Container Security Fundamentals

Final Quiz

Connecting to LMS... Progress: in progress

Assessment

1. What is container security primarily concerned with? A. Only the container logo. B. Protecting the image, build pipeline, registry, runtime, host, network, secrets, and orchestration layer. C. Replacing all application security controls. D. Eliminating the need for monitoring.

2. How are containers different from traditional virtual machines at a high level? A. Containers typically share the host operating system kernel, while virtual machines usually include a separate guest operating system. B. Containers never need operating system support. C. Containers cannot run applications. D. Containers are always more isolated than virtual machines in every context.

3. What is a container image? A. A running process only. B. A firewall rule. C. A packaged filesystem and metadata used to create container instances. D. A password reset method.

4. Why is a privileged container high risk? A. It always improves least privilege. B. It prevents all host interaction. C. It removes the need for scanning. D. It may grant broad access to host-level capabilities or sensitive system functions.

5. Why does base image selection matter? A. Base images bring operating system packages, libraries, defaults, and potential vulnerabilities into the application image. B. Base images are only decorative. C. Base images cannot contain vulnerabilities. D. Base image choice only affects the application logo.

6. What is image provenance? A. A container networking mode. B. Information about where an image came from, how it was built, and whether it can be trusted. C. A runtime memory limit. D. A backup schedule.

7. Why should secrets not be baked into container images? A. Images are never copied. B. Images are always private. C. Images can be stored, shared, scanned, cached, or reused, exposing embedded secrets beyond the intended environment. D. Images automatically delete secrets.

8. What is a multi-stage build useful for at a high level? A. Running every container as root. B. Disabling scanning. C. Removing all build controls. D. Separating build-time dependencies from smaller runtime artifacts.

9. What does least privilege mean for containers? A. Giving the container only the permissions, capabilities, files, and network access needed for its purpose. B. Running every workload as root. C. Mounting the entire host filesystem by default. D. Disabling all access controls.

10. Why are resource limits useful? A. They guarantee the application has no bugs. B. They can reduce the impact of runaway or abusive workloads on shared infrastructure. C. They replace authentication. D. They remove the need for monitoring.

11. What is a container registry? A. A user password database only. B. A runtime process monitor only. C. A service used to store, manage, and distribute container images. D. A network cable.

12. Why should registry access be controlled? A. Everyone should publish production images directly. B. Registry access does not affect security. C. It replaces CI/CD controls. D. Unauthorized image pulls or pushes can expose sensitive artifacts or introduce untrusted images.

13. What is container network control intended to support? A. Limiting which services, networks, and endpoints containers can communicate with. B. Replacing all application authorization. C. Making every port public. D. Removing all logs.

14. Why is orchestrator access control important? A. Orchestrators cannot affect production systems. B. Orchestrator permissions can allow users or services to deploy, modify, inspect, or control workloads. C. Access control is only needed for developers' laptops. D. Orchestrator permissions replace image scanning.

15. Why is monitoring important for containerized workloads? A. Monitoring guarantees no incident can occur. B. Monitoring replaces secrets management. C. It helps teams observe logs, runtime behavior, events, drift, failures, vulnerabilities, and suspicious activity. D. Monitoring is only useful after containers are deleted.

16. Which statement best summarizes container security? A. Containers are secure by default and need no review. B. Container security is only about scanning images once. C. Container security replaces application security. D. Container security requires lifecycle controls across images, builds, registries, runtimes, hosts, networks, secrets, orchestration, monitoring, and response.