CA1-005: CompTIA SecurityXDemo

Question

A security engineer wants to minimize the attack surface of a public-facing, containerized application. Which of the following would best reduce the application's privilege-escalation attack surface?

A Implementing the following commands in the Dockerfile:RUN echo user:x:1000:1000:user:/home/user:/dev/null > /etc/passwd
B Installing an EDR on the container's host, with reporting configured to log to a centralized SIEM, and implementing the following alerting rule:IF PROCESS_USER==root ALERT_TYPE==critical
C Designing a multicontainer solution, with one set of containers that runs the main application, and another set of containers that performs automatic remediation by replacing compromised containers or disabling compromised accounts
D Running the container in an isolated network and placing a load balancer in a public-facing network. Adding the following ACL to the load balancer:PERMIT HTTPS from 0.0.0.0.0/0 port 443

Explanation

Running an application as a non-root container user limits the privileges available to a compromised process and therefore reduces opportunities for privilege escalation. A non-root account must also be made the runtime user with Docker’s USER instruction or an equivalent runtime configuration; creating the account entry alone does not change the default runtime user.

Learn more

CA1-005: CompTIA SecurityXDemo

AstroTutor

Notes

Readiness

QuestionQ88

Community Discussion