You are reviewing a deployment image used to launch a containerized workload on a cloud platform. Which of the following configurations in the image is most likely to result in a security…

Question

Options

• AThe application dependencies are explicitly version-pinned in the Dockerfile.
• BThe base image is built using a minimal Linux distribution such as Alpine.
• CThe image exposes port 22 and includes an SSH server.
• DUnused packages and dependencies have been removed from the image during the build process.

• A
  15% (6)
• B
  3% (1)
• C
  72% (28)
• D
  10% (4)

Explanation

Option A: Version-pinning dependencies ensures consistency and reduces the risk of introducing vulnerabilities due to updates or changes in upstream packages. This practice is a recommended approach to maintaining security and reliability. Option B: Minimal base images like Alpine are preferred for containerized workloads because they reduce the attack surface by including only essential packages. They also result in smaller image sizes, making vulnerabilities easier to track and manage. Option C: Including an SSH server in a containerized image and exposing port 22 introduces a significant attack surface. Containers are typically designed to run single processes and should not function as full-fledged virtual machines. By exposing SSH, the container becomes vulnerable to brute-force attacks, credential leaks, and lateral movement within the environment. Best practices recommend using mechanisms like kubectl exec for debugging and avoiding SSH in containerized environments. Option D: Removing unnecessary packages reduces the attack surface and improves overall security. It also decreases image size, which benefits performance and deployment speed.

No community discussion yet for this question.