CCSK · Question #227
Which of the following is not a security benefit of Immutable workloads?
The correct answer is C. You can enable remote logins to run workloads. Enabling remote logins to running workloads contradicts the immutability principle and is a security risk, not a benefit.
Question
Which of the following is not a security benefit of Immutable workloads?
Options
- ASecurity testing can be managed during image creation
- BYou no longer patch running systems or worry about dependencies
- CYou can enable remote logins to run workloads
- DIt is much faster to roll out updated versions
- EIt is easier to disable services and whitelist applications
How the community answered
(33 responses)- A6% (2)
- B3% (1)
- C79% (26)
- D9% (3)
- E3% (1)
Why each option
Enabling remote logins to running workloads contradicts the immutability principle and is a security risk, not a benefit.
Performing security testing during image creation is a genuine benefit because vulnerabilities are caught before deployment into production.
Eliminating the need to patch running systems removes a major attack vector and operational risk, making this a true security benefit.
Immutable workloads are designed so that no changes are made to running instances - they are replaced rather than modified. Enabling remote logins (such as SSH) to running workloads directly violates this model by creating a pathway for unauthorized or untracked changes, introducing configuration drift and expanding the attack surface. This negates the core security guarantee of immutability.
Faster rollout of updated versions allows security fixes to be deployed rapidly, which is a security benefit of the immutable model.
Disabling unnecessary services and whitelisting applications during image creation reduces the attack surface, which is a recognized security benefit.
Concept tested: Security properties and limitations of immutable workloads
Source: https://csrc.nist.gov/publications/detail/sp/800-190/final
Topics
Community Discussion
No community discussion yet for this question.