Which two actions help limit the attack surface of your Docker container? (Choose two.)

Running only a single service per container adheres to the principle of least privilege and 'one concern per container', minimizing the attack surface by reducing unnecessary processes, libraries, and dependencies within the image.

Running all services in a single image significantly increases the attack surface by bundling more software and dependencies than necessary, making the container more complex and harder to secure.

Using version tags for base images and dependencies (e.g., 'ubuntu:20.04' instead of 'ubuntu:latest') ensures deterministic builds and allows specific security vulnerabilities to be tracked and updated, rather than relying on potentially unstable or unpatched 'latest' tags.

Kali Linux is a specialized distribution for penetration testing and forensics, not designed as a minimal or secure base image for production applications, and would vastly increase the attack surface.

Downloading images over HTTPS is a good practice for ensuring image integrity during transmission, but it does not directly limit the attack surface of the container's contents or configuration once the image is built or running.