GSEC Container Security — 10 Questions

Question 1

Which TWO of the following configurations are considered best practices for securing the Docker daemon?

Accepted Answer

Configure the Docker daemon to utilize user namespaces.. Securing the Docker daemon is critical because it runs with root privileges and serves as a primary target for host escape attacks. Restricting network access via TLS and enforcing user namespaces prevents attackers from gaining full host access even if a container is compromised. These configurations create a boundary between the container runtime and the host kernel, significantly reducing the attack surface for privilege escalation attempts.

Answer

Enable the Docker API to listen on TCP port 2375 for remote management.

Answer

Mount the Docker socket into all application containers.

Answer

Run the Docker daemon as a non-root user without any additional privileges.

Question 2

Refer to the exhibit. An engineer is reviewing a Dockerfile for a microservice. Which security issue is present in this configuration?

Accepted Answer

The use of alpine:latest introduces unpredictability in the image base.. The current configuration installs software as root before switching users. While the USER instruction is present, the image maintains root-owned files or potentially leftover build artifacts from the initial layers. A secure approach involves multi-stage builds to discard build tools and ensure the final image contains minimal layers, reducing the attack surface. Leaving unnecessary binaries like 'curl' increases the potential utility for an attacker during a post-exploitation phase.

Answer

The image is missing a health check instruction.

Answer

The USER instruction is placed too early in the Dockerfile.

Answer

The CMD instruction does not use the exec form syntax.

Question 3

Which THREE of the following are primary components of a comprehensive container security strategy?

Accepted Answer

Implementing automated vulnerability scanning for images.. A robust container security strategy must address the entire lifecycle, including the build process, registry management, and runtime protection. By integrating security into the CI/CD pipeline, enforcing access controls on registries, and monitoring runtime behavior for anomalies, organizations can detect threats at multiple stages. These layers ensure that if one control fails, others remain to provide visibility and prevent successful exploitation by malicious actors.

Answer

Storing all application source code inside the registry.

Answer

Disabling internal container networking completely.

Question 4

A GSEC analyst is reviewing a Kubernetes Deployment manifest for an internet-facing payment service. The pod spec sets allowPrivilegeEscalation to false, runAsNonRoot to true, and drops all Linux capabilities, but the container image is tagged myregistry/paymentsvc:latest and the imagePullPolicy is left at its default. The analyst wants to harden the workload so that a compromised registry account cannot silently swap in a malicious image on the next pod restart. Which change best mitigates this supply-chain risk?

Accepted Answer

Set imagePullPolicy to Always and reference the image by an immutable digest such as myregistry/paymentsvc@sha256:<digest> instead of the latest tag.. A mutable tag such as latest resolves at pull time to whatever the registry currently serves, so an attacker who compromises registry credentials can replace the reviewed image with a backdoored one and the cluster will run it on the next restart. Referencing the image by its sha256 digest makes the manifest point to an exact, content-addressed set of layers, and setting imagePullPolicy to Always ensures the kubelet re-resolves that digest rather than relying on a cached copy.

Answer

Enable readOnlyRootFilesystem in the container's securityContext to prevent the malicious image from writing to disk.

Answer

Add a NetworkPolicy that restricts egress from the paymentsvc pods to only the payment processor's IP range.

Answer

Raise the pod's runAsUser to a high UID and add a seccomp profile of RuntimeDefault to the pod spec.

Question 5

A security engineer is configuring a Kubernetes cluster and wants to enforce that all pods must run with a read-only root filesystem. Which Kubernetes admission controller should be used to validate this requirement?

Accepted Answer

Pod Security Admission. Pod Security Admission (PSA) is the current built-in mechanism to enforce Pod Security Standards at the namespace level. The Restricted profile requires containers to run with a read-only root filesystem, among other restrictions. By labeling a namespace with pod-security.kubernetes.io/enforce: restricted, PSA will reject pods that do not comply.

