Disclaimer:
Educational Use Only:
The website links provided are to be used strictly for educational and knowledge-gaining purposes only.
No Misuse:
Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.
Respect for Websites and Businesses:
Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.
Acknowledge Value of Knowledge:
Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.
No Endorsement:
The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.
User Responsibility:
By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.
- Container security primarily involves protecting containerized applications across their lifecycle. Which phase is not typically included in container security scope?
a. Image creation
b. Deployment
c. Execution (runtime)
d. Hardware fabrication
Answer: d. Hardware fabrication (Palo Alto Networks) - Which kernel features are commonly used to enforce isolation in containers?
a. Namespaces and cgroups
b. Virtual machines and hypervisors
c. Load balancers and proxies
d. RAID and LVM
Answer: a. Namespaces and cgroups (Sysdig) - The NIST publication on container security is titled:
a. NIST SP 800-53
b. NIST SP 800-190
c. NIST SP 800-207
d. NIST SP 800-171
Answer: b. NIST SP 800-190 (NIST Publications) - Which of the following is a vulnerability scanning tool for container images?
a. Clair
b. Kubernetes
c. Docker Swarm
d. etcd
Answer: a. Clair (wiz.io) - What is the difference between container security and general cloud workload security?
a. Container security focuses on images, runtime behavior, and orchestrator config
b. Container security ignores orchestration
c. Container security and workload security are identical
d. Workload security is only for VMs
Answer: a. Container security focuses on images, runtime behavior, and orchestrator config (Tenable®) - Which security practice involves scanning container images before deployment to detect known vulnerabilities?
a. Runtime protection
b. Image scanning
c. Network segmentation
d. Host hardening
Answer: b. Image scanning (wiz.io) - In the STRIDE threat model applied to container ecosystems, which “D” refers to tampering of container images?
a. Denial
b. Disclosure
c. Denial of Service
d. Tampering
Answer: d. Tampering (arXiv) - What is “container escape”?
a. When a container migrates to another host
b. When a process in a container breaks the isolation and attacks the host
c. When a container image is pushed to a registry
d. When a container is scaled up
Answer: b. When a process in a container breaks the isolation and attacks the host (arXiv) - Which of these is not considered a best practice for container security?
a. Using minimal base images
b. Running containers as root by default
c. Enforcing least privilege
d. Enabling image signing and verification
Answer: b. Running containers as root by default (Sysdig) - What is “shift-left” security in the context of containers?
a. Moving security to post-production
b. Integrating security earlier in development (CI/CD)
c. Delaying security testing
d. Ignoring security at build time
Answer: b. Integrating security earlier in development (CI/CD) (Sysdig) - Which open-source tool is used for runtime security / intrusion detection in container environments?
a. Falco
b. Kubernetes
c. Docker
d. etcd
Answer: a. Falco (wiz.io) - What does a container registry primarily provide?
a. Orchestration of containers
b. Storage and distribution of container images
c. Runtime isolation
d. Load balancing
Answer: b. Storage and distribution of container images (Sanfoundry) - Which of these is a major risk in containers due to their tight coupling with host kernel?
a. Kernel exploits
b. Encrypted data at rest
c. Static file systems
d. DNS resolution failure
Answer: a. Kernel exploits (Sysdig) - What is runtime protection in container security?
a. Hardening the host OS only
b. Monitoring, detecting, and blocking malicious behavior during container execution
c. Only scanning images before deployment
d. Encryption at rest
Answer: b. Monitoring, detecting, and blocking malicious behavior during container execution (SentinelOne) - Secrets management in containers often involves which tool?
a. HashiCorp Vault
b. Docker Swarm
c. Kubernetes Service
d. etcd plain text
Answer: a. HashiCorp Vault (wiz.io) - What is the principle of least privilege applied to containers?
a. Give containers full root access
b. Limit container permissions to minimum needed
c. Disable all permissions
d. Grant all containers network admin rights
Answer: b. Limit container permissions to minimum needed (Codacy Blog) - Which orchestrator is most commonly used with containerized deployments?
