Image security scanning in Kubernetes - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Output of Trivy scan on a vulnerable image

You run the command trivy image alpine:3.12 to scan the Alpine Linux image for vulnerabilities. What is the expected output type?

Kubernetes

trivy image alpine:3.12

A A syntax error indicating invalid command usage

B A list of detected vulnerabilities with severity levels and CVE IDs

C An empty output with no vulnerabilities found

D A runtime error due to missing Docker daemon

💡 Hint

Trivy scans images and reports vulnerabilities found inside them.

Trivy outputs a detailed list of vulnerabilities found in the image, including severity and CVE identifiers.

🧠 Conceptual

intermediate

Purpose of image security scanning in Kubernetes

What is the main purpose of performing image security scanning before deploying containers in Kubernetes?

A To detect and report known security vulnerabilities in container images

B To monitor container resource usage during runtime

C To automatically update images to the latest version

D To speed up container startup time by preloading images

💡 Hint

Think about why security scanning is important before running containers.

Image security scanning helps identify known vulnerabilities in container images to prevent deploying insecure containers.

🔀 Workflow

advanced

Correct order of steps for integrating image scanning in CI/CD

Arrange the following steps in the correct order to integrate image security scanning into a Kubernetes CI/CD pipeline.

A 1,3,2,4

B 2,1,3,4

C 1,2,3,4

D 3,1,2,4

💡 Hint

Think about when scanning should happen relative to building and pushing images.

You first build the image, then scan it for vulnerabilities before pushing it to the registry and deploying it.

❓ Troubleshoot

advanced

Troubleshooting failed image scan due to missing permissions

A Trivy scan fails with the error: failed to initialize image source: unauthorized: authentication required. What is the most likely cause?

A The Docker registry requires authentication and credentials are missing or incorrect

B The image does not exist in the registry

C Trivy is not installed on the system

D The Kubernetes cluster is not reachable

💡 Hint

Consider what 'authentication required' means when accessing images.

This error means Trivy cannot access the image because it lacks proper credentials for the private registry.

✅ Best Practice

expert

Best practice for automating image security scanning in Kubernetes environments

Which approach is considered best practice for automating image security scanning in Kubernetes environments?

A Manually scan images on developer machines before pushing

B Scan images only after deployment to detect runtime vulnerabilities

C Ignore scanning and rely on Kubernetes network policies for security

D Integrate scanning into the CI pipeline to block builds with critical vulnerabilities

💡 Hint

Think about how automation and early detection improve security.

Automating scanning in the CI pipeline helps catch vulnerabilities early and prevents insecure images from being deployed.