GSEC Container Security — All Questions With Answers

Question 1

Which TWO of the following configurations are considered best practices for securing the Docker daemon?

Accepted Answer

Configure the Docker daemon to utilize user namespaces.. Securing the Docker daemon is critical because it runs with root privileges and serves as a primary target for host escape attacks. Restricting network access via TLS and enforcing user namespaces prevents attackers from gaining full host access even if a container is compromised. These configurations create a boundary between the container runtime and the host kernel, significantly reducing the attack surface for privilege escalation attempts.

Answer

Enable the Docker API to listen on TCP port 2375 for remote management.

Answer

Mount the Docker socket into all application containers.

Answer

Run the Docker daemon as a non-root user without any additional privileges.

Question 2

Refer to the exhibit. An engineer is reviewing a Dockerfile for a microservice. Which security issue is present in this configuration?

Accepted Answer

The use of alpine:latest introduces unpredictability in the image base.. The current configuration installs software as root before switching users. While the USER instruction is present, the image maintains root-owned files or potentially leftover build artifacts from the initial layers. A secure approach involves multi-stage builds to discard build tools and ensure the final image contains minimal layers, reducing the attack surface. Leaving unnecessary binaries like 'curl' increases the potential utility for an attacker during a post-exploitation phase.

Answer

The image is missing a health check instruction.

Answer

The USER instruction is placed too early in the Dockerfile.

Answer

The CMD instruction does not use the exec form syntax.

Question 3

Which THREE of the following are primary components of a comprehensive container security strategy?

Accepted Answer

Implementing automated vulnerability scanning for images.. A robust container security strategy must address the entire lifecycle, including the build process, registry management, and runtime protection. By integrating security into the CI/CD pipeline, enforcing access controls on registries, and monitoring runtime behavior for anomalies, organizations can detect threats at multiple stages. These layers ensure that if one control fails, others remain to provide visibility and prevent successful exploitation by malicious actors.

Answer

Storing all application source code inside the registry.

Answer

Disabling internal container networking completely.

Question 4

A GSEC analyst is reviewing a Kubernetes Deployment manifest for an internet-facing payment service. The pod spec sets allowPrivilegeEscalation to false, runAsNonRoot to true, and drops all Linux capabilities, but the container image is tagged myregistry/paymentsvc:latest and the imagePullPolicy is left at its default. The analyst wants to harden the workload so that a compromised registry account cannot silently swap in a malicious image on the next pod restart. Which change best mitigates this supply-chain risk?

Accepted Answer

Set imagePullPolicy to Always and reference the image by an immutable digest such as myregistry/paymentsvc@sha256:<digest> instead of the latest tag.. A mutable tag such as latest resolves at pull time to whatever the registry currently serves, so an attacker who compromises registry credentials can replace the reviewed image with a backdoored one and the cluster will run it on the next restart. Referencing the image by its sha256 digest makes the manifest point to an exact, content-addressed set of layers, and setting imagePullPolicy to Always ensures the kubelet re-resolves that digest rather than relying on a cached copy.

Answer

Enable readOnlyRootFilesystem in the container's securityContext to prevent the malicious image from writing to disk.

Answer

Add a NetworkPolicy that restricts egress from the paymentsvc pods to only the payment processor's IP range.

Answer

Raise the pod's runAsUser to a high UID and add a seccomp profile of RuntimeDefault to the pod spec.

Question 5

A security engineer is configuring a Kubernetes cluster and wants to enforce that all pods must run with a read-only root filesystem. Which Kubernetes admission controller should be used to validate this requirement?

Accepted Answer

Pod Security Admission. Pod Security Admission (PSA) is the current built-in mechanism to enforce Pod Security Standards at the namespace level. The Restricted profile requires containers to run with a read-only root filesystem, among other restrictions. By labeling a namespace with pod-security.kubernetes.io/enforce: restricted, PSA will reject pods that do not comply.

Answer

AlwaysPullImages

Answer

NodeRestriction

Answer

PodSecurityPolicy

Question 6

A security analyst is reviewing the security posture of a Kubernetes cluster that runs production workloads. The analyst wants to reduce the attack surface of containers running in the cluster by applying Linux kernel-level isolation controls. Which TWO of the following mechanisms, when configured, restrict the system calls a container process can make to the host kernel? (Choose two.)

Accepted Answer

Seccomp-BPF filters loaded by the container runtime for the container. Both seccomp profiles and the underlying Seccomp-BPF filters restrict the set of system calls a container process can invoke against the host kernel. seccomp profiles are the declarative configuration, while Seccomp-BPF is the kernel-enforced mechanism that implements the filtering. Together they form the primary syscall-level isolation control in Kubernetes, directly reducing kernel attack surface.

