CKS System Hardening Practice Test 10 — 15 Questions

Question 1

An administrator runs 'aa-status' on a node and sees a profile in 'complain' mode. What does this indicate?

Accepted Answer

The profile logs violations but does not block them.. AppArmor profiles in 'complain' mode log policy violations to the system log (e.g., /var/log/syslog or audit.log) but do not enforce them, meaning the actions are allowed while being recorded. This is distinct from 'enforce' mode, where violations are blocked. The 'aa-status' command shows the current mode of loaded profiles.

Answer

The profile is disabled and has no effect.

Answer

The profile is enforcing restrictions and blocking violations.

Answer

The profile is not loaded.

Question 2

What is the effect of setting 'hostPID: true' in a pod's spec?

Accepted Answer

The container runs in the host's PID namespace.. Setting 'hostPID: true' in a pod's spec allows the container to share the host node's PID namespace, meaning the container can see and interact with all processes running on the host, not just those within its own PID namespace. This is a privileged-level setting that bypasses the default process isolation provided by Kubernetes and Linux namespaces.

Answer

The container runs with the host's IPC namespace.

Answer

The container can access the host's network interfaces.

Answer

The container can mount the host's filesystem.

Question 3

Which Pod Security Standard level allows the most relaxed security controls?

Accepted Answer

privileged. The privileged Pod Security Standard (PSS) level imposes no restrictions on pod behavior, allowing unrestricted access to host resources, capabilities, and security contexts. This makes it the most relaxed level, as it does not enforce any of the constraints found in baseline or restricted profiles.

Answer

restricted

Answer

default

Answer

baseline

Question 4

A cluster uses PodSecurity admission. A namespace has the label 'pod-security.kubernetes.io/enforce: baseline'. A user creates a pod that runs a container with 'privileged: true'. What happens?

Accepted Answer

The pod is rejected by the admission controller.. The PodSecurity admission controller enforces the configured security level based on the namespace label. The 'baseline' level prohibits privileged containers, so a pod with 'privileged: true' violates the policy. The admission controller rejects the pod immediately, preventing its creation.

Answer

The pod is created but flagged with a warning.

Answer

The pod is created successfully because privileged is allowed at baseline.

Answer

The pod is created but the privileged setting is ignored.

Question 5

An administrator wants to drop all capabilities for a container and then add back only NET_BIND_SERVICE. Which securityContext configuration is correct?

Accepted Answer

capabilities:
  drop: ["ALL"]
  add: ["NET_BIND_SERVICE"]. It first drops all capabilities using `drop: ["ALL"]`, which removes every Linux capability from the container, and then explicitly adds back only `NET_BIND_SERVICE`. This follows the principle of least privilege: start with no capabilities and grant only what is needed. The `securityContext` in Kubernetes applies these settings at the container level, ensuring the container can bind to privileged ports (below 1024) without any other elevated permissions.

Answer

capabilities:
  add: ["NET_BIND_SERVICE"]

Answer

capabilities:
  drop: ["ALL"]

Answer

capabilities:
  drop: ["NET_BIND_SERVICE"]
  add: ["ALL"]

Question 6

Which tool is used to load AppArmor profiles on a node?

Accepted Answer

apparmor_parser. The `apparmor_parser` tool is the standard utility for loading AppArmor profiles into the kernel's security module. It reads profile definitions from text files, compiles them into binary form, and loads them into the kernel's LSM (Linux Security Module) subsystem. Without this tool, AppArmor profiles cannot be activated on a node.

Answer

aa-enforce

Answer

aa-status

Answer

kubectl apply

Question 7

What is the default seccomp profile for Kubernetes containers when no seccompProfile is specified?

Accepted Answer

RuntimeDefault. When no `seccompProfile` is specified in the Pod or container security context, Kubernetes applies the `RuntimeDefault` seccomp profile by default. This profile is defined by the container runtime (e.g., containerd or CRI-O) and blocks a specific set of syscalls that are considered dangerous or unnecessary for containers, while allowing normal application operations. This default behavior was introduced in Kubernetes 1.19 and became the default for all pods in Kubernetes 1.22, enhancing security without requiring explicit configuration.

Answer

Localhost

Answer

No profile is applied

Answer

Unconfined

Question 8

A pod runs with 'hostNetwork: true' and 'hostPID: true'. Which security concern is MOST directly increased?

Accepted Answer

The container can access host processes and potentially escape. Setting `hostNetwork: true` and `hostPID: true` in a pod grants the container direct access to the host's network namespace and process namespace. With `hostPID: true`, the container can see all host processes (e.g., via `ps aux`) and potentially interact with them using system calls like `ptrace`, which could allow escaping the container by injecting code into a host process. This combination directly increases the risk of container breakout, making A the most significant security concern.

