Google Cloud Professional Cloud Security Engineer Practice Exam

When building secure container images, what should be removed?

1. Key binaries that support the application

2. Unnecessary tools not needed by the app

3. Essential libraries for functionality

4. Service accounts for permissions

The correct answer is: Unnecessary tools not needed by the app

When building secure container images, it is important to focus on removing unnecessary tools that are not needed by the application. This practice simplifies the image, which reduces the attack surface and minimizes the potential vulnerabilities that could be exploited. By eliminating unnecessary tools, you not only streamline the image but also enhance its security posture. A smaller footprint means fewer components to manage and update, reducing the chances of a security risk associated with unused or outdated software. Key binaries and essential libraries are critical for the application's functionality and should not be removed, as doing so could hinder the application’s performance or lead to operational failures. Similarly, service accounts are necessary for managing permissions and security access within the container and should remain intact to ensure proper authentication and regulatory compliance. Thus, focusing on the removal of unnecessary tools, while retaining the core components necessary for functionality and security permissions, is a key practice when creating secure container images.