Answer

AppArmor profiles applied via pod annotations

Answer

Kubernetes NetworkPolicy resources applied to the pod's namespace

Answer

SELinux context labels applied to container processes

Question 7

An enterprise development team is designing a Kubernetes cluster deployment where application containers frequently interact with cloud provider APIs. To minimize security blast radius, which architectural practice provides the most effective credential isolation per pod?

Accepted Answer

Implement service account token volume projection with short-lived auditable tokens scoped to individual application requirements.. Service account token volume projection utilizes short-lived tokens cryptographically signed by the cluster, mounting them securely into specific pods with restricted audiences. This approach replaces static long-lived credentials stored in environment variables or generic secrets, significantly reducing lateral movement risks if an application is compromised.

Answer

Store cloud provider credentials in base64-encoded Kubernetes Secret objects and mount them as environment variables.

Answer

Configure cluster-wide IAM roles on the underlying worker nodes and allow all hosted pods to inherit administrative permissions.

Answer

Embed the static cloud API keys directly into the container base image layers to ensure consistency across deployments.

Question 8

A security engineer wants to ensure that container images are not modified after they are built and pushed to a registry. Which mechanism provides the strongest assurance of image integrity and authenticity?

Accepted Answer

Applying cryptographic digital signatures to container images.. Content trust and image signing using tools like Notary or Cosign ensure that the image pulled by a runtime is exactly the same one pushed by the CI/CD pipeline. By cryptographically signing the manifest, organizations prevent man-in-the-middle attacks and unauthorized registry modifications. This is vital in modern DevSecOps, as compromised images could introduce persistent backdoors or vulnerabilities into the production environment without triggering standard application-level alerts.

Answer

Implementing a read-only filesystem for the container at runtime.

Answer

Using SHA-256 image digests instead of mutable image tags.

Answer

Scanning images for known vulnerabilities using a static analyzer.

Question 9

When designing a secure container orchestration strategy, which approach best minimizes the impact of a compromised container on the host kernel?

Accepted Answer

Use a specialized container runtime like gVisor to intercept system calls.. Kernel vulnerabilities are a primary vector for container escapes. By using technologies like gVisor or Kata Containers, the container environment uses a hardened kernel or a separate micro-VM, providing an additional layer of isolation. Standard containers share the host kernel directly; if the kernel is exploited via a system call, the attacker can break out of the container boundary entirely, leading to full system compromise of the underlying host node.

Answer

Disable all kernel modules on the host operating system.

Answer

Increase the memory limit for every container in the cluster.

Answer

Run all containers with the --privileged flag to ensure compatibility.

Question 10

Which of the following is the most effective way to prevent secrets (such as API keys) from being leaked via container images?

Accepted Answer

Use orchestrator-native secret management to inject secrets at runtime.. Secrets should never be baked into container images because they remain in the image layers even if deleted in later steps. Once an image is pushed to a registry, those secrets are accessible to anyone with pull access. Using orchestrator-native secret management (like Kubernetes Secrets or Vault) ensures that sensitive data is injected at runtime, keeping it out of the persistent image layers and the source control history.

Answer

Encrypt the Dockerfile using a secret key before building.

Answer

Delete the secrets in a subsequent RUN layer during the build.

Answer

Set the file permissions on the secret to 600 after copying it.

Question 11

Refer to the exhibit. What is the security impact of the provided Kubernetes security context configuration?

Accepted Answer

The container is protected against setuid-based privilege escalation.. This configuration enforces the principle of least privilege by ensuring the container cannot run as root and preventing any process from gaining more privileges than its parent. 'allowPrivilegeEscalation: false' is a critical setting that prevents setuid binaries from changing the process effective user ID, which is a common technique used by attackers to escalate privileges within a container after achieving initial execution.

Answer

The pod will be unable to pull the image from the registry.

Answer

The pod will block all network traffic from the container.

Answer

The application will automatically have its vulnerabilities patched.

Question 12

A GSEC consultant is hardening a Kubernetes cluster that runs multi-tenant workloads. A developer reports that a pod in the tenants namespace was able to read the contents of the kubelet's host filesystem at /var/lib/kubelet. The pod spec includes hostPath: {path: /var/lib/kubelet, type: Directory} under volumes and mounts it at /host. The cluster has Pod Security Admission enabled with the restricted profile enforced cluster-wide, but the tenants namespace was labeled pod-security.kubernetes.io/enforce: privileged to unblock a legacy job. Which action most directly closes this exposure?

Accepted Answer

Remove the privileged label from the tenants namespace so the restricted profile is enforced there, and refactor the legacy job to run without a hostPath mount.. Pod Security Admission decides admission based on the namespace's pod-security.kubernetes.io/enforce label, and the privileged value on the tenants namespace overrode the cluster-wide restricted profile. That exemption is precisely what let a pod mount the node's /var/lib/kubelet directory via hostPath. Removing the label restores restricted enforcement, which forbids hostPath volumes, and refactoring the legacy job removes the need for the exemption so the exposure cannot be recreated.

