Image security scanning in Kubernetes - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the command to scan a Docker image for vulnerabilities using Trivy.

Kubernetes

trivy [1] nginx:latest

Drag options to blanks, or click blank then click option'

Aimage

Bscan

Cpull

Drun

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'pull' instead of 'image' will only download the image.

Using 'run' tries to start a container, not scan it.

The trivy image command scans the specified image for vulnerabilities.

2fill in blank

medium

Complete the Kubernetes manifest snippet to add an image scanning annotation for the container.

Kubernetes

containers:
  - name: app
    image: myapp:latest
    metadata:
      annotations:
        [1]: "true"

Drag options to blanks, or click blank then click option'

Aimage.scan

Bscan.enabled

Csecurity.scan

Dimage.security.scan

Attempts:

3 left

💡 Hint

Common Mistakes

Using incomplete or incorrect annotation keys.

Missing the annotation entirely.

The annotation image.security.scan is commonly used to enable image scanning in Kubernetes manifests.

3fill in blank

hard

Fix the error in this Trivy command to scan an image and output results in JSON format.

Kubernetes

trivy image nginx:latest --format [1]

Drag options to blanks, or click blank then click option'

Atable

Bxml

Cjson

Dyaml

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'table' or 'yaml' instead of 'json' for JSON output.

Misspelling the format option.

The --format json option outputs the scan results in JSON format.

4fill in blank

hard

Fill both blanks to create a Kubernetes Pod spec that uses an init container to scan the main container's image before starting.

Kubernetes

apiVersion: v1
kind: Pod
metadata:
  name: scan-pod
spec:
  initContainers:
  - name: scanner
    image: [1]
  containers:
  - name: app
    image: [2]

Drag options to blanks, or click blank then click option'

Aaquasec/trivy:latest

Bnginx:latest

Cbusybox

Dalpine

Attempts:

3 left

💡 Hint

Common Mistakes

Using the wrong image for the scanner container.

Mixing up the images between init and main containers.

The init container uses the Trivy image aquasec/trivy:latest to scan the main app image nginx:latest.

5fill in blank

hard

Fill all three blanks to create a Kubernetes ConfigMap that stores a Trivy policy file with a rule to fail scans on high severity vulnerabilities.

Kubernetes

apiVersion: v1
kind: ConfigMap
metadata:
  name: trivy-policy
data:
  policy.rego: |
    package [1]

    deny[msg] {
      input.Vulnerabilities[_].Severity == [2]
      msg = "High severity vulnerability found"
    }

    severity_level = [3]

Drag options to blanks, or click blank then click option'

Atrivy.policy

B"HIGH"

C3

Dvulnerability.rules

Attempts:

3 left

💡 Hint

Common Mistakes

Using unquoted severity strings.

Wrong package names.

Incorrect severity level numbers.

The policy package is named trivy.policy. The severity is checked as the string "HIGH". The severity level is set to 3 to represent high severity.