DCA Risk Assessment & Management 2 — Questions and Answers
Question 1: A security team discovers that several Docker containers are running with the `--privileged` flag in production. What is the PRIMARY risk this introduces?
- Containers consume more CPU and memory resources than necessary
- Containers gain access to all host devices and can escape the container isolation boundary (Correct answer)
- Containers cannot communicate with each other over the default bridge network
- Containers are prevented from pulling updated images from a registry
Correct answer: Containers gain access to all host devices and can escape the container isolation boundary
The `--privileged` flag grants the container nearly all capabilities of the host kernel, allowing potential container escape and full host compromise.
Question 2: When assessing risk in a Docker Swarm deployment, which component is considered the most critical to protect because its compromise affects the entire cluster?
- Worker nodes running application containers
- The overlay network used for inter-service communication
- Manager nodes, which control cluster state and secret distribution (Correct answer)
- The local Docker daemon on each node
Correct answer: Manager nodes, which control cluster state and secret distribution
Swarm manager nodes hold the cluster's Raft consensus state, orchestrate workloads, and distribute secrets, making them the highest-value target.
Question 3: An organization wants to reduce the attack surface of its container images. Which practice BEST achieves this goal?
- Using full OS base images like ubuntu:latest to ensure all tools are available
- Running containers as the root user to avoid permission errors
- Using minimal or distroless base images and removing unnecessary packages (Correct answer)
- Disabling Docker Content Trust to speed up image pulls
Correct answer: Using minimal or distroless base images and removing unnecessary packages
Minimal or distroless images contain only the application and its runtime dependencies, eliminating unused tools that attackers could exploit.
Question 4: Which Docker feature allows you to enforce mandatory access controls by restricting the system calls a container can make to the host kernel?
- Docker volumes
- Seccomp profiles (Correct answer)
- Docker Compose networks
- Health checks
Correct answer: Seccomp profiles
Seccomp (Secure Computing Mode) profiles define an allowlist or blocklist of Linux system calls available to a container, reducing kernel attack surface.
Question 5: A developer accidentally pushed a Docker image containing a hardcoded database password to a public registry. What is the CORRECT remediation approach?
- Delete only the specific layer containing the secret, then re-push the image
- Immediately rotate the compromised credential, remove all affected image versions, and audit access logs (Correct answer)
- Add a `.dockerignore` file and rebuild the image without pushing
- Change the image tag from `latest` to a random string to obscure the image
Correct answer: Immediately rotate the compromised credential, remove all affected image versions, and audit access logs
Rotating the credential limits blast radius immediately; removing all image versions prevents further exposure since image layers are immutable and may be cached.
Question 6: In a risk assessment of a Docker environment, which scanning approach identifies known CVEs in the OS packages and application libraries within an image?
- Runtime behavioral analysis of running containers
- Static image vulnerability scanning using a tool like Docker Scout or Trivy (Correct answer)
- Network traffic inspection between containers
- Reviewing Docker daemon audit logs
Correct answer: Static image vulnerability scanning using a tool like Docker Scout or Trivy
Static image scanners inspect image layers against CVE databases to identify known vulnerabilities in packages before the container is run.
Question 7: Which Docker resource constraint helps mitigate the risk of a single container consuming all available memory and causing a host-level out-of-memory condition?
- `--cpuset-cpus` flag to pin the container to specific CPU cores
- `--memory` flag to set a hard memory limit for the container (Correct answer)
- `--ulimit nofile` to restrict file descriptor usage
- `--network none` to disable networking for the container
Correct answer: `--memory` flag to set a hard memory limit for the container
The `--memory` flag enforces a hard cap on RAM usage; when exceeded, the container process is OOM-killed rather than starving the host.
DCA Risk Assessment & Management 2
A security team discovers that several Docker containers are running with the `--privileged` flag in production.
What is the PRIMARY risk this introduces?