A security team is reviewing an image assessment report for a containerized application. The report indicates multiple high-severity Common Vulnerabilities and Exposures (CVEs) related to outdated…

Question

Options

• AApply runtime security policies to prevent container escapes and limit access to critical system files
• BUse a Kubernetes NetworkPolicy to isolate the vulnerable container from external network traffic
• CRebuild the container image using a more recent version of the base image that includes security
• DWhitelist the vulnerabilities in the assessment report to allow deployment since the application is

• A
  2% (1)
• B
  5% (2)
• C
  86% (36)
• D
  7% (3)

Explanation

Option A: Runtime security policies (e.g., limiting system calls with seccomp) help mitigate exploitation risks but do not eliminate vulnerabilities. The CVEs could still be exploitable under certain conditions. Option B: NetworkPolicies help restrict access to malicious actors but do not fix the vulnerabilities within the image itself. The risk remains if an attacker finds another vector of exploitation. Option C: Updating the base image to a patched version is the most effective way to eliminate vulnerabilities before runtime. Modern container security best practices recommend using minimal and frequently updated base images to reduce attack surfaces. Option D: Whitelisting vulnerabilities is risky, as even if the application is not directly affected today, future changes in dependencies or attack methods could expose the vulnerability.

No community discussion yet for this question.