Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-38 (Certified Network Defender) Practice Test 17

Question 160

A deployment must ensure every container instance uses an audited image, even if a mutable tag is later moved to different content. What should the deployment pin?

  1. Only the image's human-readable latest tag
  2. A public description in a registry listing
  3. An immutable container image digest
  4. The container's display name
  5. Pinning an image's repository name while omitting version and digest

Explanation

Correct Answer

C:

A content-addressed digest identifies the expected image bytes and avoids silently accepting a newly retargeted tag.

Incorrect Answers

A:

Tags can be reassigned, making the underlying artifact change without the manifest text visibly changing.

B:

Registry metadata is not an immutable reference to the exact executable layers used at deployment.

D:

Runtime names label instances and do not attest to which image content was pulled and executed.

E:

A repository name identifies a source namespace but permits whichever current artifact is selected by mutable tags or defaults.

Question 161

A Docker workload needs no root privileges on the host. Which runtime mode best reduces host-root exposure?

  1. Share the host PID namespace with untrusted containers
  2. Rootless Docker or an appropriately user-namespaced runtime
  3. Mount the host root filesystem read-write into the container
  4. Run the container with --privileged by default

Explanation

Correct Answer

B:

Rootless operation reduces dependence on a daemon with host root authority, though service and kernel confinement still matter.

Incorrect Answers

A:

Shared process visibility can expose other processes and weakens the intended container isolation.

C:

Broad host filesystem access creates a powerful compromise route independent of application permissions.

D:

Privileged mode grants extensive device and capability access and defeats the desire to limit host impact.

Question 162

A containerized image processor needs to read one input directory but not manage host devices or kernel settings. What is the best runtime hardening choice?

  1. Drop unnecessary capabilities and mount only required paths
  2. Disable all seccomp restrictions for convenience
  3. Add CAP_SYS_ADMIN to every container
  4. Use a writable mount of the entire host /etc directory

Explanation

Correct Answer

A:

Minimal Linux capabilities and scoped filesystems reduce the authority available if the image processor is exploited.

Incorrect Answers

B:

Removing syscall filtering widens kernel attack surface without supporting the stated limited workflow.

C:

This broad capability enables many sensitive operations and greatly expands the attacker's available primitives.

D:

Allowing host configuration changes is unnecessary for image processing and creates persistence risks.

Question 163

A Kubernetes service account used by a log collector should read pods but must not create deployments. Which authorization change is appropriate?

  1. Place an API token into every application image
  2. A scoped RBAC Role with read-only permissions and a RoleBinding
  3. Disable Kubernetes API authentication for all in-cluster clients
  4. Bind the account to cluster-admin

Explanation

Correct Answer

B:

Kubernetes RBAC can bind only the required verbs and resources in the necessary namespace to the collector identity.

Incorrect Answers

A:

Broad token distribution increases compromise exposure and does not constrain the collector's API permissions.

C:

Removing authentication lets workloads access API functionality without establishing authorized identities.

D:

Cluster-wide administrative authority is excessive and allows sensitive changes unrelated to reading pod metadata.

Question 164

Pods in one Kubernetes namespace should reach only designated application services, not every workload in the cluster. Which control is intended for pod-level traffic policy?

  1. Changing the container log format
  2. Namespace naming conventions alone
  3. Namespace-scoped Kubernetes RBAC for service accounts without network rules
  4. Kubernetes NetworkPolicy with a compatible enforcing CNI

Explanation

Correct Answer

D:

NetworkPolicy can describe ingress and egress selections, but actual enforcement depends on network-plugin support and correct selectors.

Incorrect Answers

A:

Log formatting affects observability and cannot deny packets crossing an inappropriate trust boundary.

B:

Namespaces organize resources, but names without network enforcement do not prevent cross-workload connections.

C:

RBAC is necessary for API authorization but does not restrict packet forwarding among application pods; a compatible network plugin must enforce pod traffic rules.

Question 165

A Kubernetes cluster stores application secrets in etcd. Which measures help limit exposure if storage is inspected?

  1. Publish etcd endpoints publicly to simplify administration
  2. Encrypt Secrets at rest and restrict API/etcd access
  3. Base64-encode secret values and treat that as encryption
  4. Grant all service accounts permission to list every Secret

Explanation

Correct Answer

B:

Encryption providers protect sensitive values in storage, while RBAC and infrastructure controls constrain access to decrypted data.

Incorrect Answers

A:

Exposed control-plane storage increases risk, particularly when credentials and cluster state are accessible.

