mediumMultiple SelectObjective-mapped
CCSP Practice Question: Which TWO of the following are best practices for…
Which TWO of the following are best practices for securing a cloud-based container orchestration platform?
⚠ Common exam trap
ISC2 often tests the misconception that environment variables are a safe place for secrets because they are 'not stored on disk,' but in reality they are accessible to any process or user with access to the container's runtime environment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use minimal base images to reduce the attack surface.
Using minimal base images (e.g., Alpine or distroless images) reduces the number of installed packages and libraries, thereby shrinking the attack surface. This practice limits the potential vectors for privilege escalation or remote code execution within containers, which is a core security principle for containerized workloads in platforms like Kubernetes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use minimal base images to reduce the attack surface.
Why this is correct
Minimal images reduce vulnerabilities.
- ✗
Store secrets in environment variables for ease of use.
Why it's wrong here
Environment variables are insecure for secrets.
- ✗
Run containers with root privileges by default.
Why it's wrong here
Root privileges increase risk.
- ✓
Enable audit logging for all administrative actions.
Why this is correct
Audit logs are essential for security.
- ✗
Disable TLS certificate validation for internal communications.
Why it's wrong here
Disabling validation creates security holes.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.