Cloud Native Operations

English

한국어

English

한국어

Appearance

Container Image Security Quiz ​

Last Updated: September 13, 2026

1. Which command scans a given image reference with Trivy? ​

  • A. trivy scan "$IMAGE_REF"
  • B. trivy image "$IMAGE_REF"
  • C. trivy container "$IMAGE_REF"
  • D. trivy check "$IMAGE_REF"
Show Answer

Answer: B. trivy image "$IMAGE_REF"

trivy image is the image-scanning command. Set IMAGE_REF to a real digest reference. Valid syntax alone does not establish registry access, database freshness, or package-detection coverage.

2. Which tool verifies a relationship between an image digest and an approved signer? ​

  • A. Trivy’s CVE database
  • B. Cosign/Sigstore
  • C. Clair’s package scanner
  • D. Docker imagePullPolicy
Show Answer

Answer: B. Cosign/Sigstore

Cosign verifies a key or OIDC identity/issuer, digest, and required transparency evidence. Signatures do not guarantee the absence of known vulnerabilities.

3. What does shift-left security mean? ​

  • A. Deferring checks until production
  • B. Checking earlier in development, PRs, and builds
  • C. Restricting source access to the security team
  • D. Removing production rescanning
Show Answer

Answer: B. Checking earlier in development, PRs, and builds

Earlier checks shorten feedback loops. New CVEs and runtime behavior still require registry rescanning and runtime detection after release.

4. What characterizes a standard distroless runtime image? ​

  • A. Every Linux utility is included
  • B. A minimal set of application runtime components
  • C. A shell and debugger are always included
  • D. A package manager is mandatory
Show Answer

Answer: B. A minimal set of application runtime components

Standard runtimes omit shells/package managers; debug variants differ. Application binaries and libraries can still contain vulnerabilities.

5. How do current ECR Basic and Enhanced scanning differ? ​

  • A. Basic uses AWS-native OS scanning; Enhanced uses Inspector for OS/language packages
  • B. Basic always uses Clair; Enhanced scans only OS packages
  • C. Both automatically reject pushes
  • D. Enhanced scans every image forever
Show Answer

Answer: A. Basic uses AWS-native OS scanning; Enhanced uses Inspector for OS/language packages

Basic supports manual/scan-on-push; Enhanced supports scan-on-push/continuous. Distinguish findings from enhancedFindings and ECR from Inspector events.

6. What does an SBOM provide? ​

  • A. Certification that no vulnerabilities exist
  • B. An inventory of software components detected by a tool
  • C. Automatic proof of an approved signer
  • D. Deployment authorization
Show Answer

Answer: B. An inventory of software components detected by a tool

SBOMs record components and relationships but may have incomplete coverage. Assess signed attestations binding them to a digest and the verification policy separately.

7. Which rule performs image signature checks in legacy Kyverno ClusterPolicy? ​

  • A. validate only
  • B. mutate only
  • C. verifyImages
  • D. generate only
Show Answer

Answer: C. verifyImages

Distinguish legacy verifyImages from the newer ImageValidatingPolicy. The Kyverno 1.19.1 example uses CEL policies alongside registry/digest restrictions covering ordinary, init, and ephemeral containers.

8. Why pin an image digest instead of a tag? ​

  • A. It is always shorter
  • B. It identifies specific image content
  • C. It automatically verifies signatures
  • D. It removes CVEs
Show Answer

Answer: B. It identifies specific image content

Tags can move; digests identify content. This supports reproducible artifact selection but does not replace signer trust, vulnerability checks, or availability validation.

9. Which area is separate from Trivy’s static checks? ​

  • A. OS package identification
  • B. Language-dependency scanning
  • C. Live syscall/process behavior detection
  • D. Source-secret detection
Show Answer

Answer: C. Live syscall/process behavior detection

Package, misconfiguration, and secret scanning differ from runtime behavior detection. Design runtime tooling such as Falco separately.

10. Which registry access practice is inappropriate? ​

  • A. Approved pull identities for private images
  • B. Digest/signature verification for public images
  • C. Allowing arbitrary anonymous image pushes/deletes
  • D. Separating registry, admission, and scan-gate permissions
Show Answer

Answer: C. Allowing arbitrary anonymous image pushes/deletes

Anonymous reads of intentionally public images are not inherently vulnerabilities. Control confidentiality, write/delete permissions, provenance, and rate limits separately.

11. What should happen when the agreed CI scan gate does not pass? ​

  • A. Always ignore it
  • B. Stop before publishing/signing and inspect the cause
  • C. Rebuild another image and push without scanning
  • D. Force exit code 0
Show Answer

Answer: B. Stop before publishing/signing and inspect the cause

Distinguish policy violations from scanner/database/permission errors and retain results. Do not deploy a different artifact rebuilt after the scan. Exceptions need rationale, ownership, and expiry.

12. Which assumption about Alpine is incorrect? ​

  • A. It uses musl libc
  • B. It uses the apk package manager
  • C. It is always fully compatible with glibc-dependent applications
  • D. The selected release’s support lifetime must be checked
Show Answer

Answer: C. It is always fully compatible with glibc-dependent applications

Alpine uses musl, so glibc-dependent binaries can have compatibility issues. Image size alone guarantees neither vulnerability counts nor build speed.