Examkin

Question

Difficulty: HardVulnerability Scanning and Assessment

A security engineer is designing a vulnerability assessment strategy for a newly deployed microservices application hosted on short-lived container instances behind a web application firewall (WAF). Recent uncredentialed network-based vulnerability scans reported zero high-severity findings; however, a manual audit revealed several unpatched software dependencies and OS configuration flaws within the running container base images. Which of the following scanning approaches should the engineer implement to accurately detect these internal vulnerabilities without incurring high network overhead or triggering false negatives due to WAF filtering?

  1. A
    Reconfigure the inline web application firewall to perform active intrusive vulnerability scanning on all incoming application layer traffic.
  2. Integrate container registry image scanning into the CI/CD deployment pipeline and deploy agent-based scanners within the base container templates.Answer
  3. C
    Apply perimeter router access control list rules to temporarily block external traffic during external uncredentialed penetration scanning windows.
  4. D
    Execute automated SQL injection and cross-site scripting attack payloads from an unauthenticated external network probe.

Answer

Integrating container registry image scanning into the CI/CD deployment pipeline and utilizing host/agent-based scanning within container base images accurately identifies internal software vulnerabilities without network overhead or WAF interference.
Integrating static image scanning into the CI/CD pipeline and deploying agent-based scanners directly inspects the container's internal file system, installed packages, and configuration files. This local assessment approach bypasses network firewalls, eliminates network latency, and reliably uncovers missing patches and misconfigurations regardless of container ephemeral lifespans.

Step-by-Step Solution

1
Analyze the technical environment and current failure state
Uncredentialed network scanning failed to identify internal flaws due to container short lifespans, network isolation, and WAF inspection.
Network-based vulnerability scanners inspect exposed open network ports and services but cannot evaluate local package manifests or file permissions behind protective inline firewalls.
2
Evaluate candidate scanning methodologies against operational constraints
Agent-based scanning and pipeline container image analysis operate locally on the target operating system image and build artifacts.
Host-based agents and static image scanners access internal package managers (e.g., dpkg, rpm) directly, generating zero network scan traffic and avoiding WAF blockage.
3
Select the optimal vulnerability scanning architecture
CI/CD registry scanning paired with agent-based evaluation provides complete visibility into containerized microservice vulnerabilities.
This strategy satisfies all requirements by detecting local vulnerabilities prior to and during deployment without network degradation.

Key Concept

Credentialed and Agent-Based vs. Network-Based Vulnerability Scanning in Container Environments
Rate this question

Topics

Vulnerability Scanning and Assessment

More questions from this topic