CCNA Platform Security Questions

Multi-Selecteasy

Which TWO practices are essential for securing container images against supply chain vulnerabilities? (Choose two)

Select 2 answers

A.Running all container processes as the root user by default

B.Disabling container registry authentication

C.Storing plain-text passwords inside image environment variables

D.Using minimal base images (e.g., Distroless or Alpine) to reduce attack surface

E.Scanning container images for known CVEs during the CI/CD pipeline

AnswersD, E

Minimal base images remove unnecessary shells and utilities, significantly reducing potential exploits.

Why this answer

Securing container images requires scanning images for known vulnerabilities and using minimal base images like Distroless or Alpine to reduce the attack surface.

Practice this question →

Multi-Selecteasy

Which TWO tasks are typically performed during container image vulnerability scanning? (Choose two)

Select 2 answers

A.Configuring ingress TLS certificates

B.Monitoring active Kubernetes node CPU utilization

C.Checking for insecure configuration settings or exposed secrets within image layers

D.Updating cluster network policies

E.Analyzing OS packages and application dependencies against known CVE databases

AnswersC, E

Scanners also detect embedded secrets (like API keys) and misconfigurations in Dockerfile instructions.

Why this answer

Vulnerability scanning inspects image layers and package managers to identify known CVEs and misconfigurations.

Practice this question →

Multi-Selecthard

Which THREE of the following practices are recommended when securing container images to prevent supply chain attacks in a Kubernetes environment? (Choose THREE)

Select 3 answers

A.Always run container processes as the root user (UID 0) to ensure maximum compatibility with host mounts.

B.Integrate automated vulnerability scanning into the CI/CD pipeline before pushing images to the container registry.

C.Disable container image pull policies entirely so nodes only rely on locally cached images.

D.Utilize minimal base images (such as distroless or Alpine) to reduce the potential attack surface and remove unnecessary package managers.

E.Reference images by their immutable cryptographic digest (SHA256) rather than mutable tags like latest.

AnswersB, D, E

Scanning images early in the pipeline prevents vulnerable software packages from reaching production registries.

Why this answer

Securing container images involves pinning image digests instead of relying solely on mutable tags, scanning images for known vulnerabilities prior to deployment, and running containers as non-root users.

Practice this question →

Multi-Selecteasy

Which TWO security features are provided by modern container runtimes like containerd or CRI-O? (Choose two)

Select 2 answers

A.Integration with Linux security modules (Seccomp, AppArmor, SELinux)

B.Management of Kubernetes RBAC roles and cluster permissions

C.Namespace isolation (PID, network, mount, user namespaces) for containers

D.Automatic deployment of service mesh sidecar proxies

E.Automatic generation of Kubernetes Ingress TLS certificates

AnswersA, C

Container runtimes interface with LSMs to enforce system call filtering and access controls.

Why this answer

Modern container runtimes provide security features such as namespace isolation and integration with Linux security modules like seccomp and AppArmor.

Practice this question →

MCQeasy

An auditor is reviewing container image registries used by a Kubernetes cluster. They notice that public images are pulled directly without verification. Which security best practice should be implemented for image registries?

A.Grant cluster-admin permissions to all developers

B.Store plaintext passwords in ConfigMaps

C.Disable all network policies in the cluster

D.Use private registries with integrated vulnerability scanning and image pull policies

AnswerD

Private registries with vulnerability scanning ensure images are checked and controlled before deployment.

Why this answer

Using private, trusted container registries with vulnerability scanning and access control helps ensure that only approved and secure images are deployed.

Practice this question →

MCQhard

An enterprise cluster utilizes a service mesh with AuthorizationPolicies. You need to configure a policy that allows GET requests from service A to service B while explicitly denying DELETE requests on all paths. How are Istio AuthorizationPolicies evaluated when both allow and deny rules are present?

A.Only the most recently created authorization policy is evaluated

B.DENY rules take precedence and are evaluated before ALLOW rules

C.ALLOW rules take precedence and override any DENY rules

D.Rules are evaluated in alphabetical order of their object names

AnswerB

Istio evaluates DENY rules before ALLOW rules to ensure strict security guardrails take effect immediately.

Why this answer

Istio AuthorizationPolicies evaluate DENY rules first, followed by ALLOW rules. If a request matches a DENY rule, it is immediately rejected regardless of any matching ALLOW rules.

Practice this question →

MCQmedium

An administrator notices that a container in a Kubernetes cluster running containerd is attempting to write files to the root filesystem (/), which should be strictly immutable. Which configuration in the Pod's securityContext should be enforced to prevent this?

A.Set securityContext.allowPrivilegeEscalation to false

B.Set securityContext.readOnlyRootFilesystem to true

C.Set securityContext.privileged to false

D.Add the SYS_ADMIN capability to securityContext.capabilities.drop

AnswerB

This correctly enforces a read-only root filesystem, requiring explicit volume mounts for any writable paths.

Why this answer

Setting readOnlyRootFilesystem to true in the securityContext ensures that the container's root file system is mounted as read-only, preventing runtime tampering or unauthorized file writes.

Practice this question →

Multi-Selectmedium

Which TWO features are typically provided by service mesh architectures to enhance platform security? (Choose two)

Select 2 answers

A.Automatic kernel patch management for worker nodes

B.Fine-grained Layer 7 authorization policies between services

C.Provisioning of persistent block storage volumes

D.Automatic mutual TLS (mTLS) encryption for pod-to-pod communication

E.Managing container registry authentication tokens

AnswersB, D

Service meshes allow operators to define rules specifying which services can communicate and invoke specific methods.

Why this answer

Service meshes enhance security primarily by providing mutual TLS (mTLS) for workload encryption and fine-grained authorization policies.

Practice this question →

MCQhard

You are configuring an Ingress resource using the NGINX Ingress Controller to expose a sensitive internal application. To prevent unauthorized clients from connecting, you want to enable mutual TLS authentication at the ingress layer. Which annotation is required in the Ingress resource definition to specify the Kubernetes Secret containing the trusted Client CA certificate?

A.ingress.kubernetes.io/backend-protocol

B.nginx.ingress.kubernetes.io/auth-tls-secret

C.kubernetes.io/ingress.class

D.nginx.ingress.kubernetes.io/ssl-redirect

AnswerB

This specific annotation tells the NGINX Ingress controller which secret contains the CA certificate for validating client certificates.

Why this answer

The NGINX ingress controller uses specific annotations such as 'nginx.ingress.kubernetes.io/auth-tls-secret' to point to the Kubernetes secret containing the CA certificate used to verify client certificates.

Practice this question →

MCQmedium

You need to ensure that an ingress controller processing TLS termination uses strong cryptographic ciphers and disables outdated protocols such as TLSv1.0 and TLSv1.1. Where are these TLS configuration settings typically managed in an NGINX Ingress deployment?

A.Ingress controller ConfigMap parameters such as ssl-ciphers and ssl-protocols

B.The core DNS configuration map

C.The kube-apiserver static pod manifest file

D.Persistent Volume Claim storage classes

AnswerA

Global TLS ciphers and protocols are configured via the NGINX Ingress controller's ConfigMap.

Why this answer

NGINX Ingress Controllers allow global configuration of SSL parameters, ciphers, and protocols via ConfigMap settings or specific ingress annotations.

Practice this question →

MCQhard

An enterprise Kubernetes cluster uses a service mesh with strict authorization policies configured. A developer complains that their frontend service cannot communicate with the backend database service. Upon inspecting the mesh configuration, you notice a PeerAuthentication resource set to STRICT mode. What does this setting enforce?

A.Pod security standards must be enforced at the baseline level

B.Network policies must block all traffic from outside the namespace

C.All external ingress traffic must pass through a Web Application Firewall

D.All incoming traffic to the targeted workloads must use mutual TLS encryption

AnswerD

STRICT mode rejects all plaintext connections and requires all incoming traffic to be encrypted via mTLS.

Why this answer

In a service mesh like Istio, setting PeerAuthentication to STRICT mode requires all incoming traffic to workloads in that scope to use mutual TLS (mTLS).

Practice this question →

Multi-Selectmedium

Which TWO actions should be taken when an image vulnerability scanner reports a critical CVE in a running production container? (Choose two)

Select 2 answers

A.Scale the vulnerable deployment replicas to maximum capacity

B.Rebuild the container image with updated base image or patched software packages

C.Redeploy the updated, patched image across the cluster workloads

D.Change all Kubernetes service account tokens to anonymous mode

E.Delete all Kubernetes NetworkPolicies to allow emergency patching traffic

AnswersB, C

Updating vulnerable packages and rebuilding the image is the primary remediation step.

Why this answer

When a critical CVE is found, the image should be rebuilt with patched dependencies and redeployed, and runtime security tools should be checked for anomalous behavior.

Practice this question →

MCQeasy

What role does image scanning play in a shift-left security strategy for platform security?

A.Detecting vulnerabilities and misconfigurations in container images during development and CI/CD

B.Automatically encrypting secrets stored in etcd

C.Generating TLS certificates for ingress controllers

D.Enforcing role-based access control policies

AnswerA

Scanning images early helps developers fix security issues before code reaches production environments.

