IncludeHelp_logo
Skip Navigation Links
×

Trending Technologies MCQs

Home » Trending Technologies MCQs

Container Security MCQs (Multiple-Choice Questions)

Test your knowledge of Container Security with these multiple-choice questions. This collection covers container images, Docker security, Kubernetes protection, image vulnerabilities, runtime monitoring, access control, secrets management, network policies, container isolation, and secure deployment practices.

Container Security MCQs

Container Security involves protecting containerized applications, their images, runtime environments, orchestration platforms, and supporting infrastructure throughout the software development lifecycle. Containers package applications and their dependencies into portable units, but insecure images, excessive privileges, exposed secrets, and misconfigured orchestration settings can introduce security risks.

Effective container security combines secure image creation, vulnerability scanning, trusted registries, least-privilege access, runtime protection, network segmentation, and continuous monitoring. These controls help organizations reduce the attack surface of containerized workloads across development, testing, and production environments.

List of Container Security MCQs

The following questions cover foundational container concepts, image security, Docker configuration, Kubernetes security, isolation mechanisms, supply chain protection, runtime threat detection, and practical security scenarios. Each question includes four options, the correct answer, and an explanation to support learning and cybersecurity exam preparation.

1. What is the primary objective of Container Security?

  1. To eliminate the need for operating system updates
  2. To protect container images, running containers, orchestration systems, and related infrastructure
  3. To replace every application with a virtual machine
  4. To increase container sizes regardless of application requirements

Answer: B) To protect container images, running containers, orchestration systems, and related infrastructure

Explanation:

Container Security addresses risks throughout the container lifecycle, including image creation, deployment, runtime execution, and retirement. It combines preventive controls, vulnerability management, access restrictions, and monitoring.

2. What is a container image?

  1. A physical server used to host applications
  2. A network firewall rule set
  3. A database containing only user passwords
  4. A packaged template containing an application, its dependencies, and filesystem content needed to create a container

Answer: D) A packaged template containing an application, its dependencies, and filesystem content needed to create a container

Explanation:

A container image provides the filesystem and configuration used to create a container. It commonly includes application code, runtime libraries, and other dependencies. Images can be stored in registries and reused to create multiple containers.

3. What is the main security risk of using an outdated container image?

  1. It may contain known vulnerabilities that attackers can exploit
  2. It automatically encrypts every application file
  3. It guarantees that the application will run without errors
  4. It prevents the container from accessing its filesystem

Answer: A) It may contain known vulnerabilities that attackers can exploit

Explanation:

Outdated images may include vulnerable operating system packages, libraries, and application dependencies. Regular rebuilding, vulnerability assessment, and timely updates help reduce exposure to known security weaknesses.

4. What is the purpose of container image scanning?

  1. To measure the physical dimensions of the host server
  2. To assign IP addresses to office printers
  3. To identify known vulnerabilities and potentially risky components in container images
  4. To guarantee that an application contains no possible security flaws

Answer: C) To identify known vulnerabilities and potentially risky components in container images

Explanation:

Image scanners examine operating system packages, application dependencies, and sometimes configuration or secret exposure. Scanning helps teams prioritize remediation, although it cannot guarantee that an image is free from every vulnerability or malicious component.

5. Why should containers generally run as non-root users when possible?

  1. To ensure every process has unrestricted system access
  2. To reduce the potential impact if an attacker compromises a process inside the container
  3. To eliminate the need for application authentication
  4. To prevent all network communication

Answer: B) To reduce the potential impact if an attacker compromises a process inside the container

Explanation:

Running applications as non-root limits the privileges available to a compromised process. It is an important least-privilege practice, although additional controls are needed because container isolation and host security still matter.

6. What is a container registry?

  1. A physical device that monitors room temperature
  2. A tool used exclusively for source code formatting
  3. A system that assigns permissions to office doors
  4. A service for storing, managing, and distributing container images

Answer: D) A service for storing, managing, and distributing container images

Explanation:

Container registries store images and make them available to development pipelines, deployment systems, and container runtimes. Secure registry practices include access controls, image scanning, trusted publishing, and protection of credentials.