Answer

Enable the NodeRestriction admission plugin and rotate the kubelet client certificates on all worker nodes.

Answer

Add a seccomp profile of RuntimeDefault to the pod and set allowPrivilegeEscalation to false in its securityContext.

Answer

Create an OPA Gatekeeper constraint that denies pods whose namespaces carry the privileged enforcement label.

Question 13

A GSEC candidate is reviewing a Docker Compose file for a web application. The file includes a service definition that mounts the Docker socket into the container. What is the primary security risk of this configuration?

Accepted Answer

It allows the container to access the host's Docker daemon, enabling privilege escalation and full host compromise.. Mounting the Docker socket into a container effectively gives that container root-level control over the host's Docker daemon. An attacker who compromises the container can use the Docker API to start privileged containers, mount host directories, or execute commands on the host, resulting in full system compromise. This is a critical misconfiguration that should be avoided.

Answer

It prevents the container from writing to its own filesystem, causing application failures.

Answer

It exposes the container's internal ports to the host network, increasing the attack surface.

Answer

It allows the container to bypass network policies and communicate with other containers without restriction.

Question 14

A security analyst is examining a Kubernetes Pod specification that includes the following securityContext: runAsUser: 0. What is the security implication of this setting?

Accepted Answer

The container will run as the root user, increasing the risk of privilege escalation if compromised.. Specifying runAsUser: 0 in a Kubernetes securityContext forces the container to run as the root user. This violates the principle of least privilege and increases the potential impact of a container compromise. Best practice is to run containers as a non-root user, often defined in the image or via runAsUser with a high UID.

Answer

The container will be unable to write to any mounted volumes due to permission restrictions.

Answer

The container will run as a non-privileged user, enhancing security by default.

Answer

The container will automatically drop all Linux capabilities, reducing its attack surface.

Question 15

A security engineer is hardening a Kubernetes cluster that runs multi-tenant workloads. Several pods have been observed running as the root user inside their containers, which the engineer wants to prevent. The engineer applies a Pod Security Admission (PSA) label to the namespace that enforces the 'restricted' profile. Which of the following best describes the enforcement action taken by the 'restricted' profile when a pod violates its policy?

Accepted Answer

The pod is rejected and the API server returns an error, preventing it from being scheduled.. The restricted Pod Security Standard is the most restrictive of the three built-in profiles and enforces controls such as requiring non-root execution, dropping all capabilities, and mandating a seccomp profile. When a namespace enforces this profile, non-compliant pods are denied at admission, directly preventing root-running containers from being scheduled.

Answer

The pod is admitted but an audit annotation is added to the pod's metadata for later review.

Answer

The pod is scheduled but the kubelet forcibly changes the container's user to a non-root UID at runtime.

Answer

The pod is admitted and a warning is written to the API server logs, but no enforcement action is taken.

Question 16

A developer is building a container image for a Python web application. During review, a security engineer notices the Dockerfile copies a .env file containing database credentials into the image and deletes it in a later RUN instruction. The engineer explains that this pattern still leaks the credentials. Which of the following best explains why the credentials remain exposed in the final image?

Accepted Answer

Each Dockerfile instruction creates a layer, and the layer containing the .env file persists in the image history even after a later deletion.. Container images are composed of immutable layers, one per Dockerfile instruction. Removing a file in a later RUN step only records a deletion in that new layer; the bytes remain in the earlier layer and can be recovered by extracting the image. Secrets must therefore be injected at runtime via secrets management, never copied into any layer.

Answer

The .env file is recreated automatically by the base image's entrypoint at container start.

Answer

Docker automatically backs up deleted files into a hidden volume that is mounted into every container.

Answer

The .env file is cached in the Docker daemon's build cache and pushed to the registry alongside the image manifest.

Question 17

A platform team runs a Kubernetes cluster where a container was compromised through a remote code execution flaw in a web application. The attacker attempted to read the service account token, query the API server, and list secrets in the namespace. The team wants to reduce the impact of such a compromise in the future. Which of the following changes most directly limits what the compromised pod's service account can do against the API server?

Accepted Answer

Binding a tightly scoped Role to the service account that grants only the specific verbs and resources the application requires, instead of cluster-admin or broad default permissions.. RBAC least privilege is the authoritative control over what a service account can do against the API server. Binding a narrowly scoped Role that grants only the required verbs and resources means a compromised pod's token cannot enumerate secrets or perform privileged actions, directly containing the blast radius from the RCE compromise.

Answer

Enabling audit logging on the API server to record all requests made by service accounts.

Answer

Disabling the automountServiceAccountToken field on the pod spec so no token is projected into the container.

