setting container restart policies to 'always'
Correct answer: Runtime security monitoring with anomaly detection for unexpected container behaviors
Runtime monitoring with anomaly detection enables rapid detection of unauthorized access or data exfiltration, supporting the HITECH 60-day breach notification requirement.
Question 3: Docker Hub's Terms of Service for free accounts includes rate limiting on image pulls. Which organizational compliance concern does this primarily raise?
- GDPR data residency violations
- Supply chain reliability and availability risk for production CI/CD pipelines (Correct answer)
- PCI DSS cardholder data exposure
- SOC 2 encryption requirement violations
Correct answer: Supply chain reliability and availability risk for production CI/CD pipelines
Rate limiting on free Docker Hub accounts can disrupt CI/CD pipelines and production deployments, creating operational risk and potential SLA compliance failures.
Question 4: Which practice ensures Docker image build reproducibility, which is required for software supply chain compliance frameworks like SLSA?
- Using mutable tags like 'latest' for all base images
- Pinning base images to immutable digests (SHA256) in Dockerfiles (Correct answer)
- Rebuilding images without version constraints to get latest security patches automatically
- Storing Dockerfiles in developer workstations rather than version control
Correct answer: Pinning base images to immutable digests (SHA256) in Dockerfiles
Pinning to SHA256 digests ensures the exact same base image is used in every build, enabling reproducibility as required by SLSA provenance requirements.
Question 5: The EU Cyber Resilience Act (CRA) imposes requirements on products with digital elements. How does it affect companies distributing Docker-based commercial software?
- It only applies to hardware manufacturers, not software vendors
- Vendors must implement vulnerability handling processes, provide SBOMs, and report actively exploited vulnerabilities within 24 hours (Correct answer)
- CRA exempts containerized applications from security requirements
- Only open-source Docker images are subject to CRA obligations
Correct answer: Vendors must implement vulnerability handling processes, provide SBOMs, and report actively exploited vulnerabilities within 24 hours
The CRA requires manufacturers of products with digital elements to establish vulnerability management, provide SBOMs, and notify authorities of actively exploited vulnerabilities within 24 hours.
Question 6: Under FedRAMP authorization, which Docker registry practice is required for containerized applications in U.S. federal cloud environments?
- Using only Docker Hub public images without additional controls
- Operating a private registry within the FedRAMP authorization boundary with continuous image scanning (Correct answer)
- Exempting containers from FedRAMP controls due to their ephemeral nature
- Pulling images at runtime from external registries to reduce storage costs
Correct answer: Operating a private registry within the FedRAMP authorization boundary with continuous image scanning
FedRAMP requires all components within the authorization boundary to be controlled; a private registry with continuous scanning ensures images meet the required security posture.
Question 7: A company's Docker Compose file for a payment application contains hardcoded database credentials. Which regulatory framework is most directly violated?
- COPPA (Children's Online Privacy Protection Act)
- PCI DSS Requirement 8 (Identify and Authenticate Access to System Components) (Correct answer)
- ADA (Americans with Disabilities Act)
- DMCA (Digital Millennium Copyright Act)
Correct answer: PCI DSS Requirement 8 (Identify and Authenticate Access to System Components)
PCI DSS Req 8 prohibits use of shared or default credentials and requires unique IDs; hardcoded credentials in compose files violate these authentication requirements.
DCA Regulatory Compliance & Legal Framework 4
Which Docker capability should be dropped to comply with CIS Docker Benchmark recommendations for minimizing container attack surface?