7. What does the principle of least privilege mean in container security?

  1. Granting containers only the permissions and capabilities required for their intended tasks
  2. Giving every container unrestricted root access
  3. Disabling authentication for all container workloads
  4. Allowing every application to modify the host operating system

Answer: A) Granting containers only the permissions and capabilities required for their intended tasks

Explanation:

Least privilege limits the permissions available to applications and container processes. Organizations can apply it through non-root execution, restricted Linux capabilities, carefully scoped service accounts, and appropriate filesystem permissions.

8. What is container escape?

  1. A process that normally exits after completing its task
  2. A method for compressing container images
  3. An attack in which an attacker breaks out of container isolation to access the host or other protected resources
  4. A routine procedure for deleting an unused image

Answer: C) An attack in which an attacker breaks out of container isolation to access the host or other protected resources

Explanation:

Container escape occurs when an attacker bypasses isolation boundaries, potentially through a runtime vulnerability, a kernel flaw, or a dangerous configuration. Restricting privileges, patching hosts, and reducing unnecessary host access help mitigate this risk.

9. Which technology provides important process, filesystem, and network isolation for containers on Linux?

  1. Spreadsheet formulas
  2. Linux namespaces and control groups
  3. Browser bookmarks
  4. Image compression algorithms alone

Answer: B) Linux namespaces and control groups

Explanation:

Linux namespaces isolate views of resources such as processes, networking, and mount points. Control groups, or cgroups, organize and limit resource usage. These mechanisms contribute to container isolation but do not eliminate every security risk.

10. Why is mounting the host filesystem into a container a security concern?

  1. It automatically disables every application log
  2. It prevents the container from accessing any files
  3. It always makes the container image smaller
  4. It may expose sensitive host files or allow unauthorized modifications, depending on the mount and permissions

Answer: D) It may expose sensitive host files or allow unauthorized modifications, depending on the mount and permissions

Explanation:

Host mounts can expose configuration files, credentials, runtime sockets, or other sensitive resources. Organizations should avoid unnecessary mounts, prefer read-only access where suitable, and carefully restrict the files and directories available to containers.

11. What is the purpose of a Kubernetes namespace?

  1. To logically organize and scope many Kubernetes resources within a cluster
  2. To encrypt every container image automatically
  3. To replace the Kubernetes API server
  4. To guarantee complete isolation between all workloads by itself

Answer: A) To logically organize and scope many Kubernetes resources within a cluster

Explanation:

Kubernetes namespaces organize resources and support scoped access controls and policies. However, namespaces alone do not provide complete security isolation; additional controls such as RBAC, network policies, and pod security settings may be required.

12. What is the main purpose of Kubernetes Role-Based Access Control (RBAC)?

  1. To allocate CPU resources based only on container size
  2. To ensure that every user has cluster-admin permissions
  3. To control which users and service accounts can perform specific actions on Kubernetes resources
  4. To replace network encryption

Answer: C) To control which users and service accounts can perform specific actions on Kubernetes resources

Explanation:

Kubernetes RBAC uses roles and bindings to grant permissions to users, groups, and service accounts. Carefully scoped permissions reduce the risk of unauthorized workload changes, secret access, or cluster administration.

13. What is the purpose of Kubernetes NetworkPolicy?

  1. To scan application source code for formatting errors
  2. To define rules governing permitted network traffic to and from selected pods, when supported by the network implementation
  3. To replace container image registries
  4. To guarantee that every network connection is encrypted

Answer: B) To define rules governing permitted network traffic to and from selected pods, when supported by the network implementation

Explanation:

NetworkPolicy can restrict pod communication and support network segmentation. Its actual enforcement depends on a compatible network plugin, and separate controls may be needed for encryption, external traffic, or other network paths.

14. Why should secrets not be hardcoded into container images?

  1. Hardcoded secrets automatically expire after one minute
  2. They prevent the container from starting
  3. They make vulnerability scanning impossible in every case
  4. They may be exposed to anyone who can access or inspect the image

Answer: D) They may be exposed to anyone who can access or inspect the image

Explanation:

Passwords, API keys, and tokens embedded in image layers can remain recoverable even if a later image layer deletes the visible file. Use appropriate secret management mechanisms, restrict access, and rotate exposed credentials.

