CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography
A security analyst discovers that a containerized application running in a cloud environment can access the host's file system by mounting /var/run/docker.sock inside the container. Which type of attack does this configuration enable?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Container escape to the host
Mounting the Docker socket inside a container allows the container to communicate with the Docker daemon on the host, potentially allowing the attacker to create new containers, escape the container, and execute commands on the host.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Server-Side Request Forgery (SSRF)
Why it's wrong here
Server-Side Request Forgery (SSRF) is an application-layer vulnerability where an attacker can coerce a server-side application to make HTTP requests to an arbitrary domain or internal resources. While SSRF can be used for network reconnaissance or to interact with internal services, it does not directly grant control over the host's Docker daemon or enable the execution of arbitrary commands on the host system, which is the direct capability provided by access to the Docker socket.
- ✗
Privilege escalation within the container only
Why it's wrong here
Privilege escalation within the container refers to gaining elevated privileges (e.g., root) *inside* the isolated container environment, without breaking out to the host. However, direct access to the Docker socket (`/var/run/docker.sock`) fundamentally bypasses container isolation entirely, allowing an attacker to interact with the host's Docker daemon to create, modify, or delete containers, effectively granting host-level control far beyond mere internal container escalation.
- ✓
Container escape to the host
Why this is correct
This is the correct answer because mounting the Docker socket (`/var/run/docker.sock`) inside a container grants the container full administrative control over the host's Docker daemon. An attacker can leverage this access to execute Docker commands, such as `docker run -v /:/host_root -it ubuntu bash`, which effectively mounts the host's root filesystem into a new container, thereby achieving a complete container escape and gaining arbitrary command execution capabilities on the host system.
- ✗
Denial-of-Service (DoS) attack against the container runtime
Why it's wrong here
While an attacker with Docker socket access *could* potentially cause a Denial-of-Service (DoS) by stopping critical containers, deleting images, or exhausting host resources, this is not the most direct or comprehensive threat posed by this vulnerability. The primary capability gained is arbitrary command execution and full control over the host's Docker daemon, which allows for far more impactful actions than just a DoS, including data exfiltration, persistent backdoors, and complete system compromise.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.