PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #35
When creating a secure container image, which two items should you incorporate into the build if possible? (Choose two.)
The correct answer is B. Package a single app as a container. C. Remove any unnecessary tools not needed by the app. Packaging a single app per container (B) follows the single-responsibility principle, reducing the attack surface and limiting blast radius if a container is compromised. Removing unnecessary tools (C) eliminates utilities an attacker could exploit for lateral movement or…
Question
Options
- AEnsure that the app does not run as PID 1.
- BPackage a single app as a container.
- CRemove any unnecessary tools not needed by the app.
- DUse public container images as a base image for the app.
- EUse many container image layers to hide sensitive information.
How the community answered
(21 responses)- B95% (20)
- D5% (1)
Explanation
Packaging a single app per container (B) follows the single-responsibility principle, reducing the attack surface and limiting blast radius if a container is compromised. Removing unnecessary tools (C) eliminates utilities an attacker could exploit for lateral movement or privilege escalation (e.g., curl, bash, package managers). Option A (avoiding PID 1) is a runtime concern, not a build-time one. Option D is risky - public base images may contain unpatched vulnerabilities; you should always use trusted, vetted base images. Option E is a misconception - container layers are not an encryption mechanism and can be fully inspected with standard tools, so they must never be used to hide secrets.
Topics
Community Discussion
No community discussion yet for this question.