Container Security Scanning
Master the IT-English vocabulary of container security scanning: vulnerabilities, CVEs, base image patching and scan gates.
0 / 37 completed
1 / 37
A scan reports a 'CVE' in the image. What is a CVE?
A CVE (Common Vulnerabilities and Exposures) entry is a publicly identified, catalogued vulnerability.
2 / 37
The scanner flags a 'critical severity' finding. What should typically happen?
Critical findings demand prompt remediation before the image is promoted to production.
3 / 37
Most image vulnerabilities are fixed by what action?
Patching means rebuilding on an updated base image and dependency versions that resolve the CVEs.
4 / 37
A pipeline has a 'scan gate'. What does it do?
A scan gate fails the pipeline when findings exceed a policy threshold, preventing risky images from shipping.
5 / 37
Which sentence correctly uses 'attack surface'?
Attack surface is the set of components an attacker could exploit; fewer packages means less surface.
6 / 37
Sarah: "Hey team, I've run a container security scan on the new API deployment. The scanner is reporting a high severity vulnerability related to outdated OpenSSL libraries in the base image. Should we immediately roll back to the previous version?"While immediate rollback might seem like the safest approach, this scenario highlights the need for careful consideration. Simply rolling back without understanding the vulnerability's impact or potential exploitability could disrupt service and isn't always the most efficient solution. A more appropriate response would acknowledge the severity and initiate a deeper investigation to determine if a patch is available or if mitigation steps can be implemented before reverting.
7 / 37
PR Description:
"Running a container security scan on the 'Phoenix' service revealed a vulnerability. The scanner recommends updating the Alpine Linux base image to version 3.18.0. We should investigate this further and determine if it impacts our existing deployments."The key here is understanding the purpose of a container security scan. The scanner identifies potential vulnerabilities, but it doesn't automatically fix them. A thorough assessment – which includes testing – is required to determine if the update actually resolves the issue and doesn't introduce new problems (regression). Option A is incorrect as updates are rarely automatic; options B and D are overly reactive and don't reflect standard dev workflow.
8 / 37
Mark says: 'The scanner is reporting a vulnerability due to misconfigured permissions on the container's volume mounts. The scan recommends implementing Role-Based Access Control (RBAC) at the host level. Should I immediately block all access to that volume until we've addressed this?'. Context: During a code review, Mark is discussing findings from a recent container security scan.
Which of the following best describes Mark's suggestion?The correct answer highlights Mark's emphasis on immediate risk mitigation. While RBAC at the host level is a good long-term strategy for securing containers and reducing the attack surface, in this scenario—where the scan identifies misconfigured volume mounts as a vulnerability—immediately blocking access to the volume is a prudent step to prevent potential data breaches or unauthorized modifications until a proper fix can be implemented. Options B and C are too aggressive; simply blocking access isn't always the fastest solution, and focusing solely on container-level permissions might miss broader host-level security issues. Option D directly contradicts the scan's findings.
9 / 37
Sarah: "Hey team, I've run a container security scan on the new API deployment. The scanner is reporting a high severity vulnerability related to outdated OpenSSL libraries in the base image. Should we immediately roll back to the previous version?"While immediate rollback might seem like the safest approach, this scenario highlights the need for careful consideration. Simply rolling back without understanding the vulnerability's impact or potential exploitability could disrupt service and isn't always the most efficient solution. A more appropriate response would acknowledge the severity and initiate a deeper investigation to determine if a patch is available or if mitigation steps can be implemented before reverting.
10 / 37
PR Description:
"Running a container security scan on the 'Phoenix' service revealed a vulnerability. The scanner recommends updating the Alpine Linux base image to version 3.18.0. We should investigate this further and determine if it impacts our existing deployments."The key here is understanding the purpose of a container security scan. The scanner identifies potential vulnerabilities, but it doesn't automatically fix them. A thorough assessment – which includes testing – is required to determine if the update actually resolves the issue and doesn't introduce new problems (regression). Option A is incorrect as updates are rarely automatic; options B and D are overly reactive and don't reflect standard dev workflow.