15. What is the purpose of a container runtime?

  1. To create and manage container execution using images and runtime configuration
  2. To write all application source code automatically
  3. To replace every network security device
  4. To manage employee payroll records

Answer: A) To create and manage container execution using images and runtime configuration

Explanation:

A container runtime handles operations required to run containers, including creating processes and applying configured isolation. Examples include containerd and CRI-O, which are commonly used in Kubernetes environments.

16. What is the security benefit of using minimal container images?

  1. They eliminate the need for patching
  2. They guarantee that application code has no vulnerabilities
  3. They reduce unnecessary packages and components that could increase the attack surface
  4. They provide every process with administrator privileges

Answer: C) They reduce unnecessary packages and components that could increase the attack surface

Explanation:

Minimal images contain fewer unnecessary tools, libraries, and services. This can reduce the number of components requiring maintenance and limit opportunities for exploitation, although the remaining components must still be secured and updated.

17. What is the purpose of image signing in container security?

  1. To compress the image without changing its size
  2. To provide a means of verifying image authenticity and integrity against a trusted signing identity
  3. To guarantee that the image contains no vulnerabilities
  4. To prevent the image from being stored in a registry

Answer: B) To provide a means of verifying image authenticity and integrity against a trusted signing identity

Explanation:

Image signing can help establish that an image or artifact came from an expected publisher and has not been altered since signing. Verification depends on trusted keys or identities and policy enforcement; signing does not itself prove that the image is safe.

18. What is a software bill of materials (SBOM)?

  1. A list of physical computers in a data center
  2. A report containing only application screenshots
  3. A record of container startup times only
  4. A structured inventory of software components and dependencies included in a software artifact

Answer: D) A structured inventory of software components and dependencies included in a software artifact

Explanation:

An SBOM identifies software components and dependencies used in an application or artifact. Security teams can use it to determine whether a newly disclosed vulnerability affects components included in their container images.

19. What is the purpose of a read-only root filesystem for a container?

  1. To prevent unauthorized modifications to the container's root filesystem during execution, where the application can operate with that restriction
  2. To prevent all network communication
  3. To disable every security log
  4. To allow any process to modify host system files

Answer: A) To prevent unauthorized modifications to the container's root filesystem during execution, where the application can operate with that restriction

Explanation:

A read-only root filesystem limits the ability of a compromised process to alter files within the container's root filesystem. Applications that require writable temporary or data locations can use carefully scoped writable mounts.

20. What is a container image layer?

  1. A physical shelf used to store server equipment
  2. A Kubernetes user account
  3. A filesystem change set that forms part of an image's layered structure
  4. A network firewall appliance

Answer: C) A filesystem change set that forms part of an image's layered structure

Explanation:

Container images commonly consist of multiple filesystem layers. Because earlier layers may remain part of the image even when later layers remove files, sensitive information should never be placed in an image during its build process.

21. Why should organizations avoid using the privileged mode for containers unless absolutely necessary?

  1. It prevents applications from using memory
  2. It can grant substantially expanded access to host resources and weaken isolation
  3. It automatically removes all container logs
  4. It makes every image immutable

Answer: B) It can grant substantially expanded access to host resources and weaken isolation

Explanation:

Privileged containers may receive broad Linux capabilities and access to devices or host resources that ordinary containers cannot access. Avoiding privileged mode unless justified helps reduce the impact of a compromised workload.

22. What is the purpose of Linux seccomp in container security?

  1. To replace all container networking components
  2. To manage cloud billing information
  3. To guarantee that application code is free of bugs
  4. To restrict the system calls that a process can make according to a configured filter

Answer: D) To restrict the system calls that a process can make according to a configured filter

Explanation:

Seccomp can limit the system calls available to a process, reducing its interaction with the kernel. A suitable profile can reduce the attack surface, although it must permit the system calls required by the application.

