exam questions

Exam Professional Cloud Security Engineer All Questions

View all questions & answers for the Professional Cloud Security Engineer exam

Exam Professional Cloud Security Engineer topic 1 question 5 discussion

Actual exam question from Google's Professional Cloud Security Engineer
Question #: 5
Topic #: 1
[All Professional Cloud Security Engineer Questions]

When creating a secure container image, which two items should you incorporate into the build if possible? (Choose two.)

  • A. Ensure that the app does not run as PID 1.
  • B. Package a single app as a container.
  • C. Remove any unnecessary tools not needed by the app.
  • D. Use public container images as a base image for the app.
  • E. Use many container image layers to hide sensitive information.
Show Suggested Answer Hide Answer
Suggested Answer: BC 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
tzKhalil
Highly Voted 2 years, 5 months ago
BC is the answer. A is wrong, https://cloud.google.com/architecture/best-practices-for-building-containers#solution_1_run_as_pid_1_and_register_signal_handlers
upvoted 14 times
...
Raz0r
Most Recent 9 months, 2 weeks ago
Selected Answer: BC
Obviously B&C are part of containerization best practices.
upvoted 2 times
...
GCP72
1 year, 2 months ago
Selected Answer: BC
The answer is BC
upvoted 2 times
...
SuperDevops
1 year, 12 months ago
it is AE
upvoted 2 times
...
Jane111
2 years, 6 months ago
It should be A,B
upvoted 1 times
...
WakandaF
2 years, 6 months ago
So, its B C?
upvoted 1 times
...
bluetaurianbull
2 years, 7 months ago
To add to my previous comment "A process running as PID 1 inside a container is treated specially by Linux: it ignores any signal with the default action. So, the process will not terminate on SIGINT or SIGTERM unless it is coded to do so." Looks like this could be an issue when talking about security, a malicious coder can write a piece of code to eat all resources on the host with this one bad PID#1 What do you think guys??
upvoted 1 times
lollo1234
2 years, 6 months ago
You don't usually want your container to get killed instantly - you want to see the SIGINT or SIGTERM command and respond. For example, in a webserver you may stop accepting connections, and respond to the remaining open ones, before calling exit()
upvoted 3 times
...
...
bluetaurianbull
2 years, 7 months ago
To add to my previous comment "A process running as PID 1 inside a container is treated specially by Linux: it ignores any signal with the default action. So, the process will not terminate on SIGINT or SIGTERM unless it is coded to do so."
upvoted 1 times
...
bluetaurianbull
2 years, 7 months ago
Really??? Wat about (A) When the process with pid 1 die for any reason, all other processes are killed with KILL signal. Shouldnt A be one of the biggest risk when we talk about container security???
upvoted 2 times
badrik
1 year, 5 months ago
I don't think this is a valid action to do to improve security perhaps it helps more to improve operational excellence. Imagine you are running production application in a container and it is signalled by container run time to terminate. In this case you don't have the running container to understand what would be issue ( though you can look at the events in modern container orchestration platform but imagine you are running a simple container ). Coming back to your concern. you don't generally run some rubbish container images in your container platform and this build process is very deliberate one.
upvoted 1 times
...
...
kubosuke
2 years, 7 months ago
bc of bc
upvoted 1 times
...
saurabh1805
3 years ago
vote for B and C
upvoted 1 times
...
MohitA
3 years, 2 months ago
BC for sure
upvoted 1 times
...
ArizonaClassics
3 years, 3 months ago
BC on point!
upvoted 2 times
...
KILLMAD
3 years, 7 months ago
I agree BC
upvoted 4 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago