An attacker with read access to a Kubernetes cluster's etcd database wants to compromise node-level runtimes. What high-value secret stored within etcd presents the most immediate risk of allowing cluster-wide node takeover if extracted?
An administrator wishes to adhere to the principle of least privilege regarding pod service accounts. How should a Pod that does not need to interact with the Kubernetes API server be configured?
An adversary successfully compromises a workload and extracts the default service account token. By default, what permission level does this unconfigured service account token possess in modern Kubernetes clusters?
A Kubernetes cluster experiences an attack where an untrusted pod attempts to access the Kubernetes API server and discover cluster secrets. The cluster uses RBAC. What is the mechanism that prevents this pod from reading secrets in other namespaces?
A security engineer is performing a threat analysis on a Kubernetes cluster and identifies a risk where a compromised container can exhaust the available CPU and memory on the underlying worker node, causing a denial of service for other tenants. Which native Kubernetes admission mechanism is specifically designed to mitigate this threat vector?
During a supply chain security audit, a platform engineer discovers that container images deployed into the cluster are being pulled from public registries without cryptographic verification of their provenance or integrity. Which integrated Kubernetes security control should be implemented alongside an admission webhook to verify image signatures before admission?
A developer accidentally hardcodes a database password directly into a container's environment variables within a Deployment manifest. According to the Kubernetes threat model, what is the primary risk associated with storing plaintext secrets as environment variables?
A platform team runs a multi-tenant Kubernetes cluster. A tenant's pod is compromised and the attacker executes code inside the container. The cluster uses the default Kubernetes RBAC configuration, and no NetworkPolicies are defined in the tenant namespace. The attacker's goal is to enumerate other pods and services in the cluster. Which action would the attacker most likely perform first to expand their view of the cluster?
An auditor is evaluating the Kubernetes control plane attack surface. Which component exposes the primary interface for cluster management and must be protected with strong authentication and authorization?
A cluster administrator wants to mitigate supply chain risks stemming from vulnerable base images used by developers. Where in the software lifecycle should vulnerability scanning ideally be integrated first to shift-left security?
In a zero-trust Kubernetes architecture, an attacker attempts to exploit the Kubernetes API server via a Server-Side Request Forgery (SSRF) flaw in a poorly written custom controller. Which defense-in-depth mechanism specifically protects against unauthorized API requests originating from inside the cluster network?
A security engineer is analyzing supply chain risks for container images. An unsigned image from an untrusted public registry is pulled into a secure cluster. Which Admission Controller plugin can be leveraged to prevent the deployment of unsigned container images?
A developer configures a Kubernetes Pod with `hostNetwork: true`. Under the STRIDE threat model, which threat category is most directly introduced or elevated by this configuration?
A security team discovers that an application container running as root has successfully mounted the host's Docker socket (`/var/run/docker.sock`). What is the primary attack vector enabled by this misconfiguration?
An administrator notices that a compromised Pod is attempting to access the cloud provider metadata service to retrieve IAM role credentials. Which native Kubernetes resource is best suited to block this specific attack vector at the network layer?
Which of the following represents a common cloud-native supply chain attack vector where malicious actors publish packages with names similar to popular libraries?
A security auditor reviews a Kubernetes cluster threat model and identifies that the Kubelet API on port 10250 permits unauthenticated requests if not configured properly. What authentication and authorization mode should be enforced on the Kubelet to prevent unauthorized remote code execution?
An organization wants to analyze potential threats to their Kubernetes cluster using the STRIDE model. Which STRIDE category maps to an attacker eavesdropping on unencrypted internal cluster traffic between pods?
A security engineer discovers that an attacker has gained access to a container and is attempting to modify container files in a way that persists across pod restarts if the container image is faulty. However, the root filesystem is marked as readOnlyRootFilesystem: true. What is the impact of this setting on the attack?
An attacker with compromised Kubernetes credentials attempts to hide malicious activity by deleting Kubernetes audit logs on the worker node. Where should audit logs ideally be stored and managed in a securely hardened cluster to prevent tampering and ensure non-repudiation?
Which attack vector involves tricking a Kubernetes cluster user or service into executing unintended actions via authenticated sessions, frequently mitigated by robust CSRF defenses and proper API design?