Why this answer

Shift-left security moves security checks earlier in the development lifecycle, allowing teams to identify and fix image vulnerabilities before deployment.

Practice this question →

MCQhard

An administrator wants to ensure that containers cannot execute any system calls related to module loading or debugging, such as 'init_module' or 'kexec_load'. Which security mechanism in Kubernetes allows applying a predefined system call filter to containers?

A.Pod Disruption Budgets

B.Kubernetes NetworkPolicies

C.ResourceQuotas

D.Seccomp profiles

AnswerD

Seccomp profiles allow or disallow specific system calls to restrict container capabilities and enhance isolation.

Why this answer

Seccomp (Secure Computing Mode) filters system calls made by a container, allowing administrators to block dangerous calls like module loading.

Practice this question →

MCQeasy

A security administrator wants to prevent container processes from writing to any part of their root filesystem except for designated ephemeral volumes. Which security context field should be configured?

A.runAsUser: 1000

B.readOnlyRootFilesystem: true

C.allowPrivilegeEscalation: false

D.privileged: false

AnswerB

This setting makes the container's root filesystem read-only, preventing unauthorized file modifications.

Why this answer

Setting 'readOnlyRootFilesystem: true' in the container's security context makes the root filesystem read-only, enhancing security by preventing attackers from modifying binaries or writing malware.

Practice this question →

Multi-Selectmedium

Which TWO mechanisms are commonly used by container runtime security tools to monitor container activity? (Choose two)

Select 3 answers

A.eBPF (Extended Berkeley Packet Filter) programs attached to kernel tracepoints

B.Kubernetes persistent volume snapshotting

C.Kubernetes Horizontal Pod Autoscaler metrics collection

D.Linux Security Modules (LSM) such as SELinux, AppArmor, or seccomp

E.CoreDNS query log analysis

AnswersA, C, D

eBPF provides high-performance, non-intrusive observation of system calls and network events.

Why this answer

Modern container runtime security tools monitor container behavior using Linux kernel tracing mechanisms such as eBPF and kernel modules or security hooks.

Practice this question →

MCQeasy

What is the primary purpose of vulnerability scanning databases (such as Trivy, Grype, or Clair) when integrated into a container platform?

A.To match package versions inside container images against known CVE databases and report vulnerabilities

B.To enforce network microsegmentation rules

C.To balance incoming web traffic across backend replicas

D.To automatically rotate cluster TLS certificates

AnswerA

Vulnerability databases match installed software versions against known CVE records to alert operators to security risks.

Why this answer

Vulnerability scanners match installed package versions in container images against known CVE databases to identify security flaws.

Practice this question →

MCQeasy

What is the primary function of a container runtime interface (CRI) security boundary in Kubernetes?

A.To provision persistent block storage volumes

B.To manage DNS lookups across cluster namespaces

C.To separate the management of container lifecycles from the kubelet while maintaining isolation

D.To encrypt all secrets stored within Kubernetes Secrets objects

AnswerC

The CRI standardizes the communication between kubelet and container runtimes, ensuring secure management of container creation and execution.

Why this answer

The CRI acts as the interface between the kubelet and the container runtime (such as containerd or CRI-O), ensuring that container isolation and execution are managed securely.

Practice this question →

MCQeasy

An administrator needs to enforce mTLS (Mutual TLS) across all microservices within a service mesh without modifying application code. Which component is automatically injected into each application pod to handle the encryption and decryption of traffic?

A.Container runtime shim

B.Kube-proxy

C.Ingress controller

D.Sidecar proxy

AnswerD

The sidecar proxy intercepts network traffic and handles mTLS encryption and policy enforcement transparently.

Why this answer

Service meshes like Istio or Linkerd inject a sidecar proxy (typically Envoy) into application pods to intercept all incoming and outgoing traffic and handle mTLS transparently.

Practice this question →

MCQeasy

A platform engineer wants to configure a container runtime security tool that monitors system calls and sends alerts about potential threats in a Kubernetes cluster. Which component of the container runtime architecture intercepts these system calls?

A.eBPF kernel probes

B.The coreDNS plugin

C.The Kubernetes storage controller

D.The kube-apiserver admission webhook

AnswerA

eBPF allows safe execution of programs in the Linux kernel space to capture system calls and monitor runtime behavior efficiently.

Why this answer

The Linux kernel relies on security modules and tracing mechanisms, while the container runtime uses interfaces like seccomp or Linux Security Modules (LSM) to interact with the kernel. Container runtime monitors often use eBPF programs attached to kernel tracepoints to observe system calls without modifying the kernel.