23. What is the purpose of Linux capabilities in container security?

  1. To divide certain privileged operations into separately controllable permissions
  2. To provide every application with unlimited root access
  3. To replace all application dependencies
  4. To guarantee that network traffic is encrypted

Answer: A) To divide certain privileged operations into separately controllable permissions

Explanation:

Linux capabilities allow administrators to grant or remove specific privileged operations without necessarily giving a process unrestricted root privileges. Dropping unnecessary capabilities helps reduce the impact of a compromise.

24. What is the main security purpose of Kubernetes admission control?

  1. To compress all container images automatically
  2. To replace the Kubernetes scheduler
  3. To validate or modify API requests before the requested changes are persisted
  4. To guarantee that every deployed application is vulnerability-free

Answer: C) To validate or modify API requests before the requested changes are persisted

Explanation:

Kubernetes admission control can enforce policies before resources are accepted. For example, admission policies can reject workloads that request privileged execution or fail to meet specified security requirements.

25. What is the purpose of Kubernetes Pod Security Standards?

  1. To define policies for application billing
  2. To describe security profiles that restrict risky pod configurations
  3. To replace all container registries
  4. To guarantee that every pod runs with root privileges

Answer: B) To describe security profiles that restrict risky pod configurations

Explanation:

Kubernetes Pod Security Standards define profiles such as Privileged, Baseline, and Restricted. These profiles describe levels of restrictions on pod security settings and can be enforced through the built-in Pod Security Admission mechanism or other policy controls.

26. Why should container secrets be rotated after a suspected exposure?

  1. To increase the size of every container image
  2. To prevent applications from accessing any configuration data
  3. To ensure that every container uses the same permanent password
  4. To invalidate or replace potentially compromised credentials and reduce the risk of unauthorized access

Answer: D) To invalidate or replace potentially compromised credentials and reduce the risk of unauthorized access

Explanation:

If a secret has been exposed, simply removing it from a configuration file may not be enough. Organizations should revoke or rotate the credential, investigate possible misuse, and update authorized consumers securely.

27. What is runtime security monitoring for containers?

  1. Monitoring running workloads for suspicious processes, system calls, file activity, and network behavior
  2. Scanning only the physical color of server racks
  3. Checking container image names without examining any activity
  4. Replacing the container runtime with a spreadsheet

Answer: A) Monitoring running workloads for suspicious processes, system calls, file activity, and network behavior

Explanation:

Runtime monitoring observes container behavior after deployment. It can help detect unexpected shells, unusual process execution, suspicious access to sensitive files, or attempts to interfere with the host or other workloads.

28. What is a major risk of exposing the Docker daemon socket to a container?

  1. The container automatically becomes read-only
  2. The container can no longer access its filesystem
  3. A process with access to the socket may gain extensive control over the Docker host and its containers
  4. The host operating system stops generating logs

Answer: C) A process with access to the socket may gain extensive control over the Docker host and its containers

Explanation:

The Docker daemon socket provides access to powerful container management operations. If an attacker gains control over a socket with elevated privileges, the attacker may be able to create privileged containers or access sensitive host resources.

29. Why is it important to use trusted base images?

  1. Trusted images never need security updates
  2. They help reduce exposure to tampered, malicious, or poorly maintained image components
  3. They guarantee that every application is free of vulnerabilities
  4. They remove the need for image provenance checks

Answer: B) They help reduce exposure to tampered, malicious, or poorly maintained image components

Explanation:

Trusted and maintained base images provide a stronger starting point for application builds. Organizations should verify image sources, review provenance where available, scan components, and update base images as vulnerabilities are addressed.

30. What is the purpose of a container security policy?

  1. To guarantee that no container will ever fail
  2. To replace application testing entirely
  3. To ensure every container uses identical resource limits regardless of need
  4. To define required security settings and rules for building, deploying, and running containers

Answer: D) To define required security settings and rules for building, deploying, and running containers

Explanation:

A container security policy establishes requirements such as trusted image sources, non-root execution, approved privileges, secret handling, and vulnerability thresholds. Automated policy checks can help enforce these requirements consistently.

