Image security scanning in Kubernetes - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Output of Trivy scan on a vulnerable image

You run the command trivy image alpine:3.12 to scan the Alpine Linux image for vulnerabilities. What is the expected output type?

Kubernetes

trivy image alpine:3.12

A A syntax error indicating invalid command usage

B A list of detected vulnerabilities with severity levels and CVE IDs

C An empty output with no vulnerabilities found

D A runtime error due to missing Docker daemon

💡 Hint

Trivy scans images and reports vulnerabilities found inside them.

Trivy outputs a detailed list of vulnerabilities found in the image, including severity and CVE identifiers.

🧠 Conceptual

intermediate

Purpose of image security scanning in Kubernetes

What is the main purpose of performing image security scanning before deploying containers in Kubernetes?

A To detect and report known security vulnerabilities in container images

B To monitor container resource usage during runtime

C To automatically update images to the latest version

D To speed up container startup time by preloading images

💡 Hint

Think about why security scanning is important before running containers.

Image security scanning helps identify known vulnerabilities in container images to prevent deploying insecure containers.

🔀 Workflow

advanced

Correct order of steps for integrating image scanning in CI/CD

Arrange the following steps in the correct order to integrate image security scanning into a Kubernetes CI/CD pipeline.

A 1,3,2,4

B 2,1,3,4

C 1,2,3,4

D 3,1,2,4

💡 Hint

Think about when scanning should happen relative to building and pushing images.

You first build the image, then scan it for vulnerabilities before pushing it to the registry and deploying it.

❓ Troubleshoot

advanced

Troubleshooting failed image scan due to missing permissions

A Trivy scan fails with the error: failed to initialize image source: unauthorized: authentication required. What is the most likely cause?

A The Docker registry requires authentication and credentials are missing or incorrect

B The image does not exist in the registry

C Trivy is not installed on the system

D The Kubernetes cluster is not reachable

💡 Hint

Consider what 'authentication required' means when accessing images.

This error means Trivy cannot access the image because it lacks proper credentials for the private registry.

✅ Best Practice

expert

Best practice for automating image security scanning in Kubernetes environments

Which approach is considered best practice for automating image security scanning in Kubernetes environments?

A Manually scan images on developer machines before pushing

B Scan images only after deployment to detect runtime vulnerabilities

C Ignore scanning and rely on Kubernetes network policies for security

D Integrate scanning into the CI pipeline to block builds with critical vulnerabilities

💡 Hint

Think about how automation and early detection improve security.

Automating scanning in the CI pipeline helps catch vulnerabilities early and prevents insecure images from being deployed.

Practice

1. What is the main purpose of image security scanning in Kubernetes?

easy

A. To find vulnerabilities in container images before deployment

B. To increase the size of container images

C. To speed up the container startup time

D. To monitor network traffic between containers

Solution

1. Step 1: Understand image security scanning

   Image security scanning checks container images for security issues like vulnerabilities.

2. Step 2: Identify the main goal

   The goal is to find and fix vulnerabilities before deploying containers to keep apps safe.

3. Final Answer:

   To find vulnerabilities in container images before deployment -> Option A

4. Quick Check:

   Image scanning = find vulnerabilities [OK]

Hint: Image scanning finds security holes before use [OK]

Common Mistakes:

• Confusing scanning with performance tuning
• Thinking it monitors network traffic
• Believing it changes image size

2. Which command correctly scans a Docker image named myapp:latest using Trivy?

easy

A. trivy myapp:latest scan

B. trivy scan myapp:latest

C. trivy image myapp:latest

D. trivy scan image myapp

Solution

1. Step 1: Recall Trivy scan syntax

   The correct command to scan an image is trivy image <image-name>.

2. Step 2: Match the command with options

   trivy image myapp:latest matches the correct syntax exactly.

3. Final Answer:

   trivy image myapp:latest -> Option C

4. Quick Check:

   Trivy scan command = trivy image [OK]

Hint: Use 'trivy image' to scan images [OK]

Common Mistakes:

• Using 'trivy scan' instead of 'trivy image'
• Placing 'scan' after image name
• Omitting the 'image' keyword

3. What will be the output of the command trivy image alpine:3.15 if the image has no vulnerabilities?

medium

A. No vulnerabilities detected, image is safe

B. Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

C. Error: image not found

D. Vulnerabilities found: 0

Solution

1. Step 1: Understand Trivy output for clean images

   When no vulnerabilities are found, Trivy outputs a table ending with Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0).

2. Step 2: Compare options with expected output

   Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) matches the typical Trivy message for no vulnerabilities.

3. Final Answer:

   Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) -> Option B

4. Quick Check:

   No vulnerabilities message = Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) [OK]

Hint: Look for 'Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)' in scan output [OK]

Common Mistakes:

• Expecting a numeric count output
• Confusing error messages with success
• Assuming 'no vulnerabilities' means error

4. You run trivy image myapp:latest but get an error: ERROR: unable to find image. What is the likely cause?

medium

A. The image name is misspelled or does not exist locally

B. Trivy is not installed correctly

C. The Kubernetes cluster is down

D. The Docker daemon is running

Solution

1. Step 1: Analyze the error message

   The error 'unable to find image' means Trivy cannot locate the specified image locally or remotely.

2. Step 2: Identify common causes

   Most often, this happens if the image name is wrong or the image is not pulled yet.

3. Final Answer:

   The image name is misspelled or does not exist locally -> Option A

4. Quick Check:

   Image not found error = wrong image name [OK]

Hint: Check image name spelling and availability [OK]

Common Mistakes:

• Blaming Kubernetes cluster status
• Assuming Trivy installation issue
• Ignoring image presence locally

5. You want to automate image scanning in your Kubernetes CI/CD pipeline using Trivy. Which approach is best to ensure images are scanned before deployment?

hard

A. Only scan images once a month regardless of deployment

B. Scan images manually after deployment to production

C. Ignore scanning if images come from trusted sources

D. Add a pipeline step that runs trivy image <image> and fails if vulnerabilities are found

Solution

1. Step 1: Understand CI/CD pipeline best practices

   Automated scanning before deployment helps catch vulnerabilities early and prevents unsafe images from running.

2. Step 2: Evaluate options for automation

   Add a pipeline step that runs trivy image <image> and fails if vulnerabilities are found. This integrates scanning into the pipeline and blocks deployment if issues exist, which is best practice.

3. Final Answer:

   Add a pipeline step that runs trivy image <image> and fails if vulnerabilities are found -> Option D

4. Quick Check:

   Automate scanning pre-deployment = Add a pipeline step that runs trivy image <image> and fails if vulnerabilities are found [OK]

Hint: Scan images in pipeline and fail on vulnerabilities [OK]

Common Mistakes:

• Scanning only after deployment
• Ignoring scans for trusted images
• Scanning too infrequently