C:

Kubernetes Secret manifests often contain encoded data, but base64 representation does not protect confidentiality by itself.

D:

Broad list access exposes credentials to compromised workloads and defeats namespace-scoped least privilege.

Question 166

A cloud tenant discovers a hypervisor-level flaw affecting a provider-managed compute service. Who normally owns remediation of the underlying physical virtualization platform?

  1. No one, because cloud services remove infrastructure risk
  2. The tenant engineering team responsible for patching guest operating systems
  3. The cloud provider, within the service's shared-responsibility model
  4. A managed security provider contracted only to maintain the tenant applications

Explanation

Correct Answer

C:

Providers secure their infrastructure, while customers remain responsible for tenant configurations, identities, workloads, and data as applicable.

Incorrect Answers

A:

Cloud adoption shifts some duties to a provider rather than eliminating the need to manage or remediate infrastructure weaknesses.

B:

Guest-OS patch teams can correct vulnerabilities inside customer-managed virtual machines but cannot remediate hypervisor code in provider-owned physical infrastructure.

D:

An application support contractor may advise or manage workloads, but it does not automatically have responsibility or authority to patch the underlying provider virtualization layer.

Question 167

A workload on AWS needs temporary permission to retrieve a secret without storing a permanent access key in its image. Which identity pattern is appropriate?

  1. Use an IAM user access key rotated annually and embedded in an encrypted application config
  2. Attach an IAM role and use temporary credentials
  3. Issue credentials from an administrator workstation and copy them to the EC2 image at build time
  4. Put an IAM user's permanent secret key in a public repository

Explanation

Correct Answer

B:

A role can grant scoped permissions to the running workload while avoiding long-lived static access keys embedded in code.

Incorrect Answers

A:

An encrypted static configuration still requires workload decryption and recurring credential distribution, while the requirement calls for temporary workload credentials.

C:

A build-time credential copy stores reusable secrets in an image. That distribution approach does not provide an instance-scoped role with short-lived credentials.

D:

Persistent exposed credentials are easily stolen and do not satisfy the requirement for automatically issued short-lived access.

Question 168

AWS instances in a private subnet need stateful filtering that automatically permits responses to allowed outbound connections. Which control should be attached to the instance network interface?

  1. A security group with narrowly defined rules
  2. A VPC route table alone
  3. A public DNS zone record
  4. A route table entry allowing return paths
  5. A network ACL used as if it maintained connection state

Explanation

Correct Answer

A:

AWS security groups are stateful virtual firewalls associated with network interfaces; return traffic for permitted connections is allowed.

Incorrect Answers

B:

Routes determine the next hop and cannot replace instance-level permission rules for allowed traffic.

C:

DNS naming resolves addresses but does not control stateful connection filtering at an instance interface.

D:

Routing may provide network reachability, but it does not determine the stateful instance-interface permission decision required here.

E:

AWS network ACLs are stateless and require explicit handling of outbound and return directions, including ephemeral ports.

Question 169

A subnet boundary on AWS must deny a specific suspicious source even if instance security groups would otherwise allow the traffic. Which mechanism is a subnet-level stateless filter?

  1. A network access control list (NACL)
  2. A CloudWatch dashboard
  3. An IAM role policy
  4. A security group with an explicit deny rule

Explanation

Correct Answer

A:

NACLs evaluate subnet traffic with ordered allow/deny rules and do not maintain session state for return packets.

Incorrect Answers

B:

A dashboard can display telemetry but does not enforce subnet network-packet filtering on its own.

C:

IAM permissions authorize API operations, not packet admission at the subnet network boundary.

D:

Security groups support allow rules rather than a general explicit-deny rule model like NACLs.

Question 170

An AWS storage administrator needs to minimize accidental anonymous exposure of newly created S3 buckets. Which preventive baseline is most appropriate?

  1. Allow ACLs granting everyone read access by default
  2. Disable object-access monitoring and retain no logs
  3. Enable S3 Block Public Access at the intended scope
  4. Rely solely on obscurity of bucket names

Explanation

Correct Answer

C:

Block Public Access settings constrain bucket or account-level public access pathways and help prevent accidental data publication.

Incorrect Answers

A:

Public ACLs make objects broadly retrievable and contradict the objective of preventing anonymous exposure.

B:

Losing visibility neither blocks public access nor helps investigate accidental exposure when it occurs.

D:

Bucket names may be discoverable and cannot function as authorization boundaries for sensitive objects.

Certified Network Defender (312-38) Practice Tests