31. What is the purpose of a container image digest?

  1. To identify image content using a content-derived cryptographic value
  2. To reveal the physical location of the container host
  3. To guarantee that the image has no malware
  4. To assign administrator privileges to the image

Answer: A) To identify image content using a content-derived cryptographic value

Explanation:

An image digest identifies particular content and can help ensure that deployments refer to the expected image. Digests improve reference consistency, but authenticity and safety still depend on trusted sources, verification, scanning, and policy enforcement.

32. Why should container workloads have appropriate CPU and memory limits?

  1. To guarantee that every workload receives unlimited resources
  2. To prevent the need for application monitoring
  3. To reduce the risk that a workload consumes excessive resources and affects other workloads or the host
  4. To eliminate every possible denial-of-service attack

Answer: C) To reduce the risk that a workload consumes excessive resources and affects other workloads or the host

Explanation:

Resource limits help control the amount of CPU and memory a workload can consume. They reduce the risk of resource exhaustion caused by faulty applications or malicious activity, although they do not prevent every form of denial of service.

33. What is the purpose of a container vulnerability management process?

  1. To retain every vulnerable image in production indefinitely
  2. To identify, prioritize, remediate, and verify vulnerabilities affecting container components
  3. To disable all package updates
  4. To replace vulnerability assessment with image naming conventions

Answer: B) To identify, prioritize, remediate, and verify vulnerabilities affecting container components

Explanation:

Vulnerability management includes scanning images, evaluating severity and exposure, updating affected packages, rebuilding images, and verifying remediation. Teams should consider exploitability, deployment context, and the availability of fixes when prioritizing work.

34. What is a container supply chain attack?

  1. A normal process of downloading an approved container image
  2. A routine application restart during deployment
  3. A method for measuring CPU consumption
  4. An attack that compromises software components, build systems, registries, or distribution processes used to deliver containers

Answer: D) An attack that compromises software components, build systems, registries, or distribution processes used to deliver containers

Explanation:

Container supply chain attacks may involve malicious dependencies, compromised build pipelines, tampered images, or stolen registry credentials. Provenance verification, controlled build systems, dependency assessment, and image signing can reduce these risks.

35. What is the purpose of a multi-stage Docker build?

  1. To separate build-time dependencies from the final runtime image and potentially reduce its size and attack surface
  2. To guarantee that application code cannot contain vulnerabilities
  3. To give every container unrestricted access to the host
  4. To disable image versioning

Answer: A) To separate build-time dependencies from the final runtime image and potentially reduce its size and attack surface

Explanation:

Multi-stage builds allow developers to compile or prepare an application in one stage and copy only required artifacts into a later stage. This can exclude unnecessary compilers, build tools, and temporary files from the production image.

36. Why should Kubernetes service accounts be configured carefully?

  1. They determine the physical location of cluster nodes
  2. They automatically encrypt every network connection
  3. They provide identities to workloads and can grant access to Kubernetes API resources
  4. They eliminate the need for authorization checks

Answer: C) They provide identities to workloads and can grant access to Kubernetes API resources

Explanation:

Pods can use service accounts to authenticate to the Kubernetes API or other integrated systems. Unnecessary permissions or exposed credentials can allow compromised workloads to access sensitive resources, so permissions should be scoped carefully.

37. What is the security benefit of using immutable infrastructure practices for containers?

  1. It allows every running container to be modified without tracking changes
  2. It encourages replacing workloads with newly built, verified versions rather than making uncontrolled changes to running instances
  3. It eliminates the need for vulnerability scanning
  4. It guarantees that all deployments are automatically secure

Answer: B) It encourages replacing workloads with newly built, verified versions rather than making uncontrolled changes to running instances

Explanation:

Immutable infrastructure practices reduce configuration drift by treating deployed artifacts as replaceable units. Updates are made through controlled builds and deployments, improving consistency and traceability while still requiring vulnerability remediation and runtime monitoring.

