Minimize Microservice Vulnerabilities

A microservice running as a Deployment in a Kubernetes cluster needs to authenticate to a third-party API using a static API key. Which is the most secure way to store and inject this secret into the container?

During a security audit, a team discovers that their microservice application, deployed on Kubernetes, is vulnerable to container breakout attacks. The containers run as root and have many Linux capabilities. Which set of Pod Security Standards (PSS) enforcement modes and policies would best mitigate this risk?

A DevOps engineer wants to ensure that all microservice containers run with a read-only root filesystem to prevent unauthorized writes. What is the simplest way to enforce this at the Pod level?

A security scanner reports that a microservice container image contains a critical vulnerability (CVE-2024-1234) in a system library. The team cannot immediately rebuild the image. What is the most effective temporary mitigation at the Kubernetes level?

A microservice container needs to perform DNS lookups using TCP rather than UDP. Which Kubernetes security context setting should be configured to allow this?

Which THREE of the following practices help protect microservice applications against supply chain attacks? (Choose three.)

Given the following PodSecurityPolicy (PSP) snippet, which statement about the allowed containers is correct?

A security engineer runs the following command to inspect a container's security context. What vulnerability does this configuration expose?

A DevOps team deploys a microservice that needs to access a third-party API using credentials stored in a Kubernetes Secret. The team wants to minimize the risk of credential exposure. Which approach best achieves this goal while following security best practices?

You are asked to secure a set of microservices running in a Kubernetes cluster. Which TWO of the following practices help minimize vulnerabilities in microservices?

Which TWO of the following are best practices for minimizing microservice vulnerabilities in a Kubernetes cluster?

You are a Kubernetes administrator for a fintech company that runs a payment processing service in a production cluster. The service consists of multiple microservices that communicate over the network. Recently, a security audit revealed that a compromised pod could potentially send malicious requests to other services because there are no network restrictions between pods. The security team has mandated that all inter-service traffic must be encrypted and authenticated, and that only necessary traffic should be allowed. You need to implement a solution that meets these requirements with minimal changes to the application code and minimal operational overhead. Which approach should you take?

Order the steps to configure and apply a NetworkPolicy to restrict pod-to-pod traffic.

Match each Kubernetes object or feature to its primary security purpose.

Match each Kubernetes network security concept to its definition.

A developer wants to ensure that all containers in a pod run with a read-only root filesystem except for a specific volume mounted for writing logs. Which container-level security context field should be set to true?

Which Istio resource is used to enforce mutual TLS (mTLS) for all services in a namespace, ensuring that traffic between services is encrypted?

Which kubectl command would you use to create a ValidatingWebhookConfiguration from a YAML file?

A cluster administrator has configured EncryptionConfiguration to encrypt secrets at rest using a local key. After applying the configuration, the administrator creates a new secret. How can they verify that the secret is encrypted at rest?

A pod is using a RuntimeClass that specifies gVisor (runsc). Which of the following scenarios is most likely to cause the pod to fail?

Which of the following is the best practice for providing sensitive data like passwords to a pod?

A pod fails to start with the error 'Container runtime network not ready', and the node uses Kata Containers (RuntimeClass: kata). What is the most likely cause?

Which of the following is the correct way to drop all capabilities in a container's security context?

What is the purpose of the `allowPrivilegeEscalation: false` setting in a container's security context?

Which TWO of the following are valid ways to securely manage secrets in Kubernetes? (Choose two.)

Which THREE of the following are best practices for securing a Kubernetes cluster using OPA Gatekeeper? (Choose three.)

Which TWO of the following are valid Kubernetes RuntimeClass handlers for container sandboxing? (Choose two.)

You are implementing a Gatekeeper policy to deny pods that run as root. Which Rego rule should you include in the ConstraintTemplate?

In the context of service mesh (e.g., Istio), which resource is used to enforce mutual TLS (mTLS) between services in a specific namespace?

You need to run a container with a sandboxed runtime using gVisor (runsc). Which Kubernetes resource must be created first to enable this?

Which of the following is the best practice for injecting secrets into a pod?

You want to drop all Linux capabilities from a container. Which securityContext field should you set?

A ValidatingWebhookConfiguration is not working as expected. The webhook server is running and accessible. What is a common misconfiguration that would cause the webhook to not be called?

Which of the following is NOT a valid method to enforce pod security standards in a Kubernetes cluster?

To encrypt secrets at rest, which file must be modified on the control plane nodes?

You need to ensure that all pods in a namespace can only communicate via mTLS. In Istio, which resource should you apply?

A Gatekeeper Constraint is not blocking pods that violate the policy. The constraint references a ConstraintTemplate that has been successfully created. What is the most likely cause?

Which container runtime is specifically designed for sandboxing containers with a lightweight kernel?

Which TWO of the following are valid arguments for the kubectl command to create a secret from a file? (Select TWO)

Which THREE of the following are valid approaches to enforce that all pods in a cluster run with a read-only root filesystem? (Select THREE)

A developer creates a Deployment with the following container spec: ```yaml containers: - name: app image: myapp:latest env: - name: DB_PASSWORD valueFrom: secretKeyRef: name: db-secret key: password ``` Which of the following is a security concern with this approach?

An administrator wants to use OPA Gatekeeper to enforce that all pods have a resource limits section defined. Which of the following is the correct combination to implement this policy?

A security engineer wants to enable mutual TLS (mTLS) between services in an Istio service mesh. Which Istio resource should be used to define the mTLS mode for the entire mesh?

Which kubectl command creates a secret named 'mysecret' from a file called 'credentials.json'?

A pod is configured with securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 The volume mounted at /data is owned by user 1000 and group 2000. The container process inside the pod writes to /data. Which statement about file ownership is true?

An administrator needs to encrypt secrets at rest in etcd. Which of the following steps is required?

Which of the following is a valid way to drop all capabilities from a container?

An administrator wants to use gVisor to sandbox containers in a Kubernetes cluster. Which resource must be created to enable this?

Which of the following commands creates a ValidatingWebhookConfiguration that uses an OPA Gatekeeper webhook?

What is the primary purpose of using a service mesh like Istio for microservices security?

Which TWO of the following are valid Rego keywords used in OPA policies for Gatekeeper? (Select TWO)

Which THREE of the following are valid ways to manage secrets in a Kubernetes environment? (Select THREE)

Which TWO of the following are correct about container sandboxing technologies? (Select TWO)

You need to ensure that all containers in a pod run as non-root. Which security context field should you set to enforce this?

A security policy requires that all pods drop ALL Linux capabilities and disable privilege escalation. Which YAML snippet correctly implements this in the pod's security context?

You are using Open Policy Agent (OPA) Gatekeeper to enforce pod security. You want to create a constraint that denies pods unless they have readOnlyRootFilesystem set to true. Which Rego rule in a ConstraintTemplate correctly implements this?

You want to enable mutual TLS (mTLS) between services in a namespace using Istio. Which custom resource should you configure to enforce STRICT mTLS for all workloads in the namespace?

You are configuring encryption at rest for Kubernetes secrets. After creating an EncryptionConfiguration with aescbc provider, which additional step is required to enable encryption?

Which admission controller is responsible for validating and mutating requests based on webhooks?

You need to use gVisor as a container runtime for a set of workloads in the cluster. Which Kubernetes resource must be created to reference the runtime class?

You are deploying a ValidatingWebhookConfiguration. The webhook server is running in the 'webhook' namespace, service name 'svc', port 443. Which clientConfig should you specify?

A pod uses a Secret mounted as a volume. The Secret is updated. How can the pod consume the updated values without restarting?

You need to enforce that no pod runs with privileged containers or runs as root. Which tool can define policies that block such pods at admission time?

Which command can be used to view the current set of admission webhooks in the cluster?

Which TWO of the following are recommended practices for securing container images and runtime?

Which THREE of the following are characteristics of container sandboxing runtimes like gVisor and Kata Containers?

Which TWO of the following are valid approaches to manage secrets in a Kubernetes cluster?

You need to enforce that all pods in the 'production' namespace run with read-only root filesystems. Which OPA Gatekeeper resource do you create first?

A security auditor requires that all pods in a cluster must not run as root. Which Pod Security Standard (PSS) and enforcement mode should be applied at the namespace level?

You need to encrypt secrets at rest in a Kubernetes cluster. What must be configured?

Which of the following is a best practice for storing sensitive data like passwords in Kubernetes?