a. Kubernetes
b. Hadoop
c. OpenStack
d. RabbitMQ
Answer: a. Kubernetes (Wikipedia) - What is an admission controller in Kubernetes?
a. A container runtime
b. A module that intercepts API requests to enforce policies
c. A load balancer
d. A storage driver
Answer: b. A module that intercepts API requests to enforce policies (e.g. validating or mutating) (Codacy Blog) - Which of the following is a misconfiguration risk in container security?
a. Exposing unneeded ports
b. Running minimal base images
c. Using signed images
d. Disabling unnecessary services
Answer: a. Exposing unneeded ports (SentinelOne) - In container security, network segmentation is used primarily to:
a. Increase throughput
b. Isolate container traffic and reduce blast radius
c. Merge all container networks
d. Disable firewall rules
Answer: b. Isolate container traffic and reduce blast radius (Sysdig) - What does image signing help prevent?
a. Kernel-level attacks
b. Running untrusted or tampered container images
c. Network eavesdropping
d. CPU exhaustion
Answer: b. Running untrusted or tampered container images (SentinelOne) - Which concept refers to combining container with hardware-based trusted execution environments (TEEs) to protect workloads?
a. Virtual machines
b. Trusted Container Extensions
c. Docker Compose
d. Kubernetes
Answer: b. Trusted Container Extensions (arXiv) - What is supply chain risk in container security?
a. Risk in image building, dependencies, and registry compromise
b. Risk in physical shipment of servers
c. Risk in power supply
d. Risk in network cables
Answer: a. Risk in image building, dependencies, and registry compromise (arXiv) - Which of the following is an orchestrator-level security control?
a. PodSecurityPolicy / Pod Security Admission
b. cgroups
c. Namespaces
d. SELinux on the host
Answer: a. PodSecurityPolicy / Pod Security Admission (Codacy Blog) - What does immutable infrastructure in container design mean?
a. Containers are mutable at runtime
b. Containers are replaced rather than updated in place
c. Containers can always be changed
d. Infrastructure is never redeployed
Answer: b. Containers are replaced rather than updated in place (SentinelOne) - What is security context in Kubernetes?
a. Defines how a pod or container runs (e.g. user, capabilities)
b. Defines network routes
c. Defines storage encryption
d. Defines CPU scheduling
Answer: a. Defines how a pod or container runs (e.g. user, capabilities) (Codacy Blog) - Which mechanism helps prevent container from accessing host kernel capabilities?
a. Dropping capabilities
b. Granting all capabilities
c. Running as root
d. Enabling sysadmin mode
Answer: a. Dropping capabilities (Codacy Blog) - What is runtime defense-in-depth in container security?
a. Only focus on image scanning
b. Layered protections at runtime including behavior monitoring, access control, network policy
c. Ignoring host security
d. Only encryption at rest
Answer: b. Layered protections at runtime including behavior monitoring, access control, network policy (SentinelOne) - Which of the following is a risk when containers share the same host kernel?
a. Kernel vulnerability exploitation
b. Full hardware virtualization
c. Independent OS per container
d. Isolated hardware drivers
Answer: a. Kernel vulnerability exploitation (Sysdig) - What is least privilege networking in container clusters?
a. Allow all ports
b. Restrict traffic only to required flows
c. No network policies at all
d. Open host ingress to all containers
Answer: b. Restrict traffic only to required flows (Sysdig) - Which open-source tool can be used to check Kubernetes cluster security configuration compliance?
a. Kube-bench
b. Docker
c. etcd
d. Harbor
Answer: a. Kube-bench (wiz.io) - What is image provenance?
a. The origin, history, and metadata of an image
b. The runtime metrics of a container
c. The network path
d. The CPU usage log
Answer: a. The origin, history, and metadata of an image (Codacy Blog) - Why is using a minimal base image a security best practice?
a. Fewer packages = smaller attack surface
b. More packages = better features
c. Minimal images are slower
d. They use more memory
Answer: a. Fewer packages = smaller attack surface (Codacy Blog) - What is sidecar container pattern useful for in security?