An attacker gains execution inside a container that has the `CAP_SYS_ADMIN` capability enabled and shares the host's IPC namespace. How does `CAP_SYS_ADMIN` facilitate container escape?
Which Kubernetes feature allows administrators to define mandatory security baselines, such as disallowing privileged containers, across an entire namespace or cluster?
A DevOps team uses mutable image tags like `:latest` in their deployment manifests. Under supply chain threat modeling, what vulnerability does this practice introduce?
An attacker with read access to Kubernetes Secrets inspects a secret containing TLS private keys. Under the STRIDE threat model, what specific threat category does this represent regarding confidentiality?
An engineer is reviewing the threat model of a Kubernetes cluster exposed to the public internet via a LoadBalancer service. Which configuration flaw most commonly leads to unintended external exposure of administrative dashboards?
An auditor notices that a cluster allows users to create Pods that mount host paths (`hostPath`). Which threat does this pose to the underlying node integrity?
An organization wants to prevent supply chain attacks where malicious code is injected into third-party Helm charts before deployment. What mitigation technique provides cryptographic verification of Helm chart integrity and authenticity?
A security engineer identifies that an enterprise Kubernetes cluster has several cluster-admin bindings granted to user accounts that have left the company. Which Kubernetes security principle has been violated?
An attacker gains execution in a container and attempts to perform a denial of service attack on other workloads sharing the same Kubernetes node by consuming all available CPU and memory resources. What Kubernetes feature prevents this cross-workload resource exhaustion?
An auditor is evaluating the security posture of an on-premises Kubernetes cluster. The team notices that the etcd data directory is stored without encryption at rest. What is the primary threat this exposes the cluster to?
An organization is building a secure software supply chain for Kubernetes. They want to ensure that containers running in the cluster were built from verified source code and passed automated security gates. Which tool combination supports this attestation and verification pipeline?
An attacker compromises a cluster node and attempts to inspect container communication. By default, how is pod-to-pod network traffic handled across different nodes in a standard Kubernetes cluster without a service mesh or CNI encryption enabled?
An organization is performing a STRIDE-based threat model on their Kubernetes deployment. Which TWO of the following threats map directly to the 'Tampering' category in a Kubernetes environment?
An administrator wishes to defend against supply chain attacks involving malicious third-party Kubernetes operators installed from public catalogs. What security practice is most effective before installing such operators?
An auditor evaluates network security controls in a Kubernetes cluster. Which TWO configurations help mitigate lateral movement and network-based attacks between pods?
An administrator needs to analyze the STRIDE threat model category that encompasses an attacker gaining unauthorized elevation of privilege inside a Kubernetes cluster by exploiting a misconfigured RBAC ClusterRoleBinding. Which threat category does this represent?
A security team is evaluating the attack surface of the Kubernetes control plane. They notice that the kubelet API port 10250 is accessible from the internal pod network without proper authorization checks if authentication defaults are misconfigured. What is the primary threat vector associated with an unauthenticated, accessible kubelet API?
An attacker who achieves remote code execution inside a misconfigured container discovers that the service account token mounted at /var/run/secrets/kubernetes.io/serviceaccount/token has cluster-wide administrative permissions. Which Kubernetes security feature should be enabled on the ServiceAccount to mitigate the risk of token theft and misuse?
A cluster administrator is conducting a threat analysis regarding supply chain vulnerabilities in container registries and deployment pipelines. Which TWO of the following practices directly mitigate supply chain threats in Kubernetes? (Choose TWO)
An auditor is reviewing the Kubernetes attack surface and notes that a container is running with privileged: true in its securityContext. Which threat model risk does this setting introduce?
An attacker manages to compromise a low-privilege pod inside a Kubernetes cluster and attempts to escalate privileges or pivot to other cluster components. Which THREE of the following misconfigurations or weaknesses would significantly aid the attacker's lateral movement or privilege escalation? (Choose THREE)
When modeling threats for a Kubernetes cluster using the STRIDE methodology, identifying scenarios where an attacker intercepts unencrypted traffic between worker nodes or between a client and the API server addresses which TWO STRIDE categories? (Choose TWO)
A security engineer is assessing the threat model of a Kubernetes cluster where the kubelet is configured with the flag --anonymous-auth=true. An attacker has network access to the node's kubelet port (10250). What is the most significant risk introduced by this configuration?