Google Professional Cloud Developer Question 247
Select 3Google Cloud PlatformYou are tasked with building a secure container image for a new microservice your team is developing. Which practices should you follow to ensure the container image is secure?
- A
Use a minimal base image and remove unnecessary packages during the build process.
- B
Include sensitive credentials (e.g., API keys) directly in the container image for easy access.
- C
Regularly scan the container image for vulnerabilities using a container scanning tool.
- D
Run the container as a non-root user wherever possible.
- E
Use the latest version of the base image without verifying its security or compatibility.
Show answer and explanation
Correct answers: A, C, D
Explanation
Building secure container images involves practices that reduce the attack surface, proactively identify vulnerabilities, and limit privileges. Using a minimal base image, scanning for vulnerabilities, and running containers as non-root users are all critical steps in securing containerized applications. Including sensitive credentials in the image or using unverified base images are common mistakes that can lead to security breaches.
- A. Correct.
Using a minimal base image and removing unnecessary packages reduces the attack surface of the container, making it harder for attackers to exploit vulnerabilities.
- B. Incorrect.
Including sensitive credentials in the container image is a security risk as it can expose them to anyone who has access to the image.
- C. Correct.
Regularly scanning the container image for vulnerabilities ensures that you identify and address security issues in a timely manner.
- D. Correct.
Running the container as a non-root user minimizes the impact of a potential security breach, as attackers would not have root privileges.
- E. Incorrect.
Using the latest version of a base image without verifying its security or compatibility can introduce vulnerabilities or break the application due to untested changes.