200-201 Question 16
Select 3An organization is running a critical web application inside a containerized environment on multiple hosts. The cybersecurity team has been tasked with ensuring the security of the containers and the underlying virtual environment. Which of the following actions should the team prioritize to secure this environment?
- A
Implement network segmentation to isolate containers from each other and the host network.
- B
Ensure that the container images are sourced from trusted registries and are regularly scanned for vulnerabilities.
- C
Disable logging inside the containers to prevent attackers from accessing sensitive logs.
- D
Apply security patches to both the container runtime and the host operating system regularly.
- E
Grant containers root access to the host operating system to reduce permission issues.
Show answer and explanation
Correct answers: A, B, D
Explanation
Securing a containerized environment requires addressing both the containers themselves and the underlying virtual or host environment. Network segmentation, using trusted and vulnerability-free images, and applying security patches are key practices to protect the environment. Granting excessive permissions or disabling logging would weaken the security posture, leaving the system vulnerable to attacks.
- A. Correct.
Network segmentation helps prevent lateral movement in case a container is compromised, ensuring better isolation and security.
- B. Correct.
Using trusted registries and scanning container images for vulnerabilities ensures that malicious or outdated images are not deployed in the environment.
- C. Incorrect.
Disabling logging is not recommended, as logs are critical for monitoring and detecting suspicious activity. Proper log management is a better approach.
- D. Correct.
Applying security patches to the container runtime and host OS addresses known vulnerabilities and strengthens the overall security of the environment.
- E. Incorrect.
Granting containers root access increases the attack surface and can allow attackers to exploit the host system if the container is compromised.