Containers

Correct Answer: Kubernetes

The best technology to orchestrate and manage containerized microservices in a data center is Kubernetes. Kubernetes is an open-source platform specifically designed for automating deployment, scaling, and management of containerized applications. It groups containers into 'Pods' for easy management and discovery, making it ideal for microservices architecture. The other technologies listed are either insufficient or inappropriate for the task described. Docker is a platform for creating containers itself, but does not have the extensive orchestration and scaling capabilities of Kubernetes. OpenStack is cloud computing software, but it doesn't specialize in container management. VMware vSphere is a server virtualization platform; while it can support containers, its primary focus is on full-fledged virtual machines, not container orchestration.

Correct Answer: Scanning images for vulnerabilities

Improving container image security in a CI/CD pipeline can be best achieved by 'Scanning images for vulnerabilities'. This practice allows you to find and fix any security vulnerabilities before these images are deployed. Scanning container images is a proactive measure to prevent the execution of vulnerable or compromised containers. 'Applying default container settings' might not necessarily improve security since default configurations are often not aligned with security best practices. 'Sharing root access between containers' is a bad practice from a security point of view as it can potentially provide an attacker with control over all containers. Similarly, 'Storing sensitive data in environment variables' is a poor security practice since environment variables can be accidentally exposed or logged, which may lead to data breaches.

Correct Answer: Network namespaces

Network namespaces are a perfect solution in this case. This technology allows for the isolation of network interfaces, ports, routes, and other network resources between different containers. By doing so, it makes each container thinks it's running its separate network stack. Therefore, even if malicious traffic pattern was detected from a specific container, it wouldn’t affect other containers on the same host. Network namespaces create a security barrier that prevents the spread of network attacks Control groups (cgroups) are incorrect because they deal with resource usage, not network traffic. They allow you to allocate resources among user-defined groups of processes. It primarily assists in CPU, memory, and IO management but doesn’t control, monitor or isolate network behavior SELinux and AppArmor are wrong choices too. These Linux security modules provide mandatory access control (MAC) system, allowing administrators to apply policies to entire systems to limit interactions with certain resources. However, they are not built specifically to isolate network traffic within containers in the way network namespaces do and wouldn't be the best option here when dealing with network traffic anomalies.