CKS System Hardening Practice Test 8 — 15 Questions

Question 1

A security admin wants to drop all Linux capabilities for a container and then add only CAP_NET_BIND_SERVICE. Which YAML snippet correctly achieves this?

Accepted Answer

securityContext:
  capabilities:
    drop: ['ALL']
    add: ['NET_BIND_SERVICE']. It uses the standard Kubernetes `securityContext.capabilities` field with `drop: ['ALL']` to remove all Linux capabilities from the container, then `add: ['NET_BIND_SERVICE']` to grant only the `CAP_NET_BIND_SERVICE` capability. This is the proper YAML syntax for the desired capability set.

Answer

securityContext:
  capabilities:
    drop: ['ALL']
    add: ['NET_BIND_SERVICE']
  privileged: true

Answer

securityContext:
  capabilities:
    drop: ['NET_BIND_SERVICE']
    add: ['ALL']

Answer

securityContext:
  capDrop: ['ALL']
  capAdd: ['NET_BIND_SERVICE']

Question 2

An admin runs 'kubectl describe pod secure-pod' and sees 'seccompProfile: RuntimeDefault' under the container's security context. Which seccomp profile is being used?

Accepted Answer

The container runtime's default seccomp profile is applied. When `seccompProfile` is set to `RuntimeDefault` in a container's security context, Kubernetes instructs the container runtime (e.g., containerd, CRI-O) to apply its own default seccomp profile. This profile is typically a restrictive set of syscalls that blocks dangerous or unnecessary system calls while allowing common operations. It is not a custom profile from the node's filesystem, nor does it disable seccomp or set it to unconfined.

Answer

A custom seccomp profile from '/var/lib/kubelet/seccomp/' is used

Answer

The container runtime's seccomp profile is set to 'Unconfined'

Answer

Seccomp is disabled for this container

Question 3

A cluster administrator wants to enforce the Pod Security Standard 'restricted' at the namespace level. Which command applies the PodSecurity admission label to the 'prod' namespace?

Accepted Answer

kubectl label namespace prod pod-security.kubernetes.io/enforce=restricted. The `enforce` label is the only one that actively blocks pods that violate the specified Pod Security Standard (PSS) level. The command `kubectl label namespace prod pod-security.kubernetes.io/enforce=restricted` applies the 'restricted' policy at the namespace level, causing the PodSecurity admission controller to reject any pod that does not comply with the restricted profile.

Answer

kubectl label namespace prod pod-security.kubernetes.io/warn=restricted

Answer

kubectl label namespace prod pod-security.kubernetes.io/audit=restricted

Answer

kubectl annotate namespace prod security.kubernetes.io/pod-security=restricted

Question 4

Which command loads an AppArmor profile into the kernel?

Accepted Answer

apparmor_parser -r /path/to/profile. The `apparmor_parser` command is the standard tool for loading AppArmor profiles into the Linux kernel. The `-r` flag (replace) loads or reloads the specified profile file, merging it into the kernel's security policy. This is the correct method because AppArmor profiles are text files that must be parsed and loaded by the kernel's LSM (Linux Security Module) subsystem via this utility.

Answer

apparmor_load /path/to/profile

Answer

aa-load /path/to/profile

Answer

aa-status /path/to/profile

Question 5

A pod is created with the following security context:
securityContext:
  seccompProfile:
    type: Localhost
    localhostProfile: profiles/audit.json
Where must the 'audit.json' file be placed on the node?

Accepted Answer

/var/lib/kubelet/seccomp/profiles/audit.json. When a pod uses a `seccompProfile` of type `Localhost` with `localhostProfile: profiles/audit.json`, the file path is relative to the kubelet's seccomp root directory, which defaults to `/var/lib/kubelet/seccomp`. Therefore, the complete path on the node must be `/var/lib/kubelet/seccomp/profiles/audit.json`. This is the only location where the kubelet will look for the seccomp profile when `type: Localhost` is specified.

Answer

/etc/kubernetes/seccomp/profiles/audit.json

Answer

/var/lib/kubelet/audit.json

Answer

/var/lib/containerd/seccomp/audit.json

Question 6

A container runs as non-root and needs to perform operations that require CAP_SYS_PTRACE. Which YAML snippet correctly adds only this capability while following the principle of least privilege?

Accepted Answer

securityContext:
  capabilities:
    drop: ['ALL']
    add: ['SYS_PTRACE']. It first drops all capabilities with `drop: ['ALL']` and then explicitly adds only `SYS_PTRACE`, ensuring the container runs with the minimum privileges required. This follows the principle of least privilege by removing any inherited or default capabilities before granting only the needed one. In Kubernetes, capabilities are Linux kernel capabilities; dropping all and adding only what is necessary is the recommended security practice.

Answer

securityContext:
  capabilities:
    add: ['SYS_PTRACE']

Answer

securityContext:
  capabilities:
    drop: ['ALL']

Answer

securityContext:
  privileged: true

Question 7

Which Pod Security Standard level allows the use of hostNetwork, hostPID, and hostIPC?

Accepted Answer

Privileged. The Privileged Pod Security Standard (PSS) level is the most permissive, allowing unrestricted access to host-level resources, including hostNetwork, hostPID, and hostIPC. These settings grant the pod direct access to the host's network namespace, process table, and inter-process communication mechanisms, which are explicitly prohibited in the Baseline and Restricted levels. The Privileged level is designed for system-level workloads that require such elevated permissions, such as CNI plugins or monitoring agents.

Answer

None of the above

Answer

Baseline

Answer

Restricted

Question 8

Which of the following is the correct way to disable swap on a Kubernetes node to improve security?