Practice this question →

MCQeasy

Your organization requires that all container images deployed to the production cluster must be scanned for known Common Vulnerabilities and Exposures (CVEs) before admission. Which component in a cloud-native architecture is primarily responsible for intercepting and blocking deployments if a vulnerability threshold is exceeded?

A.The Kubernetes Scheduler

B.An Admission Controller webhook

C.The kube-proxy daemonset

D.The container runtime (e.g., containerd)

AnswerB

Admission controllers intercept requests to the Kubernetes API server to validate or mutate resources, making them ideal for enforcing image vulnerability policies.

Why this answer

An Admission Controller (such as an OPA/Gatekeeper validating webhook or a specialized image scanning admission webhook) intercepts API requests to the Kubernetes API server and can reject the deployment of vulnerable images.

Practice this question →

MCQeasy

When configuring a Pod to run securely, which setting in the container's securityContext should be used to explicitly drop all default Linux capabilities and only retain required ones?

A.capabilities.drop: ["ALL"]

B.runAsNonRoot: true

C.capabilities.add: ["ALL"]

D.privileged: true

AnswerA

Dropping 'ALL' capabilities removes all Linux capabilities, adhering to the principle of least privilege.

Why this answer

The capabilities.drop field allows administrators to drop specific Linux capabilities (or 'ALL'), reducing the attack surface by removing root-like privileges from the container process.

Practice this question →

MCQeasy

When configuring a container to run securely in a Kubernetes cluster, you want to ensure that the container process cannot gain any new privileges during its lifecycle, even if it runs as root or exploits a setuid binary. Which Linux kernel feature should be enabled in the container security context?

A.readOnlyRootFilesystem: false

B.allowPrivilegeEscalation: false

C.privileged: true

D.runAsNonRoot: false

AnswerB

Setting allowPrivilegeEscalation to false ensures that child processes cannot gain more privileges than their parent process.

Why this answer

The 'allowPrivilegeEscalation' field in the security context controls whether a process can gain more privileges than its parent, which maps directly to the Linux PR_SET_NO_NEW_PRIVS kernel flag.

Practice this question →

Multi-Selectmedium

Which TWO methods can be used to restrict network traffic between services inside a service mesh? (Choose two)

Select 2 answers

A.Modifying CoreDNS forwarding upstream servers

B.PeerAuthentication resources enforcing STRICT mTLS mode between workloads

C.Configuring Horizontal Pod Autoscalers

D.Kubernetes PersistentVolumeClaim storage resize operations

E.Istio AuthorizationPolicy resources specifying allowed source principals and methods

AnswersB, E

PeerAuthentication ensures that traffic between workloads is encrypted and authenticated via mTLS.

Why this answer

Service mesh traffic is restricted using AuthorizationPolicies for Layer 7 access control and PeerAuthentication for transport encryption requirements.

Practice this question →

MCQeasy

Why should container images be built using multi-stage builds in Dockerfiles from a security perspective?

A.They encrypt the container image layer storage in the registry

B.They automatically enable kernel-level eBPF monitoring

C.They exclude build-time tools, package managers, and source code from the final production image, reducing attack surface

D.They enforce mTLS encryption for all container network traffic

AnswerC

Removing unnecessary build tools and source code significantly shrinks the container image attack surface.

Why this answer

Multi-stage builds allow developers to copy only the compiled binary and essential runtime dependencies into the final image, excluding build tools, package managers, and source code.

Practice this question →

MCQhard

A platform engineer is hardening a container runtime setup on worker nodes. They want to ensure that containers cannot make unauthorized changes to network configurations or mount host filesystems. Which capability must be explicitly dropped from the default container capabilities set?

A.CAP_CHOWN

B.CAP_NET_BIND_SERVICE

C.CAP_SYS_ADMIN

D.CAP_DAC_OVERRIDE

AnswerC

CAP_SYS_ADMIN is a powerful capability often referred to as the root-equivalent capability for system administration tasks and should be dropped.

Why this answer

The 'CAP_SYS_ADMIN' capability grants a broad range of administrative privileges, including mounting filesystems and modifying kernel parameters, and should be dropped in hardened environments.

Practice this question →

MCQhard

A security engineer is configuring a seccomp profile for a critical application pod running in a hardened Kubernetes cluster to restrict system calls. The pod requires access to the networking stack but must block module loading. Where must this custom JSON seccomp profile be placed on a worker node running containerd so that it can be referenced via the pod security spec?

