Examkin

Question

Difficulty: HardVulnerability Scanning and Assessment

An enterprise security team deployed agent-based vulnerability scanners across a hybrid environment comprising bare-metal host servers, containerized application workloads on managed Kubernetes nodes, and high-transaction database instances. During the initial operational assessment, the security team identifies two critical issues:
1. The installed host agents successfully inventory host OS packages but fail to detect software vulnerabilities existing inside running container filesystem layers.
2. Standard network-based vulnerability scans triggered against the database servers caused severe query latency and session timeouts.

Which of the following architectural modifications or scanning strategies should the security team implement to resolve both operational issues? (Select TWO.)

  1. Integrate container image registry and CI/CD pipeline scanning to analyze container layers prior to deployment.Answer
  2. B
    Reclassify the container runtime package vulnerabilities as Cross-Site Scripting (XSS) flaws within the SIEM correlation rules.
  3. Configure credentialed, low-impact scanning profiles or schedule non-intrusive scans during designated maintenance windows for database targets.Answer
  4. D
    Execute intrusive exploit payloads against database service ports to automatically verify vulnerability exploitability.

Answer

The security team should integrate container image registry and CI/CD pipeline scanning to analyze container layers prior to deployment, and configure credentialed, low-impact scanning profiles or schedule non-intrusive scans during designated maintenance windows for database targets.
Container base images and application layers are isolated from host OS package managers, requiring registry and CI/CD pipeline scanner integration to identify container vulnerabilities. Furthermore, active network scanning of high-transaction database systems can cause resource starvation and crashes; adjusting scan policy profiles to non-intrusive credentialed scans or scheduling scans during low-traffic maintenance windows mitigates operational impact.

Step-by-Step Solution

1
Analyze container visibility limitation
Host-level vulnerability agents view the host operating system user space and kernel but do not inspect internal container image layers or containerized package managers.
Container security requires static analysis of base images during the build/registry phase (CI/CD pipeline scanning) or specialized container-aware agents.
2
Address database latency and session timeout issues caused by active scanning
Active uncredentialed network probing sends high volumes of packets and test vectors that overload database socket connections and CPU threads.
Sensitive target systems like production databases require non-intrusive credentialed scans, performance throttling, or execution during designated maintenance windows to maintain availability.
3
Evaluate alternative options
Reclassifying vulnerability types in SIEM rules or launching intrusive exploit payloads either corrupts vulnerability metrics or causes severe service outages.
Proper vulnerability management relies on accurate categorization and non-disruptive discovery methods.

Key Concept

Vulnerability Assessment in Containerized Workloads and High-Availability Infrastructure
Rate this question

Topics

Vulnerability Scanning and Assessment

More questions from this topic