Accepted Answer

Run 'swapoff -a' and remove swap entry from /etc/fstab. Disabling swap is a prerequisite for Kubernetes nodes to ensure kubelet works correctly with memory management and resource isolation. Running 'swapoff -a' disables all active swap devices immediately, and removing the swap entry from /etc/fstab prevents swap from being re-enabled after a reboot. This is the standard and complete method recommended by Kubernetes documentation for system hardening.

Answer

Set kernel parameter 'vm.swappiness=0'

Answer

Run 'systemctl stop swap'

Answer

Run 'kubelet --disable-swap'

Question 9

A custom seccomp profile is created at /var/lib/kubelet/seccomp/custom-profile.json. Which YAML snippet applies this profile to a container?

Accepted Answer

securityContext:
  seccompProfile:
    type: Localhost
    localhostProfile: custom-profile.json. When using a custom seccomp profile stored on the node, the `type: Localhost` field must be set, and the `localhostProfile` field specifies the filename (relative to the kubelet's seccomp root directory, which defaults to `/var/lib/kubelet/seccomp`). This configuration tells the container runtime to load the profile from the node's filesystem at the path `/var/lib/kubelet/seccomp/custom-profile.json`.

Answer

securityContext:
  seccompProfile:
    type: Unconfined

Answer

securityContext:
  seccompProfile:
    type: RuntimeDefault
    localhostProfile: custom-profile.json

Answer

securityContext:
  seccomp:
    profile: custom-profile.json

Question 10

An admin wants to check which AppArmor profiles are loaded. Which command should they run?

Accepted Answer

aa-status. The `aa-status` command is the standard tool for displaying the status of AppArmor, including which profiles are loaded, their enforcement mode (enforce/complain), and process confinement. It queries the AppArmor security module directly via the kernel interface, making it the correct and most comprehensive command for this task.

Answer

apparmor list

Answer

seccomp-status

Answer

ls /sys/kernel/security/apparmor/profiles

Question 11

Which THREE of the following are best practices for reducing the attack surface of a Kubernetes node?

Accepted Answer

Run containers with non-root user and drop all capabilities. Option A is correct because running containers as a non-root user and dropping all Linux capabilities (e.g., via securityContext runAsNonRoot: true and capabilities.drop: ["ALL"]) prevents a compromised container from gaining root privileges or abusing kernel capabilities on the node. Option C is correct because disabling unneeded host services such as Bluetooth (bluetooth.service) and ModemManager (ModemManager.service) removes daemons and attack vectors that are irrelevant to a Kubernetes node's role. Option E is correct because a read-only root filesystem (securityContext readOnlyRootFilesystem: true) blocks attackers from writing malicious binaries or modifying files inside the container, limiting persistence and lateral movement. Option B is not a best practice as stated: installing all available packages increases the attack surface, whereas the correct practice is to apply security patches and keep the installed package set minimal. Option D is not a best practice because removing SSH access from all nodes eliminates a legitimate administrative and troubleshooting channel; SSH should instead be restricted, key-based, and network-limited rather than universally removed.

Answer

Install all available security patches and packages

Answer

Remove SSH access from all nodes

Question 12

Which TWO of the following are valid AppArmor profile modes?

Accepted Answer

Complain. Option A, Complain mode, is correct because AppArmor profiles can be set to complain (also called learning) mode, in which policy violations are logged but not blocked, allowing administrators to test and refine profiles. Option B, Enforce mode, is correct because it is the standard operational mode where the profile's rules are actively applied and violations are denied and logged. The unmarked options do not belong: Audit is not a profile mode (auditing is a logging behavior that occurs within complain or enforce modes), Disable is not a mode but rather the state of having no profile loaded or the profile removed, and Permissive is not an AppArmor term — it is the terminology used by SELinux, while AppArmor's equivalent is Complain.

Answer

Audit

Answer

Disable

Answer

Permissive

Question 13

An administrator wants to enforce a custom AppArmor profile named 'k8s-apparmor-example' on a pod. The profile has been loaded on the node. Which annotation should be added to the pod's metadata to apply this profile?

Accepted Answer

container.apparmor.security.beta.kubernetes.io/nginx: localhost/k8s-apparmor-example. The annotation format for applying an AppArmor profile to a container in a pod is `container.apparmor.security.beta.kubernetes.io/<container_name>`. The value `localhost/k8s-apparmor-example` specifies that the profile named `k8s-apparmor-example` is loaded locally on the node. This annotation enforces the profile on the container named 'nginx'.

Answer

container.apparmor.security.beta.kubernetes.io/pod: localhost/k8s-apparmor-example

Answer

apparmor.security.beta.kubernetes.io/pod: k8s-apparmor-example

Answer

container.apparmor.security.beta.kubernetes.io/nginx: k8s-apparmor-example

Question 14

Which command is used to load an AppArmor profile into the kernel?

Accepted Answer

apparmor_parser. The `apparmor_parser` command is used to load AppArmor profiles into the kernel by parsing the profile file and adding it to the kernel's security module. This is the standard utility for loading, reloading, and removing AppArmor profiles, making option B correct.

Answer

aa-status

Answer

aa-load

Answer

aa-enforce

Question 15

A container is running with the following securityContext:

securityContext:
  capabilities:
    drop: ["ALL"]
    add: ["NET_BIND_SERVICE"]

Which capabilities will the container have?

Accepted Answer

Only NET_BIND_SERVICE. The securityContext first drops all capabilities with `drop: ["ALL"]`, which removes every capability from the container's bounding set. Then `add: ["NET_BIND_SERVICE"]` adds back only that single capability. Therefore, the final effective set is exactly `NET_BIND_SERVICE`, making option B correct.

Answer

All capabilities except NET_BIND_SERVICE

Answer

No capabilities

Answer

All default capabilities plus NET_BIND_SERVICE