A./var/log/containers/

B./etc/kubernetes/manifests/

C./var/lib/kubelet/seccomp/

D./etc/containerd/certs.d/

AnswerC

Kubelet and container runtimes look for localhost seccomp profiles relative to the kubelet root directory's seccomp folder.

Why this answer

Container runtime implementations like containerd look for custom seccomp profiles relative to the kubelet root directory, specifically inside the seccomp subdirectory (e.g., /var/lib/kubelet/seccomp/).

Practice this question →

MCQmedium

You are configuring an Ingress object with TLS termination. The TLS certificate and private key are stored in a Kubernetes Secret. Which specific secret type must be used to ensure the ingress controller recognizes and validates the TLS credentials correctly?

A.kubernetes.io/tls

B.kubernetes.io/service-account-token

C.Opaque

D.kubernetes.io/dockerconfigjson

AnswerA

The 'kubernetes.io/tls' secret type is specifically designed for storing TLS certificates and private keys.

Why this answer

Kubernetes expects TLS-related secrets used by Ingress or other components to be of type 'kubernetes.io/tls', containing 'tls.crt' and 'tls.key' data keys.

Practice this question →

MCQhard

An organization mandates that all traffic entering the service mesh must be decrypted at the ingress gateway, inspected by a Web Application Firewall (WAF), and then re-encrypted using mTLS before reaching backend pods. What is this architectural pattern called within service mesh security?

A.HTTP plaintext tunneling

B.Pod security standard restriction

C.DNS-based load balancing

D.TLS re-encryption (or edge termination with backend mTLS)

AnswerD

TLS re-encryption terminates incoming TLS at the gateway and establishes a fresh secure mTLS connection to the backend.

Why this answer

Re-encryption (or TLS origination/re-encryption) is the pattern where traffic is terminated at an edge proxy and then a new TLS connection is established to the internal backend service.

Practice this question →

MCQhard

You are configuring a runtime security agent that uses Falco to detect unexpected shell execution inside containers. The security rule triggers when a process spawns a shell binary (e.g., bash or sh) inside a container namespace. Which underlying Linux kernel mechanism allows Falco to detect this event with minimal overhead?

A.Periodic polling of container logs using kubectl logs

B.eBPF system call tracing and kernel event capture

C.Analyzing CoreDNS lookup history

D.Inspecting etcd database keys every second

AnswerB

eBPF allows Falco to monitor system calls efficiently at the kernel level without performance penalties of context switching.

Why this answer

Falco uses kernel modules or eBPF probe drivers to capture system calls and event streams from the Linux kernel, matching them against a rules engine to detect anomalous behavior.

Practice this question →

Multi-Selecthard

Which THREE advanced container runtime or image security features help prevent container breakout exploits? (Choose three)

Select 3 answers

A.Using sandboxed container runtimes (such as Kata Containers or gVisor) for strong isolation

B.Running all containers in privileged mode

C.Mounting host /proc and /sys directories in read-write mode

D.Applying restrictive Seccomp profiles to block sensitive system calls

E.Dropping dangerous capabilities like CAP_SYS_ADMIN, CAP_NET_RAW, and CAP_SYS_PTRACE

AnswersA, D, E

Sandboxed runtimes provide a hardware virtualization or user-space kernel layer between containers and the host.

Why this answer

Container breakouts are mitigated by dropping unnecessary capabilities, enforcing seccomp profiles, and using secure container runtimes or sandboxed runtimes like gVisor.

Practice this question →

MCQhard

You are troubleshooting a service mesh traffic split policy where telemetry shows that unauthorized external clients are bypassing the service mesh ingress gateway and directly accessing backend services via NodePort services. Which Kubernetes feature should you configure to prevent direct NodePort access to these sensitive pods?

A.Enabling anonymous authentication in kube-apiserver

B.Changing the service type from NodePort to ClusterIP

C.Increasing the API server request rate limit

D.NetworkPolicies restricting pod ingress traffic exclusively to the service mesh gateway pod selector

AnswerD

NetworkPolicies ensure that pods only accept traffic from authorized sources such as the ingress gateway.

Why this answer

Kubernetes NetworkPolicies can be configured to restrict incoming traffic to backend pods so that they only accept connections originating from the ingress gateway pod selectors, blocking direct NodePort access.

Practice this question →

Multi-Selecthard

Which THREE configurations should be applied to a Kubernetes Pod Security Standard 'restricted' profile compliance checklist? (Choose three)

Select 3 answers

A.Allowing privileged: true for all application containers

B.Restricting container capabilities to drop ALL and only permit essential ones like NET_BIND_SERVICE

C.Setting allowPrivilegeEscalation to false in the container securityContext

D.Mounting the host root filesystem in read-write mode

E.Requiring runAsNonRoot to be true

AnswersB, C, E

Restricted profiles require dropping all default capabilities except optionally NET_BIND_SERVICE.

