How does Twistlock offer workload security at runtime?

Question

Options

• Aworks with the IDP to identify over-privileged containers and services and restricts network
• Bquarantines containers that demonstrate increased CPU and memory usage
• Cautomatically patches vulnerabilities and compliance issues for every container and service
• Dbuilds a whitelist security model automatically for every container and service

• A
  94% (46)
• B
  4% (2)
• D
  2% (1)

Explanation

Option A is correct because Twistlock integrates with identity providers (IDPs) to enforce least-privilege at runtime - it detects containers or services with excessive permissions and enforces network restrictions to contain potential threats. This is core to its runtime defense model, which ties identity and network policy together to reduce the attack surface dynamically.

Why the distractors are wrong:

• B is wrong because high CPU/memory usage is a performance metric, not a security signal Twistlock acts on - quarantining based on resource usage alone would cause massive false positives in legitimate workloads.
• C is wrong because Twistlock identifies and alerts on vulnerabilities and compliance gaps but does not automatically patch them - patching requires human or pipeline intervention.
• D is a tempting distractor because Twistlock does use behavioral modeling to establish baselines, but the whitelist approach describes its learning phase, not its core runtime enforcement mechanism involving IDP and network controls.

Memory tip: Think "runtime = real-time identity + network control." Twistlock pairs the who (IDP/identity) with the where (network) to stop threats as they happen - not by patching (C), not by CPU watching (B), and not just by a static whitelist (D).

No community discussion yet for this question.