Answer

The container can modify iptables rules

Answer

The container can sniff network traffic of other pods

Answer

The container can mount the host filesystem

Question 9

An administrator creates a custom seccomp profile and places it at /var/lib/kubelet/seccomp/myprofile.json. Which securityContext field is used to apply this profile to a container?

Accepted Answer

seccompProfile:
  type: Localhost
  localhostProfile: "myprofile.json". When using a custom seccomp profile stored on the node, the `type` must be `Localhost`, and the `localhostProfile` field must contain only the filename (e.g., `myprofile.json`), not the full path. Kubernetes automatically prepends `/var/lib/kubelet/seccomp/` to the filename, so specifying the full path would cause the profile to be looked up in the wrong location, resulting in a failure to apply the profile.

Answer

seccompProfile:
  type: Localhost
  localhostProfile: "/var/lib/kubelet/seccomp/myprofile.json"

Answer

seccompProfile:
  type: RuntimeDefault
  localhostProfile: "myprofile.json"

Answer

seccompProfile:
  type: Unconfined
  localhostProfile: "myprofile.json"

Question 10

Which TWO of the following are valid Pod Security Standards levels?

Accepted Answer

privileged. The Pod Security Standards (PSS) define three levels: privileged, baseline, and restricted. 'Privileged' is the most permissive level, allowing all known privilege escalations and is intended for system-level workloads that require unrestricted access to host resources.

Answer

secure

Answer

default

Answer

strict

Question 11

Which THREE of the following are recommended measures to reduce the attack surface of Kubernetes nodes?

Accepted Answer

Disable unnecessary system services on nodes. Disabling unnecessary system services on Kubernetes nodes reduces the number of running processes and open ports that could be exploited by an attacker. Services like telnet, rsh, or unused SNMP daemons provide additional attack vectors. This aligns with the principle of minimalism in system hardening, as recommended by the CIS Kubernetes Benchmark.

Answer

Open all ports on nodes to allow easy debugging

Answer

Run all containers as root user

Question 12

Which THREE of the following are valid AppArmor profile modes?

Accepted Answer

complain. AppArmor has three valid profile modes: enforce, complain, and unconfined. In enforce mode, violations are blocked and logged; in complain mode, only logging occurs without blocking; in unconfined mode, the profile is loaded but no confinement is applied (essentially disabled). The other options are not valid profile modes: audit is a rule-level flag, and allow is not a mode. Therefore, options A (complain), C (enforce), and D (unconfined) are all valid AppArmor profile modes.

Answer

audit

Answer

allow

Question 13

A cluster administrator wants to enforce that all pods in the 'restricted' namespace use the Restricted Pod Security Standard. Which command achieves this?

Accepted Answer

kubectl label ns restricted pod-security.kubernetes.io/enforce=restricted. The `kubectl label` command with the key `pod-security.kubernetes.io/enforce` and value `restricted` applies the Restricted Pod Security Standard to the namespace. This label instructs the Pod Security Admission controller to enforce the most restrictive policy, rejecting any pod that violates the standard. The command targets the namespace 'restricted' as required.

Answer

kubectl annotate ns restricted pod-security.kubernetes.io/restricted=restricted

Answer

kubectl label ns restricted pod-security.kubernetes.io/enforce=privileged

Answer

kubectl create podsecuritypolicy restricted --namespace restricted

Question 14

You have built a custom seccomp profile at /var/lib/kubelet/seccomp/audit.json. Which YAML snippet correctly applies this profile to a container?

Accepted Answer

securityContext:
  seccompProfile:
    type: Localhost
    localhostProfile: "audit.json". The seccomp profile is stored at `/var/lib/kubelet/seccomp/audit.json`. The `localhostProfile` field expects a relative path from the base directory `/var/lib/kubelet/seccomp/`. Therefore, `audit.json` correctly resolves to the full path. The `seccompProfile` API with `type: Localhost` is the current method for applying custom profiles.

Answer

securityContext:
  seccompProfile:
    type: RuntimeDefault

Answer

securityContext:
  seccompProfile:
    type: Localhost
    localhostProfile: "profiles/audit.json"

Answer

securityContext:
  seccomp:
    type: Localhost
    profile: "audit.json"

Question 15

A pod is running with AppArmor enabled using a profile named 'k8s-apparmor-profile'. You want to verify that the profile is loaded and set to enforce mode. Which command should you run on the node?

Accepted Answer

aa-status. `aa-status` is the standard AppArmor utility that displays the status of AppArmor, including which profiles are loaded and their enforcement mode (enforce, complain, or unconfined). Running this command on the node will show whether 'k8s-apparmor-profile' is loaded and set to enforce mode, which directly answers the verification requirement.

Answer

aa-profile --status

Answer

aa-enabled

Answer

cat /sys/kernel/security/apparmor/profiles