Why this answer

The Restricted Pod Security Standard requires running as non-root, disabling privilege escalation, and restricting dangerous capabilities.

Practice this question →

MCQmedium

An organization requires that all container images pulled into a Kubernetes cluster are cryptographically signed and verified before execution. Which tool integrates with Kubernetes admission control to enforce signature verification using Cosign?

A.Cilium CNI plugin

B.Metrics-server

C.Kyverno policy engine

D.Helm package manager

AnswerC

Kyverno supports native image verification rules using Cosign signatures and public keys.

Why this answer

Policy engines such as Kyverno or OPA Gatekeeper integrate with Sigstore Cosign to verify container image signatures during admission control.

Practice this question →

MCQmedium

A security engineer wants to inspect container runtime logs for potential security violations or runtime errors. Which log file or mechanism on a worker node managed by systemd and containerd provides container lifecycle events?

A.kubectl get events --all-namespaces

B.journalctl -u containerd

C./var/log/coredns.log

D./var/log/kube-apiserver.log

AnswerB

Containerd runs as a systemd service, so its logs and runtime messages are captured by journalctl.

Why this answer

In Kubernetes nodes managed by systemd, containerd logs its activities and container lifecycle events to the systemd journal, which can be queried using journalctl.

Practice this question →

MCQmedium

An Ingress controller is deployed in a cluster, and security auditors request that incoming traffic must be restricted to specific trusted external CIDR blocks. Which standard Ingress annotation is commonly supported by popular Ingress controllers (such as ingress-nginx) to achieve IP-based allowlisting?

A.ingress.kubernetes.io/allowed-source-cidrs

B.networking.k8s.io/ip-filter

C.nginx.ingress.kubernetes.io/whitelist-source-range

D.kubernetes.io/ingress.allow-ips

AnswerC

This is the correct ingress-nginx annotation used to define allowed source IP ranges for incoming traffic.

Why this answer

Popular Ingress controllers like ingress-nginx support annotations such as nginx.ingress.kubernetes.io/whitelist-source-range to restrict access to specified client IP CIDRs.

Practice this question →

MCQmedium

Your team is implementing image caching and proxying to protect against external container registry rate limits and security incidents. Which upstream project acts as a CNCF-compliant registry proxy and caching mechanism?

A.Harbor

B.Fluentd

C.Jaeger

D.Prometheus

AnswerA

Harbor is a CNCF artifact registry that provides security features like vulnerability scanning, signing, and proxy caching.

Why this answer

Harbor is an open-source, CNCF-graded cloud-native registry that stores, signs, and scans content with vulnerability management and proxy caching features.

Practice this question →

MCQmedium

A security engineer is hardening a Kubernetes cluster and wants to ensure that all container images are pulled only from an approved internal container registry (e.g., registry.internal.corp). Which Kubernetes mechanism can enforce this restriction across all namespaces?

A.Deploying a validating admission policy or webhook to check image registry URLs

B.Configuring NodePort service selectors

C.Enabling horizontal pod autoscaling

D.Modifying the kube-proxy IPVS configuration

AnswerA

Validating admission webhooks can inspect pod specs and reject pods using images from unauthorized registries.

Why this answer

Admission webhook policy engines like Kyverno or OPA Gatekeeper can intercept creation requests and validate that the image URL matches the approved registry domain prefix.

Practice this question →

MCQeasy

What is the primary security benefit of implementing Ingress TLS termination at the ingress controller rather than inside the application pods?

A.Automatically encrypting persistent volume storage

B.Centralized certificate management and reduced cryptographic overhead on application pods

C.Preventing the container runtime from executing untrusted binaries

D.Ensuring that all pod-to-pod communication is blocked

AnswerB

Centralizing TLS termination simplifies certificate renewal and protects backend pods from TLS processing overhead.

Why this answer

Terminating TLS at the ingress controller centralizes certificate management and offloads cryptographic overhead from the backend application pods.

Practice this question →

MCQmedium

An external penetration tester managed to achieve remote code execution inside a container. They attempt to query the Kubernetes API server using the service account token mounted inside the container. To minimize the blast radius of such an attack, which setting should be explicitly configured on the Pod spec?

A.shareProcessNamespace: false

B.automountServiceAccountToken: false

C.hostIPC: false

D.hostNetwork: false

AnswerB

Disabling automatic service account token mounting ensures pods that do not need to interact with the Kubernetes API server lack credentials inside the container filesystem.

