CompTIA Security+ SY0-701 Practice Question

Using non-privileged containers is a best practice to ensure that containers run with the least privilege required and do not have unnecessary access to the host system. This minimizes the attack surface and reduces the risk of a container exploit leading to host or other container compromise. Mounting volumes read-only where applicable ensures that containers cannot modify the mounted data, preserving integrity, but does not limit container privileges. Network segmentation is important for controlling traffic but doesn't inherently reduce privileges within the container itself. Similarly, routine vulnerability scanning and implementing resource limits are important practices for container security, but they do not directly address the principle of least privilege regarding container access to the host system.