easyMultiple Select
200-901 Practice Question: Which TWO are valid methods to secure a Docker…
Which TWO are valid methods to secure a Docker container?
⚠ Common exam trap
Cisco often tests the misconception that 'running as root inside a container is safe because the container is isolated,' but the trap here is that root inside a container is the same UID 0 on the host if the container is not run with a user namespace remapping or `--user` flag, making it a direct privilege escalation vector.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use read-only filesystem
Option A (Use read-only filesystem) is correct because mounting a container's root filesystem with the --read-only flag prevents processes from writing to the filesystem, which blocks malware persistence, unauthorized file modification, and many privilege-escalation or tampering attacks. Option C (Set resource limits) is correct because constraining CPU, memory, and other resources via flags such as --memory, --cpus, or --pids-limit mitigates denial-of-service and resource-exhaustion attacks, and limits the blast radius if a container is compromised. The remaining options weaken security: exposing all ports (B) unnecessarily enlarges the attack surface, running containers as root (D) violates least privilege and increases the impact of a container breakout, and disabling network isolation (E) removes segmentation that normally restricts lateral movement between containers and hosts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use read-only filesystem
Why this is correct
Mounting the container's root filesystem read-only prevents processes from writing to or modifying binaries and configuration at runtime, blocking many post-compromise persistence and tampering techniques. This directly hardens the container, satisfying the stem's requirement for a valid Docker security method.
- ✗
Expose all ports
Why it's wrong here
Publishing every port widens the reachable attack surface, which is the opposite of securing a container. It is tempting because exposing ports is how services become reachable, and that is legitimate when a container must accept inbound traffic on specific, deliberately chosen ports.
- ✓
Set resource limits
Why this is correct
Setting CPU and memory limits via cgroups caps how much of the host a container can consume, containing denial-of-service and resource-exhaustion attacks from a compromised or runaway process. This is a recognised container-hardening control, satisfying the stem's requirement for a valid Docker security method.
- ✗
Run containers as root
Why it's wrong here
Running as root means a container escape or process compromise yields host-level privileges, defeating the isolation securing a container depends on. It is tempting because many official images default to root, so it works without extra configuration when privilege inside the container is genuinely required.
- ✗
Disable network isolation
Why it's wrong here
Disabling network isolation lets containers reach each other and the host unrestricted, removing the segmentation that limits lateral movement after compromise. It is tempting because flat networking simplifies service discovery and connectivity when containers must freely communicate without policy overhead.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 975 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.