11 / 37
Mark says: 'The scanner is reporting a vulnerability due to misconfigured permissions on the container's volume mounts. The scan recommends implementing Role-Based Access Control (RBAC) at the host level. Should I immediately block all access to that volume until we've addressed this?'. Context: During a code review, Mark is discussing findings from a recent container security scan.
Which of the following best describes Mark's suggestion?The correct answer highlights Mark's emphasis on immediate risk mitigation. While RBAC at the host level is a good long-term strategy for securing containers and reducing the attack surface, in this scenario—where the scan identifies misconfigured volume mounts as a vulnerability—immediately blocking access to the volume is a prudent step to prevent potential data breaches or unauthorized modifications until a proper fix can be implemented. Options B and C are too aggressive; simply blocking access isn't always the fastest solution, and focusing solely on container-level permissions might miss broader host-level security issues. Option D directly contradicts the scan's findings.
12 / 37
Sarah: "Hey team, I've run a container security scan on the new API deployment. The scanner is reporting a high severity vulnerability related to outdated OpenSSL libraries in the base image. Should we immediately roll back to the previous version?"While immediate rollback might seem like the safest approach, this scenario highlights the need for careful consideration. Simply rolling back without understanding the vulnerability's impact or potential exploitability could disrupt service and isn't always the most efficient solution. A more appropriate response would acknowledge the severity and initiate a deeper investigation to determine if a patch is available or if mitigation steps can be implemented before reverting.
13 / 37
PR Description:
"Running a container security scan on the 'Phoenix' service revealed a vulnerability. The scanner recommends updating the Alpine Linux base image to version 3.18.0. We should investigate this further and determine if it impacts our existing deployments."The key here is understanding the purpose of a container security scan. The scanner identifies potential vulnerabilities, but it doesn't automatically fix them. A thorough assessment – which includes testing – is required to determine if the update actually resolves the issue and doesn't introduce new problems (regression). Option A is incorrect as updates are rarely automatic; options B and D are overly reactive and don't reflect standard dev workflow.
14 / 37
Mark says: 'The scanner is reporting a vulnerability due to misconfigured permissions on the container's volume mounts. The scan recommends implementing Role-Based Access Control (RBAC) at the host level. Should I immediately block all access to that volume until we've addressed this?'. Context: During a code review, Mark is discussing findings from a recent container security scan.
Which of the following best describes Mark's suggestion?The correct answer highlights Mark's emphasis on immediate risk mitigation. While RBAC at the host level is a good long-term strategy for securing containers and reducing the attack surface, in this scenario—where the scan identifies misconfigured volume mounts as a vulnerability—immediately blocking access to the volume is a prudent step to prevent potential data breaches or unauthorized modifications until a proper fix can be implemented. Options B and C are too aggressive; simply blocking access isn't always the fastest solution, and focusing solely on container-level permissions might miss broader host-level security issues. Option D directly contradicts the scan's findings.
15 / 37
Sarah: "Hey team, I've run a container security scan on the new API deployment. The scanner is reporting a high severity vulnerability related to outdated OpenSSL libraries in the base image. Should we immediately roll back to the previous version?"While immediate rollback might seem like the safest approach, this scenario highlights the need for careful consideration. Simply rolling back without understanding the vulnerability's impact or potential exploitability could disrupt service and isn't always the most efficient solution. A more appropriate response would acknowledge the severity and initiate a deeper investigation to determine if a patch is available or if mitigation steps can be implemented before reverting.
16 / 37
PR Description:
"Running a container security scan on the 'Phoenix' service revealed a vulnerability. The scanner recommends updating the Alpine Linux base image to version 3.18.0. We should investigate this further and determine if it impacts our existing deployments."The key here is understanding the purpose of a container security scan. The scanner identifies potential vulnerabilities, but it doesn't automatically fix them. A thorough assessment – which includes testing – is required to determine if the update actually resolves the issue and doesn't introduce new problems (regression). Option A is incorrect as updates are rarely automatic; options B and D are overly reactive and don't reflect standard dev workflow.