Answer

AlwaysPullImages

Answer

NodeRestriction

Answer

PodSecurityPolicy

Question 6

A security analyst is reviewing the security posture of a Kubernetes cluster that runs production workloads. The analyst wants to reduce the attack surface of containers running in the cluster by applying Linux kernel-level isolation controls. Which TWO of the following mechanisms, when configured, restrict the system calls a container process can make to the host kernel? (Choose two.)

Accepted Answer

Seccomp-BPF filters loaded by the container runtime for the container. Both seccomp profiles and the underlying Seccomp-BPF filters restrict the set of system calls a container process can invoke against the host kernel. seccomp profiles are the declarative configuration, while Seccomp-BPF is the kernel-enforced mechanism that implements the filtering. Together they form the primary syscall-level isolation control in Kubernetes, directly reducing kernel attack surface.

Answer

AppArmor profiles applied via pod annotations

Answer

Kubernetes NetworkPolicy resources applied to the pod's namespace

Answer

SELinux context labels applied to container processes

Question 7

An enterprise development team is designing a Kubernetes cluster deployment where application containers frequently interact with cloud provider APIs. To minimize security blast radius, which architectural practice provides the most effective credential isolation per pod?

Accepted Answer

Implement service account token volume projection with short-lived auditable tokens scoped to individual application requirements.. Service account token volume projection utilizes short-lived tokens cryptographically signed by the cluster, mounting them securely into specific pods with restricted audiences. This approach replaces static long-lived credentials stored in environment variables or generic secrets, significantly reducing lateral movement risks if an application is compromised.

Answer

Store cloud provider credentials in base64-encoded Kubernetes Secret objects and mount them as environment variables.

Answer

Configure cluster-wide IAM roles on the underlying worker nodes and allow all hosted pods to inherit administrative permissions.

Answer

Embed the static cloud API keys directly into the container base image layers to ensure consistency across deployments.

Question 8

A security engineer wants to ensure that container images are not modified after they are built and pushed to a registry. Which mechanism provides the strongest assurance of image integrity and authenticity?

Accepted Answer

Applying cryptographic digital signatures to container images.. Content trust and image signing using tools like Notary or Cosign ensure that the image pulled by a runtime is exactly the same one pushed by the CI/CD pipeline. By cryptographically signing the manifest, organizations prevent man-in-the-middle attacks and unauthorized registry modifications. This is vital in modern DevSecOps, as compromised images could introduce persistent backdoors or vulnerabilities into the production environment without triggering standard application-level alerts.

Answer

Implementing a read-only filesystem for the container at runtime.

Answer

Using SHA-256 image digests instead of mutable image tags.

Answer

Scanning images for known vulnerabilities using a static analyzer.

Question 9

When designing a secure container orchestration strategy, which approach best minimizes the impact of a compromised container on the host kernel?

Accepted Answer

Use a specialized container runtime like gVisor to intercept system calls.. Kernel vulnerabilities are a primary vector for container escapes. By using technologies like gVisor or Kata Containers, the container environment uses a hardened kernel or a separate micro-VM, providing an additional layer of isolation. Standard containers share the host kernel directly; if the kernel is exploited via a system call, the attacker can break out of the container boundary entirely, leading to full system compromise of the underlying host node.

Answer

Disable all kernel modules on the host operating system.

Answer

Increase the memory limit for every container in the cluster.

Answer

Run all containers with the --privileged flag to ensure compatibility.

Question 10

Which of the following is the most effective way to prevent secrets (such as API keys) from being leaked via container images?

Accepted Answer

Use orchestrator-native secret management to inject secrets at runtime.. Secrets should never be baked into container images because they remain in the image layers even if deleted in later steps. Once an image is pushed to a registry, those secrets are accessible to anyone with pull access. Using orchestrator-native secret management (like Kubernetes Secrets or Vault) ensures that sensitive data is injected at runtime, keeping it out of the persistent image layers and the source control history.

Answer

Encrypt the Dockerfile using a secret key before building.

Answer

Delete the secrets in a subsequent RUN layer during the build.

Answer

Set the file permissions on the secret to 600 after copying it.