38. Which practice helps protect container images stored in a private registry?

  1. Allowing anonymous write access to every repository
  2. Publishing registry credentials in application logs
  3. Disabling all access auditing
  4. Enforcing authentication, least-privilege repository permissions, and secure credential management

Answer: D) Enforcing authentication, least-privilege repository permissions, and secure credential management

Explanation:

Registry controls help prevent unauthorized image downloads, replacement, or publication. Authentication, scoped permissions, protected credentials, audit logs, and image verification can reduce the risk of tampering and unauthorized access.

39. What is the purpose of a container admission policy that rejects images with critical vulnerabilities?

  1. To prevent deployment of images that violate the organization's defined security requirements
  2. To guarantee that every accepted image is free of all security weaknesses
  3. To disable image scanning across the development pipeline
  4. To make vulnerability severity irrelevant

Answer: A) To prevent deployment of images that violate the organization's defined security requirements

Explanation:

An admission policy can block images that fail configured security checks. Effective enforcement depends on reliable scan results, suitable severity thresholds, exception management, and a process for updating or rebuilding affected images.

40. What should a security team do if a running container shows unexpected privileged process execution and suspicious outbound network traffic?

  1. Ignore the behavior because containers are always isolated
  2. Delete all cluster audit logs immediately
  3. Investigate the activity, assess potential compromise, and contain the workload according to incident response procedures
  4. Grant the container additional privileges to prevent errors

Answer: C) Investigate the activity, assess potential compromise, and contain the workload according to incident response procedures

Explanation:

Unexpected privileged activity and suspicious network connections may indicate compromise or abuse. The response should preserve relevant evidence, investigate the container and host, restrict malicious communication when appropriate, and follow the organization's containment and recovery process.

41. Why is Kubernetes audit logging important?

  1. It replaces authentication for the Kubernetes API
  2. It records API activity that can help investigators understand who performed actions and when
  3. It guarantees that no administrator can make an unauthorized change
  4. It prevents pods from being created

Answer: B) It records API activity that can help investigators understand who performed actions and when

Explanation:

Kubernetes audit logs can provide records of API requests, identities, operations, and results according to the configured audit policy. These records support investigations into unauthorized resource changes, privilege misuse, and suspicious administrative activity.

42. What is the main purpose of a service mesh in a containerized environment?

  1. To replace all container images with virtual machines
  2. To manage application source code compilation only
  3. To remove the need for service authentication
  4. To provide infrastructure for service-to-service communication controls, observability, and, where configured, traffic encryption

Answer: D) To provide infrastructure for service-to-service communication controls, observability, and, where configured, traffic encryption

Explanation:

A service mesh can manage communication between services and support capabilities such as mutual TLS, traffic policies, and telemetry. Security benefits depend on correct configuration and do not replace container, host, or application security controls.

43. Why should container logs be collected and monitored centrally?

  1. To support investigation, detect suspicious activity, and preserve records beyond the lifetime of short-lived containers
  2. To guarantee that all containers will remain running indefinitely
  3. To prevent applications from producing events
  4. To replace all access control policies

Answer: A) To support investigation, detect suspicious activity, and preserve records beyond the lifetime of short-lived containers

Explanation:

Containers may be replaced or terminated during normal operations, which can make local logs difficult to retain. Centralized collection helps correlate events across workloads and provides historical evidence for security monitoring and incident response.

44. What is the purpose of a Kubernetes security context?

  1. To define the physical location of a cluster
  2. To replace every namespace with a separate operating system
  3. To configure security-related settings such as user identity, privilege escalation, capabilities, and filesystem behavior
  4. To automatically remove all application vulnerabilities

Answer: C) To configure security-related settings such as user identity, privilege escalation, capabilities, and filesystem behavior

Explanation:

Security contexts allow pod and container settings to control how processes execute. Relevant settings can include running as a non-root user, disabling privilege escalation, dropping capabilities, and mounting a read-only root filesystem.

45. What is the purpose of a vulnerability exception in a container security program?

  1. To permanently exempt every image from security assessment
  2. To document and authorize a specific, justified deviation from a security requirement under defined conditions
  3. To hide vulnerabilities from every security analyst
  4. To guarantee that an accepted vulnerability can never be exploited

Answer: B) To document and authorize a specific, justified deviation from a security requirement under defined conditions

Explanation:

An exception may be necessary when a fix is unavailable or immediate remediation is not feasible. It should include justification, risk assessment, ownership, compensating controls, approval, and an expiration or review date.

