DCA Risk Assessment & Management 4 — Questions and Answers
Question 1: When conducting a risk assessment for Docker daemon exposure, which configuration change MOST reduces the network attack surface of the daemon?
- Enabling the Docker daemon to listen on `tcp://0.0.0.0:2375` for remote management
- Configuring the daemon to listen only on a Unix socket and requiring mutual TLS for any TCP exposure (Correct answer)
- Disabling all container logging drivers to reduce daemon overhead
- Setting the daemon's default ulimit to unlimited for maximum compatibility
Correct answer: Configuring the daemon to listen only on a Unix socket and requiring mutual TLS for any TCP exposure
Unauthenticated TCP exposure of the Docker daemon is a critical risk; mutual TLS with client certificates ensures only authorized clients can connect remotely.
Question 2: A container workload requires reading from `/etc/passwd` on the host. An assessor flags this as high risk. What mitigation maintains functionality while reducing risk?
- Mount the file as a read-only bind mount (`--mount type=bind,source=/etc/passwd,target=/etc/passwd,readonly`) (Correct answer)
- Run the container with `--privileged` to ensure full host filesystem access
- Copy `/etc/passwd` into the container image during the build stage
- Use `--cap-add SYS_PTRACE` to allow the container to inspect host processes
Correct answer: Mount the file as a read-only bind mount (`--mount type=bind,source=/etc/passwd,target=/etc/passwd,readonly`)
A read-only bind mount grants the container access to the specific file without allowing writes or granting broader host filesystem permissions.
Question 3: In a Docker environment, what does the term 'image provenance' refer to in the context of supply chain risk?
- The geographic region where the Docker registry is hosted
- The verified chain of custody showing where an image was built, by whom, and from what source (Correct answer)
- The number of times an image has been downloaded from a registry
- The compression algorithm used to store image layers
Correct answer: The verified chain of custody showing where an image was built, by whom, and from what source
Image provenance tracks the build origin, build process, and signing chain, allowing consumers to verify the image was produced by a trusted, untampered pipeline.
Question 4: Which cgroup-based Docker flag prevents a container from consuming excessive CPU and impacting other workloads on the same host?
- `--memory-swap`
- `--cpu-shares` or `--cpus` (Correct answer)
- `--blkio-weight`
- `--pids-limit`
Correct answer: `--cpu-shares` or `--cpus`
`--cpus` sets a hard CPU quota and `--cpu-shares` sets relative weight, both using Linux cgroups to prevent a container from monopolizing CPU resources.
Question 5: An assessor recommends enabling AppArmor profiles for Docker containers. What category of risk does this specifically address?
- Network-based denial-of-service attacks targeting the container's open ports
- Unauthorized file system access and process execution within the container (Correct answer)
- Misconfigured Docker Compose service dependencies
- Registry authentication failures during image pulls
Correct answer: Unauthorized file system access and process execution within the container
AppArmor profiles use mandatory access control to restrict which files, directories, and executables a container process can access, limiting exploit impact.
Question 6: What is the security risk of using mutable image tags like `myapp:latest` in production deployments instead of immutable digest references?
- Mutable tags increase image pull latency due to additional metadata lookups
- A registry could serve a different, potentially malicious image under the same tag without detection (Correct answer)
- Latest tags are automatically blocked by Docker Content Trust
- Mutable tags prevent containers from being restarted by Docker Swarm
Correct answer: A registry could serve a different, potentially malicious image under the same tag without detection
Tags can be overwritten in a registry at any time; using a specific digest (sha256:...) ensures you always run the exact same image bytes.
Question 7: During a Docker environment risk review, the auditor notes containers are on the default bridge network (`docker0`). What inter-container communication risk does this present?
- Containers on the default bridge cannot reach external internet resources
- By default, all containers on the default bridge can communicate with each other without restriction (Correct answer)
- Containers on the default bridge automatically expose all ports to the host network
- The default bridge network disables DNS resolution between containers
Correct answer: By default, all containers on the default bridge can communicate with each other without restriction
The default bridge network allows unrestricted lateral communication between all containers on it; user-defined bridge networks and `--icc=false` are recommended to segment traffic.
DCA Risk Assessment & Management 4
When conducting a risk assessment for Docker daemon exposure, which configuration change MOST reduces the network attack surface of the daemon?