A company is moving from the use of web servers hosted in an internal datacenter to a containerized cloud platform. An analyst has been asked to identify indicators of compromise in the containerized environment. Which of the following would BEST indicate a running container has been compromised?
A) A container from an approved software image has drifted
B) An approved software orchestration container is running with root privileges
C) A container from an approved software image has stopped responding
D) A container from an approved software image fails to start

Question

Quizplus · Accepted Answer

A container from an approved software image that has drifted indicates that the container's configuration or code has changed unexpectedly, which could be a sign of compromise.

A Company Is Moving from the Use of Web Servers