Google Professional Cloud Developer Question 248
Select 3Google Cloud PlatformYou are tasked with creating a secure container image for a microservice that will run on Google Kubernetes Engine (GKE). Which of the following steps should you take to ensure the container image is secure and adheres to best practices?
- A
Use a minimal base image to reduce the attack surface.
- B
Run the application as a root user inside the container for full access.
- C
Scan the container image for vulnerabilities using Google Cloud's Container Analysis.
- D
Include only required dependencies in the container image.
- E
Embed sensitive credentials, such as API keys, directly into the container image for easy access.
Show answer and explanation
Correct answers: A, C, D
Explanation
To create secure container images, it is important to minimize the attack surface by using minimal base images and including only necessary dependencies. Scanning container images for vulnerabilities is essential to identifying and addressing risks. Avoid insecure practices such as running containers as root or embedding sensitive credentials directly into the image. These steps align with best practices for secure container development in a Google Cloud environment.
- A. Correct.
Using a minimal base image reduces the attack surface by limiting unnecessary tools and libraries that might introduce vulnerabilities.
- B. Incorrect.
Running the application as a root user inside the container is a security risk because it increases the potential damage in case of a compromise. It is recommended to run applications as a non-root user.
- C. Correct.
Scanning the container image for vulnerabilities using tools like Google Cloud's Container Analysis is a crucial step in identifying and mitigating security risks before deployment.
- D. Correct.
Including only required dependencies ensures that the container image is lightweight and reduces the chance of introducing vulnerabilities from unused or unnecessary libraries.
- E. Incorrect.
Embedding sensitive credentials directly into the container image is highly insecure as the credentials can be exposed if the image is accessed. Instead, use tools like Secret Manager to manage credentials securely.