While auditing a cloud image configured for deployment, which of the following findings represents a deployment misconfiguration?

Including unused software packages in a cloud image is a critical deployment misconfiguration. It violates the security principle of minimalism by unnecessarily increasing the image's attack surface. Each additional package is a potential vector for vulnerabilities that could be exploited, even if the application does not use it directly. Security audits prioritize identifying and removing such packages to harden the image. This practice also leads to image bloat, which increases storage costs and slows down deployment and scaling operations.

A. Lacking a health check is an operational issue that impacts reliability and automated recovery, but it is not a direct security vulnerability like including unnecessary code.
B. Using a private registry with RBAC is a security best practice for controlling access to container images, representing a correct and secure configuration.
C. Applying labels for metadata is a recommended practice for effective image management, versioning, and maintainability, not a misconfiguration. ---

1. CrowdStrike Official Blog. In a discussion on container security best practices, CrowdStrike advises to "Minimize the attack surface" by starting with a minimal base image and "only install the packages and libraries required for your application to run." This directly identifies including unused software as a poor practice to be avoided.

Source: CrowdStrike Blog, "Container Security: 5 Best Practices for Securing Your Containers," Section: "1. Start with a trusted, minimal base image."

2. NIST Special Publication 800-190, Application Container Security Guide. This guide identifies risks associated with images, stating that images may contain "unnecessary software." It recommends using vulnerability scanning tools to identify vulnerable and unnecessary software components and rebuilding the image without them to reduce the attack surface.

Source: NIST SP 800-190, Section 3.1.1, "Image Risks," and Section 4.1, "Image Vulnerability Scanning."

3. Center for Internet Security (CIS) Docker Benchmark. The benchmark's guiding principle for image construction is to reduce the attack surface. The introduction to the section on image creation emphasizes that images should be crafted with the "bare minimum of software and libraries to support the containerized application."

Source: CIS Docker Benchmark v1.4.0, Page 81, Introduction to Section 4, "Image and Build File."