17 / 37
Mark says: 'The scanner is reporting a vulnerability due to misconfigured permissions on the container's volume mounts. The scan recommends implementing Role-Based Access Control (RBAC) at the host level. Should I immediately block all access to that volume until we've addressed this?'. Context: During a code review, Mark is discussing findings from a recent container security scan.
Which of the following best describes Mark's suggestion?The correct answer highlights Mark's emphasis on immediate risk mitigation. While RBAC at the host level is a good long-term strategy for securing containers and reducing the attack surface, in this scenario—where the scan identifies misconfigured volume mounts as a vulnerability—immediately blocking access to the volume is a prudent step to prevent potential data breaches or unauthorized modifications until a proper fix can be implemented. Options B and C are too aggressive; simply blocking access isn't always the fastest solution, and focusing solely on container-level permissions might miss broader host-level security issues. Option D directly contradicts the scan's findings.
18 / 37
Reviewer: "This PR includes a new container image. The security scan flagged a potential issue with the exposed port 8080. It suggests using a firewall to restrict access. Does this align with our standard security practices for API deployments?"
The question tests understanding of standard container security practices. Restricting exposed ports and using firewalls is a crucial defense against unauthorized access. Ignoring the scan's recommendation would be a significant risk. The partially correct option highlights that while firewalls are necessary, they're not a complete solution.
19 / 37
"DevOps: Hey team, the container security scan for the 'Hydra' service returned a high severity alert concerning an unpatched kernel vulnerability. The scanner recommends immediately halting deployments until mitigation is confirmed. What's the best approach?"
This scenario assesses understanding of risk mitigation in container deployments. A high-severity vulnerability warrants immediate action to prevent potential exploitation. Halting deployments allows for investigation and prevents further exposure while a more thorough analysis can be performed. The other options represent less proactive or appropriate responses.
20 / 37
"PR Description:
"Running container security scans on the 'Chimera' service identified a weakness: the base image used contains an outdated version of `libcurl`. The scanner recommends updating to the latest stable release. What's the most appropriate next step?"
This tests understanding of proactive security measures. Updating vulnerable libraries is a standard practice to address known vulnerabilities. While compatibility concerns should be considered, prioritizing patching outdated components is crucial for container security. Ignoring the recommendation or deferring the update would increase risk.
21 / 37
"John: 'I've been running container security scans on our new microservice deployments. The scanner is repeatedly flagging issues with overly permissive file system permissions within the containers. It suggests implementing least privilege principles. How should I proceed?'"
This question evaluates understanding of 'least privilege' – a core principle in container security. While testing for functionality is important, addressing overly permissive permissions directly aligns with this principle and reduces potential attack surface. A phased approach is often preferable to avoid disrupting service.
22 / 37
{
"scan_result": {
"vulnerability": "CVE-2023-1234",
"severity": "critical",
"description": "Unpatched vulnerability in the base image's SSH server.",
"recommendation": "Immediately disable SSH access to the container."
}
}This item assesses understanding of interpreting security scan results. The API response clearly identifies a critical vulnerability and recommends immediate action—disabling SSH access. A critical severity level demands prompt attention; ignoring the API or dismissing it as 'automated' is incorrect.
23 / 37
Reviewer: "This PR includes a new container image. The security scan flagged a potential issue with the exposed port 8080. It suggests using a firewall to restrict access. Does this align with our standard security practices for API deployments?"
The question tests understanding of standard container security practices. Restricting exposed ports and using firewalls is a crucial defense against unauthorized access. Ignoring the scan's recommendation would be a significant risk. The partially correct option highlights that while firewalls are necessary, they're not a complete solution.
