CAS-004 Scripting, Containers and Automation — Timed 40 Questions

Question 1

Which of the following is the primary security benefit of using immutable infrastructure in automated deployments?

Accepted Answer

Eliminates configuration drift and unauthorized changes. Immutable infrastructure ensures that servers are never modified after deployment; instead, updates are made by replacing the entire instance with a new, pre-configured image. This eliminates configuration drift because any unauthorized or unintended changes are wiped out on the next deployment cycle, enforcing a consistent, known-good state across all environments.

Answer

Reduces operational costs by reusing existing servers

Answer

Increases system performance through hardware acceleration

Answer

Simplifies monitoring by reducing the number of servers

Question 2

A security analyst is writing a script to scan container images for known vulnerabilities before deployment. Which of the following best practices should the analyst implement to ensure the script runs securely?

Accepted Answer

Use parameterized queries or input sanitization for any user-supplied data. Option B is correct because input sanitization and parameterized queries prevent injection attacks when the script processes user-supplied data, such as image names or tags. In the context of container scanning, unsanitized input could lead to command injection or SQL injection if the script queries a vulnerability database. This aligns with secure coding practices for automation scripts, ensuring that the script does not inadvertently execute malicious commands or expose sensitive data.

Answer

Hardcode API keys into the script for simplicity

Answer

Run the script with root privileges to ensure it has access to all images

Answer

Store credentials in a world-readable configuration file

Question 3

An organization implements a CI/CD pipeline that automatically builds and deploys containerized microservices. Which of the following is the most effective method to ensure that only signed, trusted container images are deployed to production?

Accepted Answer

Enable content trust and require signatures on all images. Option B is correct because enabling content trust (e.g., Docker Content Trust or Notary) cryptographically signs container images, ensuring that only images signed by a trusted publisher can be deployed. This directly enforces integrity and authenticity in the CI/CD pipeline, preventing unauthorized or tampered images from reaching production.

Answer

Implement a private container registry with access controls

Answer

Run vulnerability scanning on all images before deployment

Answer

Use an admission controller that checks image labels

Question 4

A DevOps engineer is automating the deployment of a web application using containers. Which of the following security practices should be implemented to reduce the attack surface of the containers? (Select TWO.)

Accepted Answer

Run containers as a non-root user. Running containers as a non-root user (option A) is a fundamental security best practice because it limits the privileges available to processes inside the container. If an attacker compromises the application, they will not have root access to the host or the container runtime, reducing the potential for privilege escalation or host-level damage. This aligns with the principle of least privilege, which is critical for container security.

Answer

Build images with embedded database credentials

Answer

Expose port 22 for SSH debugging

Answer

Grant all Linux capabilities to the container

Question 5

A security administrator is reviewing a Python script used to automate compliance checks across cloud resources. The script uses environment variables for API tokens. Which of the following are secure coding practices that should be implemented in this script? (Select TWO.)

Accepted Answer

Use try-except blocks to handle exceptions gracefully. Option A is correct because using try-except blocks in Python allows the script to catch and handle exceptions (e.g., missing environment variables, API call failures) gracefully without crashing. This is a fundamental secure coding practice that prevents unhandled errors from exposing sensitive information or causing unpredictable behavior in automated compliance checks.

Answer

Use os.system() to run shell commands for resource management

Answer

Hardcode API tokens as fallback if environment variables are missing

Answer

Log the API tokens for troubleshooting purposes

Question 6

Match each automation security concept with its correct description.

Answer

Immutable infrastructure

Answer

Infrastructure as Code

Answer

Secret management

Answer

Container orchestration

Question 7

Which of the following best describes the primary security benefit of using immutable infrastructure in a containerized environment?

Accepted Answer

It prevents unauthorized modifications to running containers.. Immutable infrastructure ensures that once a container image is built and deployed, it is never modified in place. If a change is needed, a new image is built and deployed, replacing the old container entirely. This prevents unauthorized or unplanned modifications to running containers, which is the primary security benefit because it eliminates configuration drift and reduces the attack surface from runtime tampering.

