During an image security scan, a container image assessment report reveals that an API key and database credentials are embedded in the Docker image's environment variables. Which of the following…

Question

Options

• AEncrypt the secrets within the image using AES-256 and store the decryption key in a separate
• BUse Docker's --no-cache flag when building the image to prevent secrets from being stored in
• CChange file permissions in the image to restrict access to the secrets to only the root user
• DRemove secrets from the image and use environment variables injected at runtime via a secrets

• A
  24% (13)
• B
  4% (2)
• C
  9% (5)
• D
  63% (34)

Explanation

Option A: Encrypting secrets inside the image does not solve the problem effectively because the decryption key must still be accessible, potentially leading to key exposure. Option B: Using --no-cache can prevent secrets from persisting in intermediate layers during image builds, but it does not remove the fundamental problem of hardcoded secrets within the Option C: File permission changes only limit access inside the container but do not prevent secrets from being extracted from the image itself once it is pulled from a registry. Option D: Hardcoded secrets in container images pose a major security risk. The best approach is to remove them and use a secrets management solution like AWS Secrets Manager, HashiCorp Vault, or Kubernetes Secrets to inject them at runtime securely.

No community discussion yet for this question.