You want to run a container with gVisor for sandboxing. After installing gVisor and creating a RuntimeClass named 'gvisor', which Pod configuration enables it?

You have created a ValidatingWebhookConfiguration to reject pods without resource limits. When you try to create a pod without limits, it is created successfully. What is the most likely reason?

You need to ensure that all pods in a namespace have the label 'security: high' added automatically upon creation. Which admission controller should you use?

Which flag enables the PodSecurity admission plugin in kube-apiserver?

You run 'kubectl auth can-i create pods --as=system:serviceaccount:default:sa1 -n default' and get 'no'. What does this mean?

Which TWO actions help minimize vulnerabilities in microservices by securing secrets? (Choose two)

Which ONE of the following is a valid Rego policy construct used in OPA Gatekeeper ConstraintTemplates to enforce security policies?

Which TWO container sandboxing technologies are supported in Kubernetes via RuntimeClass? (Choose two)

Which field must be set in a Pod's security context to prevent the container from running as the root user?

An administrator deploys a Gatekeeper ConstraintTemplate with the following Rego policy: package k8srequiredlabels deny[{"msg": msg}] { input.request.kind.kind == "Pod" not input.request.object.metadata.labels["security-tier"] msg := "Pod must have label 'security-tier'" } After creating the Constraint, a user creates a Pod without the 'security-tier' label. What is the expected behavior?

You are configuring an Istio service mesh for mTLS between services. Which resource defines the TLS mode for traffic between services in a namespace?

A cluster administrator wants to ensure that all Secrets are encrypted at rest using AES-CBC with a key managed by the local Kubernetes API server. Which configuration is required?

A security team wants to enforce that containers in a specific namespace cannot gain new capabilities. Which Pod security context field is used to achieve this?

Which command creates a validating webhook configuration that checks all pods in the cluster?

A developer asks you to run a container with gVisor runtime. The cluster has a RuntimeClass named 'gvisor' defined. Which field must be added to the Pod spec to use gVisor?

Which kubectl command lists all MutatingWebhookConfigurations in the cluster?

A cluster has EncryptionConfiguration with aescbc provider. After rotating the encryption key, what must be done to re-encrypt existing Secrets with the new key?

You need to drop all Linux capabilities from a container. Which YAML snippet is correct?

Which TWO of the following are valid ways to enforce that containers cannot run as root in a Kubernetes cluster? (Select TWO.)

Which THREE of the following are true about Istio PeerAuthentication? (Select THREE.)

Which TWO of the following are secure practices for managing secrets in Kubernetes? (Select TWO.)

A security admin wants to ensure that no container in a specific namespace runs as root. Which Gatekeeper ConstraintTemplate and Constraint configuration should be used?

Which of the following is the correct kubectl command to view the OPA Gatekeeper ConstraintTemplates in the cluster?

An admin wants to enforce that all pods in a namespace use a read-only root filesystem except for a specific deployment that needs to write to a temporary directory. Which approach best meets this requirement?

Which field in a Pod's securityContext prevents privilege escalation by the container?

A security admin wants to ensure all pods in a cluster drop ALL Linux capabilities. Which of the following YAML snippets should be added to a PodSecurityPolicy (assuming PSP is enabled) or a pod spec?

An admin has created an EncryptionConfiguration to encrypt secrets at rest in etcd. After applying the configuration and restarting the kube-apiserver, existing secrets are still stored in plaintext. What is the most likely reason?

What is the primary benefit of using external secret managers (e.g., HashiCorp Vault) in Kubernetes?

An administrator wants to enforce mutual TLS (mTLS) between all services in an Istio service mesh. Which resource should be configured?

A cluster administrator wants to run some workloads in a sandboxed environment using gVisor. Which Kubernetes resource must be created first to allow pods to request the gVisor runtime?

Which of the following is a characteristic of Kata Containers compared to gVisor?

An admin has deployed a ValidatingWebhookConfiguration that denies pods with `runAsNonRoot: false`. After creating a pod that does not set `runAsNonRoot` at all, the pod is created successfully. Why did the webhook not deny it?

Which TWO of the following are valid ways to enforce that containers run with a read-only root filesystem?

Which THREE of the following are required to configure encryption of secrets at rest in Kubernetes?