24 / 37
"DevOps: Hey team, the container security scan for the 'Hydra' service returned a high severity alert concerning an unpatched kernel vulnerability. The scanner recommends immediately halting deployments until mitigation is confirmed. What's the best approach?"
This scenario assesses understanding of risk mitigation in container deployments. A high-severity vulnerability warrants immediate action to prevent potential exploitation. Halting deployments allows for investigation and prevents further exposure while a more thorough analysis can be performed. The other options represent less proactive or appropriate responses.
25 / 37
"PR Description:
"Running container security scans on the 'Chimera' service identified a weakness: the base image used contains an outdated version of `libcurl`. The scanner recommends updating to the latest stable release. What's the most appropriate next step?"
This tests understanding of proactive security measures. Updating vulnerable libraries is a standard practice to address known vulnerabilities. While compatibility concerns should be considered, prioritizing patching outdated components is crucial for container security. Ignoring the recommendation or deferring the update would increase risk.
26 / 37
"John: 'I've been running container security scans on our new microservice deployments. The scanner is repeatedly flagging issues with overly permissive file system permissions within the containers. It suggests implementing least privilege principles. How should I proceed?'"
This question evaluates understanding of 'least privilege' – a core principle in container security. While testing for functionality is important, addressing overly permissive permissions directly aligns with this principle and reduces potential attack surface. A phased approach is often preferable to avoid disrupting service.
27 / 37
{
"scan_result": {
"vulnerability": "CVE-2023-1234",
"severity": "critical",
"description": "Unpatched vulnerability in the base image's SSH server.",
"recommendation": "Immediately disable SSH access to the container."
}
}This item assesses understanding of interpreting security scan results. The API response clearly identifies a critical vulnerability and recommends immediate action—disabling SSH access. A critical severity level demands prompt attention; ignoring the API or dismissing it as 'automated' is incorrect.
28 / 37
Reviewer: "This PR includes a new container image. The security scan flagged a potential issue with the exposed port 8080. It suggests using a firewall to restrict access. Does this align with our standard security practices for API deployments?"
The question tests understanding of standard container security practices. Restricting exposed ports and using firewalls is a crucial defense against unauthorized access. Ignoring the scan's recommendation would be a significant risk. The partially correct option highlights that while firewalls are necessary, they're not a complete solution.
29 / 37
"DevOps: Hey team, the container security scan for the 'Hydra' service returned a high severity alert concerning an unpatched kernel vulnerability. The scanner recommends immediately halting deployments until mitigation is confirmed. What's the best approach?"
This scenario assesses understanding of risk mitigation in container deployments. A high-severity vulnerability warrants immediate action to prevent potential exploitation. Halting deployments allows for investigation and prevents further exposure while a more thorough analysis can be performed. The other options represent less proactive or appropriate responses.
30 / 37
"PR Description:
"Running container security scans on the 'Chimera' service identified a weakness: the base image used contains an outdated version of `libcurl`. The scanner recommends updating to the latest stable release. What's the most appropriate next step?"
This tests understanding of proactive security measures. Updating vulnerable libraries is a standard practice to address known vulnerabilities. While compatibility concerns should be considered, prioritizing patching outdated components is crucial for container security. Ignoring the recommendation or deferring the update would increase risk.
31 / 37
"John: 'I've been running container security scans on our new microservice deployments. The scanner is repeatedly flagging issues with overly permissive file system permissions within the containers. It suggests implementing least privilege principles. How should I proceed?'"
This question evaluates understanding of 'least privilege' – a core principle in container security. While testing for functionality is important, addressing overly permissive permissions directly aligns with this principle and reduces potential attack surface. A phased approach is often preferable to avoid disrupting service.
32 / 37
{
"scan_result": {
"vulnerability": "CVE-2023-1234",
"severity": "critical",
"description": "Unpatched vulnerability in the base image's SSH server.",
"recommendation": "Immediately disable SSH access to the container."