Why this answer

Setting automountServiceAccountToken to false prevents Kubernetes from automatically mounting the service account API credentials into the container, effectively blocking unauthorized local API access if the container is compromised.

Practice this question →

MCQmedium

You are troubleshooting a container image vulnerability scan report that flagged a high-severity CVE in a base image layer. The development team wants to ensure that vulnerable container images are automatically prevented from being deployed to any namespace in the cluster. Which Kubernetes mechanism should you implement?

A.Enable resource quotas on the default namespace

B.Rotate the cluster certificate authority

C.Add network policies to restrict outbound CVE database queries

D.Configure a validating admission webhook to inspect image metadata and reject deployments with known CVEs

AnswerD

Validating admission webhooks can block pods that use images with unresolved vulnerabilities.

Why this answer

An admission controller, specifically a validating webhook or a policy engine like OPA Gatekeeper or Kyverno, can intercept image creation requests and block images that fail vulnerability checks.

Practice this question →

Multi-Selecthard

Which THREE mechanisms are used in a zero-trust platform security model for cloud-native applications? (Choose three)

Select 3 answers

A.Granting cluster-admin permissions to all application service accounts

B.Implementing microsegmentation via Kubernetes NetworkPolicies and service mesh auth policies

C.Enforcing mutual TLS (mTLS) for all internal service-to-service communications

D.Applying strict admission webhook policies to validate workloads before creation

E.Assuming internal cluster networks are fully secure and trusting all pods by default

AnswersB, C, D

Microsegmentation restricts lateral movement by explicitly defining allowed network paths.

Why this answer

A zero-trust model relies on continuous verification, including mutual TLS encryption, strict admission controls, and principle of least privilege via network and authorization policies.

Practice this question →

Multi-Selectmedium

Which TWO components are involved when an Ingress controller routes external HTTPS traffic to a backend service in Kubernetes? (Choose two)

Select 2 answers

A.The kube-apiserver etcd storage backend encryption key

B.The coreDNS server managing TLS private keys

C.The persistent volume CSI controller

D.The Ingress resource object defining routing rules and TLS hosts

E.The Ingress Controller pod implementing the reverse proxy logic

AnswersD, E

The Ingress resource specifies the routing rules, hostnames, and TLS secret mappings.

Why this answer

Ingress routing involves the Ingress resource defining routing rules and the Ingress Controller (such as NGINX or Traefik) implementing those rules and terminating TLS.

Practice this question →

MCQmedium

An administrator needs to configure an Ingress resource to route traffic securely to a backend service using HTTPS (TLS between the ingress controller and the backend pod). Which NGINX Ingress annotation enables this backend HTTPS communication?

A.nginx.ingress.kubernetes.io/ssl-redirect: "true"

B.nginx.ingress.kubernetes.io/proxy-connect-timeout

C.nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"

D.nginx.ingress.kubernetes.io/cors-allow-origin

AnswerC

This annotation informs the NGINX Ingress controller to use HTTPS when proxying traffic to backend pods.

Why this answer

The NGINX Ingress controller supports annotations like 'nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"' to instruct the proxy to communicate with backend pods over HTTPS.

Practice this question →

MCQhard

An administrator needs to restrict a container from accessing any devices on the host system via device nodes. By default, how does Docker or containerd handle device access for containers when no custom security profile is applied?

A.By disabling all system calls related to file I/O

B.By routing all device access requests through kube-proxy

C.By applying a default device allowlist that restricts access to essential devices like /dev/null and /dev/random

D.By mounting the entire host /dev directory in read-write mode

AnswerC

Container runtimes apply a restrictive default device cgroup policy permitting only basic safe devices.

Why this answer

Container runtimes like containerd and Docker apply a default set of cgroups and device rules that restrict access, but can be further locked down using device plugins or cgroup rules.

Practice this question →

MCQeasy

Why is running containers as the root user discouraged in Kubernetes platform security best practices?

A.It prevents the kubelet from starting the pod

B.It disables network policy enforcement

C.It stops container image vulnerability scanning

D.It increases the impact of potential container breakout or compromise by granting root privileges inside the container

AnswerD

Running as non-root limits the potential damage an attacker can do if they compromise the container application.

Why this answer

Running as root inside a container means that if an attacker achieves container escape or remote code execution, they may have elevated privileges on the host or inside the container namespace.

Practice this question →

Multi-Selecteasy

Which TWO actions help secure Ingress traffic in a Kubernetes cluster? (Choose two)

Select 2 answers

A.Exposing all internal debugging endpoints via unencrypted HTTP on port 80

B.Enforcing TLS termination with strong cipher suites and valid certificates

C.Disabling all authentication mechanisms at the ingress gateway

D.Restricting ingress controller exposure and using Web Application Firewalls (WAF)

E.Storing TLS private keys in plaintext ConfigMaps

AnswersB, D

TLS encryption protects data in transit between clients and the ingress controller.

