Security benchmarks (CIS Docker) - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Check Docker daemon configuration for CIS compliance

You run the command docker info --format '{{json .SecurityOptions}}' on a Docker host. What is the expected output if the host is compliant with CIS benchmark regarding security options?

Docker

docker info --format '{{json .SecurityOptions}}'

A ["name=seccomp", "name=selinux", "name=apparmor"]

B ["name=seccomp", "name=apparmor"]

C ["name=selinux"]

D null

💡 Hint

CIS recommends enabling multiple security options including seccomp, apparmor, and selinux where applicable.

The CIS Docker benchmark requires that Docker daemon runs with security options like seccomp, apparmor, and selinux enabled to reduce attack surface.

🧠 Conceptual

intermediate

Understanding CIS Docker benchmark for container user privileges

According to CIS Docker benchmarks, which practice is recommended to reduce risk related to container user privileges?

A Allow containers to run with any user ID

B Run containers as root user to avoid permission issues

C Run containers with a non-root user inside the container

D Disable user namespaces for better compatibility

💡 Hint

Running containers as root inside the container increases security risks.

CIS Docker benchmarks recommend running containers as a non-root user to limit potential damage if the container is compromised.

❓ Troubleshoot

advanced

Troubleshoot Docker daemon logging configuration for CIS compliance

You configured Docker daemon with --log-driver=json-file and --log-opt max-size=10m. After restarting Docker, logs are not rotating as expected. What is the most likely cause?

A The <code>max-size</code> option must be set in bytes, not megabytes

B The <code>json-file</code> log driver does not support log rotation

C Docker daemon must be restarted twice for logging options to apply

D Docker daemon requires <code>--log-opt max-file</code> to specify number of rotated files

💡 Hint

Log rotation requires both size limit and number of files to keep.

CIS Docker benchmark requires log rotation to prevent disk exhaustion. Setting only max-size without max-file means no rotation occurs.

🔀 Workflow

advanced

Implementing CIS Docker benchmark for image vulnerability scanning

Which sequence of steps correctly implements a workflow to scan Docker images for vulnerabilities as recommended by CIS Docker benchmarks?

A 2,1,3,4

B 1,2,3,4

C 1,3,2,4

D 3,1,2,4

💡 Hint

Start with pulling the image, then scan, fix, and finally push.

The correct workflow is to pull the image, scan it, fix vulnerabilities, then push the updated image.

✅ Best Practice

expert

Identify the best CIS Docker benchmark practice for container network security

Which of the following is the best CIS Docker benchmark practice to secure container networking?

A Create and use user-defined bridge networks with restricted access

B Disable Docker's user-defined networks to reduce complexity

C Use the default bridge network for all containers to simplify management

D Allow containers to communicate freely on the host network

💡 Hint

User-defined networks allow better control over container communication.

CIS recommends using user-defined bridge networks to isolate containers and control traffic, improving security.