DCA Risk Assessment & Management 3 — Questions and Answers
Question 1: Docker Content Trust (DCT) is enabled in a CI/CD pipeline. What specific risk does it mitigate?
- Unauthorized access to Docker volumes on the host filesystem
- Deployment of tampered or unsigned images from a registry (Correct answer)
- Excessive CPU usage by containers during peak load
- Misconfigured inter-container firewall rules
Correct answer: Deployment of tampered or unsigned images from a registry
DCT uses Notary to verify image signatures, ensuring that only images signed by trusted publishers are pulled and run.
Question 2: A security audit finds that the Docker daemon socket `/var/run/docker.sock` is mounted inside several application containers. Why is this classified as a critical risk?
- It exposes container logs to other containers on the same network
- It gives the container full control over the Docker daemon, equivalent to root access on the host (Correct answer)
- It causes the container to restart automatically when the daemon restarts
- It prevents the container from being stopped with `docker stop`
Correct answer: It gives the container full control over the Docker daemon, equivalent to root access on the host
Access to the Docker socket allows a container to issue any Docker API command, including spawning new privileged containers that mount the host filesystem.
Question 3: In a multi-tenant Docker environment, which Linux kernel feature provides the PRIMARY isolation boundary between containers on the same host?
- iptables rules managed by Docker networking
- Namespaces, which isolate process, network, mount, and user views between containers (Correct answer)
- Union filesystems like OverlayFS that separate image layers
- Docker Compose profiles that group related services
Correct answer: Namespaces, which isolate process, network, mount, and user views between containers
Linux namespaces (pid, net, mnt, uts, ipc, user) create isolated views of system resources for each container, forming the core isolation mechanism.
Question 4: An organization's risk policy requires that no container run as UID 0. Which Dockerfile instruction enforces this at the image level?
- EXPOSE 8080
- VOLUME /data
- USER nonroot (Correct answer)
- ENTRYPOINT ["/bin/sh"]
Correct answer: USER nonroot
The `USER` instruction sets the default user for subsequent RUN, CMD, and ENTRYPOINT instructions, preventing the container from running as root.
Question 5: Which attack vector is introduced when using the `docker build --network=host` option in an untrusted build environment?
- Build arguments are exposed in the final image metadata
- The build context can access host network resources, allowing exfiltration or SSRF via build steps (Correct answer)
- The resulting image is automatically pushed to a public registry
- Base image layers are skipped, causing incomplete builds
Correct answer: The build context can access host network resources, allowing exfiltration or SSRF via build steps
Host networking during build gives RUN instructions unrestricted access to the host's network interfaces, enabling data exfiltration or lateral movement.
Question 6: A DevSecOps team wants to automatically fail CI/CD pipelines when a Docker image contains a CRITICAL severity CVE. Which approach achieves this?
- Manually review Docker Hub tags before each deployment
- Integrate a vulnerability scanner (e.g., Trivy, Grype) with an exit-code policy that fails on CRITICAL findings (Correct answer)
- Enable Docker Content Trust and sign all images before scanning
- Use `docker inspect` to check image labels for CVE counts
Correct answer: Integrate a vulnerability scanner (e.g., Trivy, Grype) with an exit-code policy that fails on CRITICAL findings
Scanners like Trivy support `--exit-code 1 --severity CRITICAL`, which causes the CI step to fail when critical vulnerabilities are found.
Question 7: Which Docker Swarm feature protects sensitive configuration data (passwords, TLS certs) at rest and in transit between manager and worker nodes?
- Docker volumes with encrypted drivers
- Overlay networks with VXLAN encapsulation
- Docker Secrets, stored encrypted in the Raft log and mounted in-memory in containers (Correct answer)
- Environment variables passed via `docker service create --env`
Correct answer: Docker Secrets, stored encrypted in the Raft log and mounted in-memory in containers
Docker Secrets are encrypted in the Raft log, transmitted over mutual TLS, and mounted as a tmpfs file inside the container so they never touch disk on workers.
DCA Risk Assessment & Management 3
Docker Content Trust (DCT) is enabled in a CI/CD pipeline.
What specific risk does it mitigate?