Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

The SecOps Group CAP Exam - Topic 12 Question 110 Discussion

While performing a security audit of a web application, you discovered an exposed docker-compose.yml file. What is the significance of this file and what data can be found in it?
C) The docker-compose.yml file is a YAML file that is used to define the services, networks, and volumes required for a Docker application. It specifies the configuration and dependencies for all containers in the application, including their network settings and container volumes.
A) The docker-compose.yml file is a YAML file that contains the application source code.
B) The docker-compose.yml file is a YAML file that contains the server logs and user session information including but not limited to admin users.
D) The docker-compose.yml file is a YAML file that contains the configuration of load balancers and firewalls.

The SecOps Group CAP Exam - Topic 12 Question 110 Discussion

Actual exam question for The SecOps Group's CAP exam
Question #: 110
Topic #: 12
[All CAP Questions]

While performing a security audit of a web application, you discovered an exposed docker-compose.yml file. What is the significance of this file and what data can be found in it?

Show Suggested Answer Hide Answer
Suggested Answer: C

A docker-compose.yml file is a YAML-formatted configuration file used with Docker Compose, a tool for defining and running multi-container Docker applications. Its primary significance lies in orchestrating the deployment of Docker containers by specifying services (e.g., web server, database), networks (e.g., internal communication), and volumes (e.g., persistent storage). An exposed docker-compose.yml file poses a security risk because it may reveal sensitive configuration details, such as service names, ports, environment variables (e.g., database credentials), and network settings, which attackers could exploit to target the application.

Option A ('The docker-compose.yml file is a YAML file that contains the application source code'): Incorrect, as this file defines configuration and orchestration, not source code.

Option B ('The docker-compose.yml file is a YAML file that contains the server logs and user session information...'): Incorrect, as logs and session data are stored elsewhere (e.g., in container logs or databases), not in docker-compose.yml.

Option C ('The docker-compose.yml file is a YAML file that is used to define the services, networks, and volumes...'): Correct, as it accurately describes the file's purpose and content, including configuration and dependencies, which are critical for Docker applications.

Option D ('The docker-compose.yml file is a YAML file that contains the configuration of load balancers and firewalls'): Incorrect, as it focuses only on load balancers and firewalls, which are specific components and not the primary focus of the file.

The correct answer is C, aligning with the CAP syllabus under 'Container Security' and 'Configuration Management.'


Contribute your Thoughts:

0/2000 characters
Glennis
2 hours ago
I thought the docker-compose.yml file might include sensitive data, but I can't recall if it has user session info. I guess C is still the safest bet.
upvoted 0 times
...
Trina
5 days ago
I feel like I've seen similar questions before, and they emphasized that this file is crucial for managing Docker applications. C seems to fit best.
upvoted 0 times
...
Brinda
10 days ago
I'm not entirely sure, but I think the file doesn't contain source code or logs. It’s more about the setup of containers, right?
upvoted 0 times
...
Lashaunda
16 days ago
I remember studying that the docker-compose.yml file defines services and their configurations, so I think option C is correct.
upvoted 0 times
...

Save Cancel