Answer

It reduces resource consumption by reusing containers.

Answer

It automates patching of container images.

Answer

It eliminates the need for container security scanning.

Question 8

A security engineer is writing a Python script to automate the revocation of compromised credentials across multiple cloud services. Which of the following is the most critical security consideration when implementing this script?

Accepted Answer

Use a secrets management service to store API keys.. Option B is correct because storing API keys in a secrets management service (e.g., HashiCorp Vault, AWS Secrets Manager) prevents hardcoding credentials in the script, which is a critical security practice for automation. Even with least privilege, if the API key is exposed in plaintext (e.g., in source code or logs), an attacker can reuse it across services. Secrets management also enables rotation, auditing, and dynamic access control, directly addressing the risk of credential compromise in multi-cloud revocation scripts.

Answer

Ensure the script runs with the least privilege necessary.

Answer

Log all actions performed by the script.

Answer

Run the script from a hardened bastion host.

Question 9

An organization uses a CI/CD pipeline that builds Docker images and pushes them to a private registry. A security analyst discovers that some images contain environment variables with database credentials. Which of the following is the most effective way to prevent this in the future?

Accepted Answer

Implement multi-stage builds to separate build and runtime environments.. The best approach is to use multi-stage builds: build the application in one stage, then copy only the artifact to a final, clean image. This avoids including build-time secrets in the final image. Additionally, using Docker BuildKit's --secret flag can inject secrets without persisting them.

Answer

Use a .dockerignore file to exclude credential files.

Answer

Scan images with a vulnerability scanner after build.

Answer

Reduce the base image size to minimize attack surface.

Question 10

Which two of the following are best practices for securing container orchestration platforms (e.g., Kubernetes)? (Select two.)

Accepted Answer

Apply network policies to isolate workloads.. Network policies in Kubernetes act as a firewall for pods, controlling ingress and egress traffic at the IP address or port level (OSI layer 3 or 4). By default, all pods can communicate with each other; applying network policies enforces least-privilege segmentation, which is a core security best practice for container orchestration platforms.

Answer

Use privileged containers for system services.

Answer

Disable all security contexts to avoid restrictions.

Question 11

A security team is automating incident response using playbooks. Which two of the following are critical considerations when designing automated response actions? (Select two.)

Accepted Answer

Include a manual approval step for high-impact actions.. Option B is correct because high-impact automated actions, such as blocking a critical server or deleting user accounts, can cause significant collateral damage if triggered by a false positive. Including a manual approval step ensures a human verifies the alert before irreversible or disruptive actions are taken, aligning with the principle of least privilege and incident response best practices.

Answer

Execute all actions immediately to minimize damage.

Answer

Use the same playbook for all incident types.

Question 12

Match each container security concept with its correct description.

Answer

Container runtime security

Answer

Image signing

Answer

Secrets management

Answer

Orchestration security

Answer

Enforces system call filtering and access controls at runtime

Answer

Ensures container images are not tampered with using cryptographic hashes

Answer

Safely injects credentials into containerized applications at runtime

Answer

Manages network segmentation and pod security policies in clusters

Question 13

Which of the following is the primary benefit of using infrastructure as code (IaC) for automating security configurations?

Accepted Answer

It ensures consistent and repeatable security configurations. Infrastructure as code (IaC) enables security configurations to be defined in declarative or procedural scripts (e.g., Terraform, AWS CloudFormation, Ansible). This ensures that every deployment applies the exact same security settings (e.g., firewall rules, IAM policies, encryption at rest) without drift, making configurations consistent and repeatable across environments. The primary benefit is eliminating manual, error-prone processes that lead to configuration inconsistencies.