Which TWO of the following are best practices for securing secrets in Kubernetes?

You need to ensure that all pods in a cluster run with read-only root filesystems. Which Pod Security Standard (PSS) control field should be set to true?

An administrator wants to enforce a policy that all containers must drop ALL capabilities and not allow privilege escalation. Which YAML snippet correctly implements this requirement in a PodSecurityPolicy-like manner using a security context? (Note: PodSecurityPolicy is deprecated; consider using a ValidatingAdmissionPolicy or OPA/Gatekeeper, but for this question choose the correct security context fields.)

A security team wants to use OPA/Gatekeeper to enforce that all namespaces must have a label 'security-tier' with value 'high' or 'medium'. What is the correct approach?

You need to encrypt Kubernetes secrets at rest. Which resource should you configure?

A pod runs with a service mesh sidecar (Istio). The team wants to enforce mutual TLS (mTLS) for all traffic between services in the 'production' namespace. Which resource should be applied?

An admin runs 'kubectl run test-pod --image=busybox --command -- sleep 3600' and then executes 'kubectl exec test-pod -- cat /var/run/secrets/kubernetes.io/serviceaccount/token'. The admin wants to prevent such access to the service account token. What is the correct action?

Which command correctly creates a secret from a file named 'config.json'?

You want to run a container with gVisor (runsc) runtime for sandboxing. Which resource is required to use a non-default runtime?

Which kubectl command creates a validating webhook configuration that calls an external HTTPS endpoint for pod validation?

You are using External Secrets Operator to sync secrets from HashiCorp Vault. The operator is deployed but secrets are not being created. Which resource defines the mapping between Vault secrets and Kubernetes secrets?

Which TWO of the following are valid Pod Security Context settings to harden a container? (Select 2)

You need to enforce that all containers in a namespace run with a read-only root filesystem. Which OPA Gatekeeper resource would you use to define the policy?

You are deploying an application that needs to access a database password stored in a Kubernetes Secret. To minimize risk, you should mount the Secret as a volume rather than using environment variables. Which of the following is the primary security benefit of using mounted volumes over environment variables?

In Kubernetes, you need to enforce a default deny-all network policy for pods in a specific namespace to ensure pods cannot communicate unless explicitly allowed by policy. Which resource should you create?

You have enabled encryption at rest for Kubernetes Secrets by configuring an EncryptionConfiguration object and restarting the API server. After the configuration, you create a new Secret. However, when you retrieve the Secret using 'kubectl get secret mysecret -o yaml', the 'data' field still shows base64-encoded plaintext. Is the Secret encrypted at rest?

You want to run a workload in a sandboxed container using gVisor. You have created a RuntimeClass named 'gvisor' that references the 'runsc' handler. Which of the following Pod specs correctly uses this RuntimeClass?

You have a Pod that uses a ServiceAccount token mounted via a projected volume. You want to ensure that the token has an expiration time and that the pod is not using a long-lived token. What is the most secure way to mount the token?

You need to create a NetworkPolicy that denies all ingress traffic to pods with label 'app: web' in the 'frontend' namespace, except for traffic from pods with label 'app: ingress' in the 'ingress' namespace. Which NetworkPolicy spec correctly achieves this?

Which kubectl command would you use to create a Secret from a file named 'db-password.txt'?

Which TWO of the following are valid ways to enforce that a container runs as a non-root user?

Which THREE of the following are capabilities that should typically be dropped from a container to minimize vulnerabilities?

You want to use an external secret management system like HashiCorp Vault to manage database credentials for your application. Which of the following are valid approaches to integrate Vault with Kubernetes?

A security engineer needs to ensure that all containers in a cluster run as non-root users. Which Pod Security Context field should be set to enforce this requirement?

You are tasked with creating a ConstraintTemplate in OPA/Gatekeeper that denies pods running with the 'latest' image tag. Which Rego rule should the ConstraintTemplate include?

A security best practice is to avoid storing sensitive data in environment variables. Instead, secrets should be mounted as volumes. Which of the following YAML snippets correctly mounts a Kubernetes Secret named 'db-secret' as a volume at /etc/secrets?

An administrator wants to enforce mTLS between all services in the 'mesh' namespace using Istio. Which resource should be applied to require mutual TLS for all workloads in that namespace?

