Your company operates a hybrid cloud environment spanning AWS, Azure, and Google Cloud. The security team wants to implement a pre-runtime protection strategy to prevent containerized applications fro

Question

Options

• ANetwork-Based Intrusion Detection
• BApplication Sandboxing
• CRegistry Scanning
• DHost-Based Malware Scanning

• A
  12% (2)
• C
  82% (14)
• D
  6% (1)

Explanation

Option A: Network-based intrusion detection systems (NIDS) monitor network traffic for malicious activity but do not assess container images for vulnerabilities before deployment. They are useful for runtime threat detection, not pre-runtime protection. Option B: Sandboxing isolates applications to observe their behavior and detect potential threats. However, this method is typically used for testing unknown executables rather than scanning container images in a registry before deployment. It does not provide proactive pre-runtime Option C: Registry scanning is the most effective method for assessing container images before they are deployed. It integrates with container registries (e.g., Amazon ECR, Azure Container Registry, Google Artifact Registry) to scan images for vulnerabilities, misconfigurations, and malware before they are pulled into a runtime environment. This pre-runtime approach ensures security compliance across multiple cloud platforms. Option D: Host-based scanning is focused on identifying threats already present on a running system. While useful for runtime protection, it does not prevent vulnerable images from being deployed in the first place, making it an inadequate choice for pre-runtime security.

No community discussion yet for this question.