Answer

Applying a NetworkPolicy that blocks egress from the pod to the API server's ClusterIP.

Question 18

A security engineer is evaluating a container runtime for a production Kubernetes cluster. The requirement is that the runtime must not share the host kernel with containers, providing stronger isolation than standard runc-based containers. Which of the following runtimes best satisfies this requirement?

Accepted Answer

Kata Containers, which runs each pod inside a lightweight virtual machine. Kata Containers runs each pod in a lightweight virtual machine with its own guest kernel, so workloads do not share the host kernel. This hardware-virtualization-based isolation provides a stronger boundary than runc, containerd with runc, or CRI-O with SELinux, all of which share the host kernel and are therefore vulnerable to kernel-level escapes.

Answer

runc with user namespaces enabled

Answer

CRI-O with the default runtime configured for SELinux enforcement

Answer

containerd configured with the default runc shim

Question 19

A GSEC analyst is reviewing the deployment pipeline for a containerized Node.js service. The Dockerfile contains a layer that runs `curl -fsSL https://example.com/install.sh | sh` during the build, before the image is pushed to an internal registry. The registry enforces vulnerability scanning, and the image is deployed to a Kubernetes cluster with a restrictive NetworkPolicy. Which of the following is the primary supply chain risk introduced by this Dockerfile instruction?

Accepted Answer

The remote script is fetched without integrity verification, so the image may include tampered or malicious content that scanning cannot reliably detect.. Fetching and executing a remote script during a Docker build introduces unverified third-party code into the image. Because there is no checksum or signature validation, a compromised endpoint can inject malicious content that becomes part of a trusted image. Registry scanning may not catch bespoke or obfuscated payloads, so the integrity of the supply chain is the primary concern.

Answer

The instruction allows the build host's environment variables, including registry credentials, to be exfiltrated by the remote script.

Answer

The curl command creates a writable layer that persists at runtime and can be modified by an attacker after deployment.

Answer

The instruction bypasses Kubernetes NetworkPolicy because build-time traffic does not originate from a pod in the cluster.

GSEC Container Security — All Questions With Answers

Which TWO of the following configurations are considered best practices for securing the Docker daemon?

Refer to the exhibit. An engineer is reviewing a Dockerfile for a microservice. Which security issue is present in this configuration?

Which THREE of the following are primary components of a comprehensive container security strategy?

A security engineer is configuring a Kubernetes cluster and wants to enforce that all pods must run with a read-only root filesystem. Which Kubernetes admission controller should be used to validate this requirement?

An enterprise development team is designing a Kubernetes cluster deployment where application containers frequently interact with cloud provider APIs. To minimize security blast radius, which architectural practice provides the most effective credential isolation per pod?

A security engineer wants to ensure that container images are not modified after they are built and pushed to a registry. Which mechanism provides the strongest assurance of image integrity and authenticity?

When designing a secure container orchestration strategy, which approach best minimizes the impact of a compromised container on the host kernel?

Which of the following is the most effective way to prevent secrets (such as API keys) from being leaked via container images?

Refer to the exhibit. What is the security impact of the provided Kubernetes security context configuration?

Exhibit

A GSEC candidate is reviewing a Docker Compose file for a web application. The file includes a service definition that mounts the Docker socket into the container. What is the primary security risk of this configuration?

A security analyst is examining a Kubernetes Pod specification that includes the following securityContext: runAsUser: 0. What is the security implication of this setting?

GSEC Container Security — All Questions With Answers

Which TWO of the following configurations are considered best practices for securing the Docker daemon?

Refer to the exhibit. An engineer is reviewing a Dockerfile for a microservice. Which security issue is present in this configuration?

Which THREE of the following are primary components of a comprehensive container security strategy?

A security engineer is configuring a Kubernetes cluster and wants to enforce that all pods must run with a read-only root filesystem. Which Kubernetes admission controller should be used to validate this requirement?

An enterprise development team is designing a Kubernetes cluster deployment where application containers frequently interact with cloud provider APIs. To minimize security blast radius, which architectural practice provides the most effective credential isolation per pod?

A security engineer wants to ensure that container images are not modified after they are built and pushed to a registry. Which mechanism provides the strongest assurance of image integrity and authenticity?

When designing a secure container orchestration strategy, which approach best minimizes the impact of a compromised container on the host kernel?

Which of the following is the most effective way to prevent secrets (such as API keys) from being leaked via container images?

Refer to the exhibit. What is the security impact of the provided Kubernetes security context configuration?

Exhibit

A GSEC candidate is reviewing a Docker Compose file for a web application. The file includes a service definition that mounts the Docker socket into the container. What is the primary security risk of this configuration?

A security analyst is examining a Kubernetes Pod specification that includes the following securityContext: runAsUser: 0. What is the security implication of this setting?