}
}This item assesses understanding of interpreting security scan results. The API response clearly identifies a critical vulnerability and recommends immediate action—disabling SSH access. A critical severity level demands prompt attention; ignoring the API or dismissing it as 'automated' is incorrect.
33 / 37
Reviewer: "This PR includes a new container image. The security scan flagged a potential issue with the exposed port 8080. It suggests using a firewall to restrict access. Does this align with our standard security practices for API deployments?"
The question tests understanding of standard container security practices. Restricting exposed ports and using firewalls is a crucial defense against unauthorized access. Ignoring the scan's recommendation would be a significant risk. The partially correct option highlights that while firewalls are necessary, they're not a complete solution.
34 / 37
"DevOps: Hey team, the container security scan for the 'Hydra' service returned a high severity alert concerning an unpatched kernel vulnerability. The scanner recommends immediately halting deployments until mitigation is confirmed. What's the best approach?"
This scenario assesses understanding of risk mitigation in container deployments. A high-severity vulnerability warrants immediate action to prevent potential exploitation. Halting deployments allows for investigation and prevents further exposure while a more thorough analysis can be performed. The other options represent less proactive or appropriate responses.
35 / 37
"PR Description:
"Running container security scans on the 'Chimera' service identified a weakness: the base image used contains an outdated version of `libcurl`. The scanner recommends updating to the latest stable release. What's the most appropriate next step?"
This tests understanding of proactive security measures. Updating vulnerable libraries is a standard practice to address known vulnerabilities. While compatibility concerns should be considered, prioritizing patching outdated components is crucial for container security. Ignoring the recommendation or deferring the update would increase risk.
36 / 37
"John: 'I've been running container security scans on our new microservice deployments. The scanner is repeatedly flagging issues with overly permissive file system permissions within the containers. It suggests implementing least privilege principles. How should I proceed?'"
This question evaluates understanding of 'least privilege' – a core principle in container security. While testing for functionality is important, addressing overly permissive permissions directly aligns with this principle and reduces potential attack surface. A phased approach is often preferable to avoid disrupting service.
37 / 37
{
"scan_result": {
"vulnerability": "CVE-2023-1234",
"severity": "critical",
"description": "Unpatched vulnerability in the base image's SSH server.",
"recommendation": "Immediately disable SSH access to the container."
}
}This item assesses understanding of interpreting security scan results. The API response clearly identifies a critical vulnerability and recommends immediate action—disabling SSH access. A critical severity level demands prompt attention; ignoring the API or dismissing it as 'automated' is incorrect.
Frequently Asked Questions
What does the "Container Security Scanning" exercise practise?
Master the IT-English vocabulary of container security scanning: vulnerabilities, CVEs, base image patching and scan gates.
How many questions are in this exercise?
This exercise has 37 questions, each multiple-choice with a full explanation shown after you answer.
What English level is this exercise for?
This exercise is tagged Intermediate. If the vocabulary feels difficult, browse the Containers & Virtualization category page for an easier module to start with.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free with no account, sign-up, or paywall.
Do I get feedback if I answer incorrectly?
Yes — whichever option you choose, right or wrong, you'll immediately see an explanation clarifying the correct term and why the other options don't fit.
Can I retry this exercise?
Yes — once you finish all the questions, a "Try again" button on the results screen resets the exercise so you can practise as many times as you like.
Do I need an account to track my progress?
No account is required. Your progress bar and score for this session are tracked in the browser as you go, but nothing is saved once you leave the page.
Is "Container Security Scanning" part of a larger series?
Yes — it's one exercise in the Containers & Virtualization category on CoderSlingo. See the category page for the full list of related exercises on similar terminology.
Can I link directly to this exercise?
Yes — this exercise has its own permanent URL, so you can bookmark it or share the link directly with a colleague or study partner.
Where can I find more exercises like this one?
See the Containers & Virtualization category page for related exercises, or browse the main Exercises hub for other IT English topics.