25. Which of the following hardening techniques must be applied on a container image before deploying it to a production environment?
Answer: A,C
Remove default applications and disable Telnet must be applied on a container image before deploying it to a production environment.
Both removing default applications and disabling Telnet are crucial hardening techniques that help minimize the attack surface of a container image, ensuring that only necessary applications are present and that insecure protocols are disabled.
A) Remove default applications.
This is a necessary hardening technique as default applications can introduce vulnerabilities that attackers might exploit. By removing unnecessary applications, the overall security posture of the container is enhanced, reducing potential entry points for threats.
B) Install a NIPS.
While installing a Network Intrusion Prevention System (NIPS) can enhance security, it is not a direct hardening technique applicable to a container image itself. NIPS protects network traffic rather than addressing the security of the container image prior to deployment.
C) Disable Telnet.
Disabling Telnet is an essential security practice since Telnet transmits data in plaintext, making it vulnerable to interception. By disabling this protocol, the security of the container is significantly improved, especially in a production environment where sensitive data might be transmitted.
D) Reconfigure the DNS.
Reconfiguring DNS is not a specific hardening technique for a container image. While DNS configurations can affect security, they do not directly relate to the hardening of the container itself prior to production deployment.
E) Add an SFTP server.
Adding an SFTP server is not a hardening technique for a container image. Instead, it introduces additional components that require further security considerations. Hardening focuses on minimizing vulnerabilities rather than adding more services.
F) Delete the public certificate.
Deleting a public certificate does not constitute a hardening technique for a container image. In fact, public certificates are often necessary for secure communications, and their deletion could lead to more vulnerabilities rather than addressing them.
Conclusion
The techniques of removing default applications and disabling Telnet are vital for hardening a container image, as they directly mitigate risks associated with unnecessary software and insecure protocols. Other options either do not apply directly to the hardening process of a container image or could inadvertently introduce new vulnerabilities, underscoring the importance of the correct choices.