Image security scanning in Kubernetes - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the command to scan a Docker image for vulnerabilities using Trivy.

Kubernetes

trivy [1] nginx:latest

Drag options to blanks, or click blank then click option'

Aimage

Bscan

Cpull

Drun

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'pull' instead of 'image' will only download the image.

Using 'run' tries to start a container, not scan it.

The trivy image command scans the specified image for vulnerabilities.

2fill in blank

medium

Complete the Kubernetes manifest snippet to add an image scanning annotation for the container.

Kubernetes

containers:
  - name: app
    image: myapp:latest
    metadata:
      annotations:
        [1]: "true"

Drag options to blanks, or click blank then click option'

Aimage.scan

Bscan.enabled

Csecurity.scan

Dimage.security.scan

Attempts:

3 left

💡 Hint

Common Mistakes

Using incomplete or incorrect annotation keys.

Missing the annotation entirely.

The annotation image.security.scan is commonly used to enable image scanning in Kubernetes manifests.

3fill in blank

hard

Fix the error in this Trivy command to scan an image and output results in JSON format.

Kubernetes

trivy image nginx:latest --format [1]

Drag options to blanks, or click blank then click option'

Atable

Bxml

Cjson

Dyaml

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'table' or 'yaml' instead of 'json' for JSON output.

Misspelling the format option.

The --format json option outputs the scan results in JSON format.

4fill in blank

hard

Fill both blanks to create a Kubernetes Pod spec that uses an init container to scan the main container's image before starting.

Kubernetes

apiVersion: v1
kind: Pod
metadata:
  name: scan-pod
spec:
  initContainers:
  - name: scanner
    image: [1]
  containers:
  - name: app
    image: [2]

Drag options to blanks, or click blank then click option'

Aaquasec/trivy:latest

Bnginx:latest

Cbusybox

Dalpine

Attempts:

3 left

💡 Hint

Common Mistakes

Using the wrong image for the scanner container.

Mixing up the images between init and main containers.

The init container uses the Trivy image aquasec/trivy:latest to scan the main app image nginx:latest.

5fill in blank

hard

Fill all three blanks to create a Kubernetes ConfigMap that stores a Trivy policy file with a rule to fail scans on high severity vulnerabilities.

Kubernetes

apiVersion: v1
kind: ConfigMap
metadata:
  name: trivy-policy
data:
  policy.rego: |
    package [1]

    deny[msg] {
      input.Vulnerabilities[_].Severity == [2]
      msg = "High severity vulnerability found"
    }

    severity_level = [3]

Drag options to blanks, or click blank then click option'

Atrivy.policy

B"HIGH"

C3

Dvulnerability.rules

Attempts:

3 left

💡 Hint

Common Mistakes

Using unquoted severity strings.

Wrong package names.

Incorrect severity level numbers.

The policy package is named trivy.policy. The severity is checked as the string "HIGH". The severity level is set to 3 to represent high severity.

Practice

1. What is the main purpose of image security scanning in Kubernetes?

easy

A. To find vulnerabilities in container images before deployment

B. To increase the size of container images

C. To speed up the container startup time

D. To monitor network traffic between containers

Solution

1. Step 1: Understand image security scanning

   Image security scanning checks container images for security issues like vulnerabilities.

2. Step 2: Identify the main goal

   The goal is to find and fix vulnerabilities before deploying containers to keep apps safe.

3. Final Answer:

   To find vulnerabilities in container images before deployment -> Option A

4. Quick Check:

   Image scanning = find vulnerabilities [OK]

Hint: Image scanning finds security holes before use [OK]

Common Mistakes:

• Confusing scanning with performance tuning
• Thinking it monitors network traffic
• Believing it changes image size

2. Which command correctly scans a Docker image named myapp:latest using Trivy?

easy

A. trivy myapp:latest scan

B. trivy scan myapp:latest

C. trivy image myapp:latest

D. trivy scan image myapp

Solution

1. Step 1: Recall Trivy scan syntax

   The correct command to scan an image is trivy image <image-name>.

2. Step 2: Match the command with options

   trivy image myapp:latest matches the correct syntax exactly.

3. Final Answer:

   trivy image myapp:latest -> Option C

4. Quick Check:

   Trivy scan command = trivy image [OK]

Hint: Use 'trivy image' to scan images [OK]

Common Mistakes:

• Using 'trivy scan' instead of 'trivy image'
• Placing 'scan' after image name
• Omitting the 'image' keyword

3. What will be the output of the command trivy image alpine:3.15 if the image has no vulnerabilities?

medium

A. No vulnerabilities detected, image is safe

B. Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

C. Error: image not found

D. Vulnerabilities found: 0

Solution

1. Step 1: Understand Trivy output for clean images

   When no vulnerabilities are found, Trivy outputs a table ending with Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0).

2. Step 2: Compare options with expected output

   Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) matches the typical Trivy message for no vulnerabilities.

3. Final Answer:

   Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) -> Option B

4. Quick Check:

   No vulnerabilities message = Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) [OK]

Hint: Look for 'Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)' in scan output [OK]

Common Mistakes:

• Expecting a numeric count output
• Confusing error messages with success
• Assuming 'no vulnerabilities' means error

4. You run trivy image myapp:latest but get an error: ERROR: unable to find image. What is the likely cause?

medium

A. The image name is misspelled or does not exist locally

B. Trivy is not installed correctly

C. The Kubernetes cluster is down

D. The Docker daemon is running

Solution

1. Step 1: Analyze the error message

   The error 'unable to find image' means Trivy cannot locate the specified image locally or remotely.

2. Step 2: Identify common causes

   Most often, this happens if the image name is wrong or the image is not pulled yet.

3. Final Answer:

   The image name is misspelled or does not exist locally -> Option A

4. Quick Check:

   Image not found error = wrong image name [OK]

Hint: Check image name spelling and availability [OK]

Common Mistakes:

• Blaming Kubernetes cluster status
• Assuming Trivy installation issue
• Ignoring image presence locally

5. You want to automate image scanning in your Kubernetes CI/CD pipeline using Trivy. Which approach is best to ensure images are scanned before deployment?

hard

A. Only scan images once a month regardless of deployment

B. Scan images manually after deployment to production

C. Ignore scanning if images come from trusted sources

D. Add a pipeline step that runs trivy image <image> and fails if vulnerabilities are found

Solution

1. Step 1: Understand CI/CD pipeline best practices

   Automated scanning before deployment helps catch vulnerabilities early and prevents unsafe images from running.

2. Step 2: Evaluate options for automation

   Add a pipeline step that runs trivy image <image> and fails if vulnerabilities are found. This integrates scanning into the pipeline and blocks deployment if issues exist, which is best practice.

3. Final Answer:

   Add a pipeline step that runs trivy image <image> and fails if vulnerabilities are found -> Option D

4. Quick Check:

   Automate scanning pre-deployment = Add a pipeline step that runs trivy image <image> and fails if vulnerabilities are found [OK]

Hint: Scan images in pipeline and fail on vulnerabilities [OK]

Common Mistakes:

• Scanning only after deployment
• Ignoring scans for trusted images
• Scanning too infrequently