a. Running business logic
b. Offloading auxiliary functions like logging or security agents
c. Replacing the main container
d. Kernel-level operations
Answer: b. Offloading auxiliary functions like logging or security agents (e.g. monitoring, security sidecars) (Codacy Blog) - Which of these is not a container runtime?
a. containerd
b. CRI-O
c. Docker Engine
d. VMware ESXi
Answer: d. VMware ESXi (Wikipedia) - What is image vulnerability drift?
a. When a runtime code changes inside container
b. Over time image becomes vulnerable due to new CVEs
c. Network packets drifting
d. CPU usage drift
Answer: b. Over time image becomes vulnerable due to new CVEs (SentinelOne) - Which policy engine can be used to enforce security rules in Kubernetes?
a. Open Policy Agent (OPA)
b. Docker Swarm
c. FTP
d. Cron
Answer: a. Open Policy Agent (OPA) (wiz.io) - In case a container is compromised, containment refers to:
a. Shutting down the entire cluster
b. Isolating the compromised container and limiting lateral movement
c. Ignoring the incident
d. Disabling logs
Answer: b. Isolating the compromised container and limiting lateral movement (Sysdig) - Immutable containers help security because:
a. They can be modified during runtime
b. They cannot be tampered with after deployment
c. They use more CPU
d. They allow dynamic code injection
Answer: b. They cannot be tampered with after deployment (Codacy Blog) - What is continuous monitoring in container security?
a. Only scanning images once
b. Ongoing visibility into container runtime, logs, metrics, behavior
c. Only host OS monitoring
d. Disabling alerts
Answer: b. Ongoing visibility into container runtime, logs, metrics, behavior (Sysdig) - Which of the following helps in securing etcd in Kubernetes clusters?
a. Allow open network access
b. Encryption of etcd data at rest
c. No authentication
d. Expose etcd on public interface
Answer: b. Encryption of etcd data at rest (Red Hat) - What is defense in depth in container security?
a. Single security measure
b. Multiple layered protections at image, host, network, runtime, orchestrator
c. Only runtime scan
d. Only host firewall
Answer: b. Multiple layered protections at image, host, network, runtime, orchestrator (Sysdig) - Which of the following could indicate container-level compromise?
a. Unexpected process spawning
b. Normal network traffic only
c. Predictable CPU usage
d. No file changes
Answer: a. Unexpected process spawning (arXiv) - What is the role of Seccomp in container security?
a. It configures storage
b. It restricts system calls a container can use
c. It manages network
d. It scales containers
Answer: b. It restricts system calls a container can use (Codacy Blog) - In container security, fuzz testing is used to:
a. Test performance
b. Feed random or malformed inputs to find vulnerabilities
c. Monitor logs
d. Encrypt secrets
Answer: b. Feed random or malformed inputs to find vulnerabilities (arXiv) - Which of these is a control plane component in Kubernetes that requires securing?
a. kube-apiserver
b. Pod
c. Sidecar container
d. application code
Answer: a. kube-apiserver (Wikipedia) - What is the shared responsibility model in container security?
a. Vendor handles all security
b. Users handle all security
c. Both platform provider and user share security tasks
d. Security is ignored
Answer: c. Both platform provider and user share security tasks (user handles container, image, runtime; provider handles infrastructure) (Codacy Blog) - What is drift detection in container environments?
a. Detecting changes from desired state (config drift)
b. Monitoring network throughput
c. Ignoring changes
d. Only CPU monitoring
Answer: a. Detecting changes from desired state (config drift) (Codacy Blog) - Which of the following is a zero-trust principle relevant to container security?
a. Trust all internal traffic by default
b. Always verify identity and enforce least privilege
c. No authentication required
d. Open access to container APIs
Answer: b. Always verify identity and enforce least privilege (Wikipedia) - What is the purpose of virtual machine introspection applied to containers, as in recent research?
a. To slow down containers
b. To monitor container file operations from host or hypervisor level
c. To disable containers
d. To replicate containers
Answer: b. To monitor container file operations from host or hypervisor level (arXiv)