To encrypt secrets at rest in Kubernetes, an administrator configures an EncryptionConfiguration. What is the correct flag to pass to the kube-apiserver to use this configuration?

A cluster administrator wants to audit all pod creations and modifications using an admission webhook. Which resource type should be created to register the webhook?

Which of the following is a valid approach to enforce that containers cannot escalate privileges?

A security engineer runs the following command to inspect a pod's security context: kubectl get pod secure-pod -o jsonpath='{.spec.containers[0].securityContext.capabilities}' The output is: {"drop":["ALL"]} What does this indicate?

An OPA/Gatekeeper ConstraintTemplate is defined with the following Rego rule: violation[{"msg": msg}] { container := input.review.object.spec.containers[_] container.securityContext.runAsNonRoot != true msg := "Container must run as non-root" } What happens when a pod is submitted with a container that has runAsNonRoot: true?

Which THREE of the following security context settings help mitigate container breakout attacks? (Select 3)

Which TWO of the following are valid methods to enforce mTLS in an Istio service mesh? (Select 2)

An administrator wants to enforce that all containers in a Kubernetes cluster run as non-root and have read-only root filesystems using OPA/Gatekeeper. Which two resources must be created?

A developer wants to run a container that reads a secret from a mounted volume, not as an environment variable. Which volume type should they use?

An admin creates the following EncryptionConfiguration to encrypt secrets at rest. After applying it, what must the admin do to ensure existing secrets are encrypted?

In an Istio service mesh, you want to enforce mutual TLS (mTLS) between all services in the 'default' namespace. Which resource should you create?

Which kubectl command creates a valid webhook configuration that validates pods against a policy?

A cluster administrator needs to run a workload that uses gVisor (runsc) for container sandboxing. Which Kubernetes resource is required to enable this?

A pod manifests with securityContext: { runAsNonRoot: true, runAsUser: 1001 }. However, the container image expects to run as root (UID 0). What will happen when the pod is created?

You are writing a Rego policy for OPA/Gatekeeper to deny pods that do not have runAsNonRoot set to true. Which Rego statement should the ConstraintTemplate contain?

An admin runs 'kubectl get pod web -o yaml' and sees the following security context. Which setting prevents privilege escalation?

A cluster has a ValidatingWebhookConfiguration that intercepts Pod CREATE requests. The webhook server is unavailable. What happens when a user tries to create a pod?

Which ONE of the following is a valid method to restrict a container's filesystem to read-only in Kubernetes?

Which TWO of the following are required to enable encryption of Kubernetes Secrets at rest?

Which THREE of the following are valid capabilities that should be dropped for a container running a typical non-privileged application to adhere to the principle of least privilege?

You need to encrypt Secrets at rest in an existing Kubernetes cluster. You create an EncryptionConfiguration file specifying aescbc as the provider. After updating the API server kube-apiserver.yaml with the new configuration, you create a new Secret. Which of the following statements is true?

Which TWO of the following are valid ways to enable mTLS between services in a service mesh (e.g., Istio)?

Which THREE of the following are recommended practices for minimizing microservice vulnerabilities related to container security?

Which TWO of the following are valid methods to securely manage secrets in Kubernetes?

Which THREE of the following are features of container sandboxing solutions like gVisor or Kata Containers?

You are deploying a workload that must be isolated from other workloads on the same node. You want to use a container sandboxing runtime to provide an additional security boundary. Which TWO of the following are true regarding the use of gVisor or Kata Containers in a Kubernetes cluster? (Choose two.)

A developer reports that a pod fails to start with the error 'container has runAsNonRoot and image will run as root'. The pod spec includes securityContext.runAsNonRoot: true but does not specify runAsUser. The container image's Dockerfile does not set a USER instruction. Which change should you make to the pod spec to resolve the error while still enforcing non-root execution?

A developer is deploying a pod that needs to access a sensitive database. The security team requires that the database credentials be stored in a Kubernetes Secret and mounted as a file, not exposed as environment variables. The credentials must be rotated without restarting the pod. Which volume type should be used?

You are reviewing a pod specification that mounts a hostPath volume to /var/run/docker.sock. Which security risk does this present, and what is the recommended mitigation?