Answer

It eliminates the need for security testing

Answer

It allows unapproved changes to be deployed faster

Answer

It increases manual oversight of security settings

Question 14

A security analyst is writing a Python script to parse network logs and automatically block IP addresses that exceed a threshold of failed login attempts. Which security consideration is most critical when implementing this automation?

Accepted Answer

Validating and sanitizing all input from logs. Option C is correct because log files can contain maliciously crafted entries designed to exploit parsing logic. Without input validation and sanitization, an attacker could inject commands or manipulate the script into blocking legitimate IPs or executing unintended actions, leading to a denial-of-service or compromise of the automation system itself.

Answer

Using the most efficient parsing algorithm

Answer

Ensuring the script runs with root privileges

Answer

Writing detailed audit logs of script actions

Question 15

In a CI/CD pipeline, a container image is built from a Dockerfile that uses a base image from a public registry. To minimize the attack surface, which of the following actions should be automated in the pipeline?

Accepted Answer

Run a vulnerability scanner and fail the build on critical findings. Option B is correct because integrating a vulnerability scanner into the CI/CD pipeline and failing the build on critical findings directly reduces the attack surface by preventing deployment of images with known exploitable vulnerabilities. This aligns with the principle of secure software supply chain management, where automated security gates are essential for containerized environments.

Answer

Use the 'latest' tag for the base image to get latest patches

Answer

Store the Dockerfile in a private repository only

Answer

Install all available packages inside the container

Question 16

Which of the following are secure scripting practices when automating administrative tasks? (Choose two.)

Accepted Answer

Use a secrets management service to retrieve credentials at runtime. Option B is correct because using a secrets management service (e.g., HashiCorp Vault, AWS Secrets Manager) retrieves credentials at runtime via secure APIs, avoiding hardcoded secrets in scripts. This practice ensures credentials are encrypted at rest and in transit, and supports rotation without modifying the script. It aligns with the principle of least privilege and reduces the risk of credential exposure in version control or logs.

Answer

Hardcode credentials in the script for convenience

Answer

Run the script with the highest privileges required

Question 17

A DevOps engineer is automating container orchestration using Kubernetes. Which of the following are security best practices to include in the automation? (Choose two.)

Accepted Answer

Enforce Pod Security Policies to restrict privileged containers. Enforcing Pod Security Policies (PSPs) is a critical security best practice in Kubernetes because it restricts the creation of privileged containers, prevents host namespace sharing, and enforces read-only root filesystems. This reduces the attack surface by ensuring that containers run with the least privilege necessary, mitigating risks of container breakout or host compromise. Disabling PSPs or failing to enforce them would allow developers to deploy containers with excessive capabilities, violating the principle of least privilege.

Answer

Disable RBAC to simplify automation scripts

Answer

Allow all network traffic between pods for simplicity

Question 18

Match each automation security concept (left) with its corresponding best practice (right).

Answer

Scan container images for vulnerabilities before deployment

Answer

Never modify a running instance; redeploy instead

Answer

Store all configuration files in version control

Answer

Use a dedicated vault service to store credentials

Question 19

A security engineer is writing a Python script to automate the revocation of compromised certificates using the ACME protocol. The script uses the `acme` library and requires secure credential storage. Which method is MOST appropriate for storing the ACME account private key used for authentication?

Accepted Answer

Store the key in the operating system's keychain (e.g., macOS Keychain, Windows Credential Manager) or a HSM. The ACME account private key is a highly sensitive cryptographic credential used to authenticate against the ACME server (RFC 8555). Storing it in the OS keychain or a Hardware Security Module (HSM) provides encryption at rest, access control via OS-level permissions, and protection against accidental exposure. This aligns with the principle of least privilege and secure key management required for automation scripts handling certificate revocation.

Answer

Store the key in a configuration file with 600 permissions

Answer

Embed the key directly in the script as a string variable

Answer

Store the key in an environment variable

Question 20

Drag and drop the steps to configure a site-to-site IPsec VPN on a firewall into the correct order.