CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The container uses default credentials for SSH

  Why it's wrong here

  While default SSH credentials would grant a penetration tester access *into* the container, this access is confined to the container's isolated environment. SSH provides user-level interaction within the container's namespaces and cgroups, which are designed to prevent direct interaction with the host system. Therefore, simply having SSH access inside the container does not inherently provide a mechanism to break out of that isolation and escape to the host.

• ✗

  The container image has a known vulnerability in the MQTT library

  Why it's wrong here

  A known vulnerability in an application library like MQTT, even if exploited, typically allows for compromise *within* the container's user space or application layer. Such vulnerabilities usually do not provide the necessary privileges or direct access to the underlying container runtime or host kernel interfaces required for a container escape. Exploiting an MQTT library would likely lead to data manipulation or denial of service within the container, not a breach of its isolation boundary.

• ✗

  The host OS is running an outdated kernel version

  Why it's wrong here

  An outdated host OS kernel version certainly presents a significant security risk, as it could harbor known vulnerabilities that, if exploited, might lead to privilege escalation or container escape. However, exploiting a host kernel vulnerability is often a complex and highly technical endeavor, requiring specific exploits tailored to the kernel version. While possible, it is generally less common for a penetration tester to leverage a direct kernel exploit for container escape compared to exploiting a misconfiguration of the container runtime itself.

• ✓

  The container is running with the --privileged flag

  Why this is correct

  Running a container with the `--privileged` flag effectively disables most of the security features and isolation mechanisms provided by the container runtime. This flag grants the container nearly all capabilities of the host, including direct access to host devices (e.g., `/dev`), the ability to mount host filesystems, and full control over the kernel's capabilities (like `CAP_SYS_ADMIN`). These elevated privileges provide direct and straightforward vectors for a penetration tester to break out of the container and gain control over the host system.

Go deeper

Related to this question