312-97: EC-Council Certified DevSecOps Engineer (ECDE)Demo

Question

Evan Peters works as a DevSecOps engineer for an IT company based in Denver, Colorado. His organization has deployed multiple applications using Docker containers. Evan has been running the SSH service inside these containers, and managing SSH keys and access policies has become a significant security concern for him.

What solution should address Evan's security concern?

A Run SSH on the host and utilize docker exec for interacting with the container
B Run SSH on the docker build and utilize docker exec for interacting with the container
C Run SSH on the registry and utilize docker exec for interacting with the container
D Run SSH on the client and utilize docker exec for interacting with the container

Explanation

Running SSH daemons inside containers is discouraged because it forces administrators to manage SSH keys, user accounts, and access policies separately for every container, increasing operational overhead and attack surface. Docker security best practices (reflected in guides such as the CIS Docker Benchmark) recommend instead running SSH only on the host system and using the 'docker exec' command to obtain a shell or execute commands inside a running container. This approach centralizes authentication and key management on the host while still allowing administrators to interact with container processes, eliminating the need to expose or maintain SSH services within each container image.

Learn more

Docker security | Docker Docs

312-97: EC-Council Certified DevSecOps Engineer (ECDE)Demo

AstroTutor

Notes

Readiness

QuestionQ34

Community Discussion