46. Which practice is most appropriate when a container image is found to contain a critical vulnerability?

  1. Ignore the finding if the image was downloaded from a popular registry
  2. Remove the vulnerability report without investigating the affected component
  3. Continue deploying the image indefinitely without assessment
  4. Assess exposure and impact, update or replace the vulnerable component, rebuild the image, and verify the remediation

Answer: D) Assess exposure and impact, update or replace the vulnerable component, rebuild the image, and verify the remediation

Explanation:

A critical vulnerability requires timely assessment based on exploitability, exposure, and available fixes. Rebuilding and redeploying a corrected image is generally preferable to making untracked changes inside running containers, followed by verification that the vulnerable component is addressed.

47. What is the purpose of Kubernetes resource quotas?

  1. To limit the aggregate consumption of specified resources within a namespace
  2. To guarantee that every workload receives unlimited CPU
  3. To replace container image signing
  4. To prevent every user from accessing the Kubernetes API

Answer: A) To limit the aggregate consumption of specified resources within a namespace

Explanation:

Resource quotas can constrain the total amount of selected resources, such as CPU requests, memory requests, or the number of certain objects in a namespace. They help manage resource consumption but should be combined with suitable workload-level controls.

48. Why should organizations monitor container runtime events?

  1. To guarantee that all containers have identical process trees
  2. To eliminate the need for vulnerability scanning
  3. To detect unexpected execution, privilege changes, suspicious file access, and other potentially malicious runtime behavior
  4. To prevent all containers from communicating with approved services

Answer: C) To detect unexpected execution, privilege changes, suspicious file access, and other potentially malicious runtime behavior

Explanation:

Runtime monitoring can reveal suspicious behavior that was not apparent during image scanning. It helps security teams investigate compromised workloads, identify possible abuse of privileges, and correlate activity with logs from the host and orchestration platform.

49. Which sequence best represents a secure container deployment workflow?

  1. Deploy an unverified image, grant full privileges, and scan it only after an incident
  2. Build from trusted sources, scan and verify the image, enforce deployment policies, run with least privilege, and monitor runtime activity
  3. Store secrets in image layers, disable logging, and permit unrestricted network access
  4. Skip image verification and grant every workload access to the host filesystem

Answer: B) Build from trusted sources, scan and verify the image, enforce deployment policies, run with least privilege, and monitor runtime activity

Explanation:

A secure deployment workflow combines supply chain controls, image assessment, policy enforcement, least-privilege configuration, and runtime monitoring. These measures address different risks and should work together throughout the container lifecycle.

50. A company operates a Kubernetes cluster. A security scanner discovers a critical vulnerability in an application image running in production. Investigation confirms that a fixed version of the affected package is available. The workload also runs as root and has unnecessary Linux capabilities. What is the most appropriate remediation plan?

  1. Ignore the vulnerability because Kubernetes automatically isolates every container from all threats
  2. Delete the cluster immediately without preserving relevant evidence or assessing business impact
  3. Rebuild the image with the fixed package, scan and verify the new image, deploy it through the approved process, and reduce privileges and unnecessary capabilities
  4. Disable image scanning and grant additional privileges to the existing container

Answer: C) Rebuild the image with the fixed package, scan and verify the new image, deploy it through the approved process, and reduce privileges and unnecessary capabilities

Explanation:

The critical vulnerability should be addressed by updating the affected package and producing a corrected image. The organization should scan and verify the replacement, deploy it through a controlled release process, and confirm that the vulnerable version is no longer running. Configuring the workload to run as a non-root user and dropping unnecessary capabilities reduces the potential impact of a future compromise. The team should also assess exposure, review relevant logs, and monitor the workload after remediation.

Comments and Discussions!

Load comments ↻



Top MCQs
Top Programs/Examples
Top Tutorials
About
Student's Section
Subscribe

Copyright © 2026 www.includehelp.com. All rights reserved.