Why this answer

Securing ingress traffic involves enforcing TLS encryption for all incoming web traffic and restricting ingress access using appropriate firewall or network policies.

Practice this question →

MCQhard

A platform engineer needs to secure an Ingress resource using TLS termination, ensuring that sensitive private keys are stored securely within the cluster and referenced safely. Which Kubernetes resource should be created to store the TLS certificate and private key pair?

A.Secret of type kubernetes.io/tls

B.PersistentVolumeClaim

C.CertificateSigningRequest

D.ConfigMap

AnswerA

The kubernetes.io/tls secret type standardizes the storage of tls.crt and tls.key fields for Ingress and other components.

Why this answer

Kubernetes Secrets of type kubernetes.io/tls are specifically designed to store TLS certificates and private keys securely, allowing them to be referenced directly within the Ingress spec.

Practice this question →

Multi-Selectmedium

Which TWO of the following mechanisms are standard methods used by container runtimes (such as containerd or CRI-O) to isolate container workloads from the host kernel and other containers? (Choose TWO)

Select 2 answers

A.Disabling the Linux virtual memory manager cluster-wide

B.Hypervisor-based hardware virtualization for every container instance

C.Executing all container processes inside the host root process namespace

D.Control Groups (cgroups)

E.Linux Namespaces

AnswersD, E

Cgroups limit, account for, and isolate the resource usage (CPU, memory, disk I/O) of a collection of processes.

Why this answer

Container runtimes rely heavily on Linux kernel namespaces (to isolate system views such as network, process IDs, and mounts) and control groups (cgroups, to limit CPU, memory, and I/O resources).

Practice this question →

MCQhard

A security engineer is configuring a service mesh using Istio to ensure that all east-west traffic between microservices is mutually authenticated and encrypted. Which custom resource must be configured with a STRICT mTLS mode to enforce this requirement cluster-wide?

A.PeerAuthentication

B.EnvoyFilter

C.AuthorizationPolicy

D.DestinationRule

AnswerA

PeerAuthentication defines whether mTLS is enabled or disabled for workloads in a specific namespace or the entire mesh, supporting STRICT mode.

Why this answer

Istio uses the PeerAuthentication custom resource to define how traffic is authenticated between services. Setting it to STRICT mode ensures that all incoming traffic to the workload must be TLS encrypted and authenticated via mTLS.

Practice this question →

Multi-Selecthard

Which THREE of the following features or configurations are associated with securing Ingress traffic in a Kubernetes cluster? (Choose THREE)

Select 3 answers

A.Configuring TLS blocks in the Ingress resource referencing a kubernetes.io/tls Secret.

B.Directly exposing internal Pod clusterIPs to the public internet via kube-proxy bypass rules.

C.Integrating Web Application Firewall (WAF) modules or OAuth/OIDC authentication filters via Ingress annotations or middleware.

D.Removing all network policies so the Ingress controller can freely probe unmanaged host ports.

E.Using annotations to enforce HTTP-to-HTTPS redirection so unencrypted traffic is automatically upgraded.

AnswersA, C, E

This enables secure HTTPS communication by terminating TLS at the Ingress controller using stored certificate keys.

Why this answer

Ingress security involves terminating TLS securely using TLS secrets, enforcing HTTPS redirects for unencrypted traffic, and applying authentication or Web Application Firewalls (WAF) at the Ingress layer.

Practice this question →

Multi-Selecthard

Which THREE practices are critical for securing container registries and image distribution pipelines? (Choose three)

Select 3 answers

A.Enabling automated vulnerability scanning upon image push

B.Enforcing role-based access control (RBAC) on registry repositories

C.Storing registry admin credentials in plaintext inside Dockerfiles

D.Allowing anonymous write access to public repositories

E.Using image signing and verification (e.g., Notary or Cosign) to guarantee artifact integrity

AnswersA, B, E

Scanning images immediately upon upload ensures vulnerabilities are identified before distribution.

Why this answer

Securing container registries involves implementing role-based access control, enabling vulnerability scanning on push, and enforcing image signing.

Practice this question →

MCQmedium

Your security team has discovered that an application container image contains outdated packages with known remote code execution vulnerabilities. Which phase of the software development lifecycle is the most effective place to initially scan and remediate these vulnerabilities?

A.Node OS package manager updates

B.Kubelet container startup phase

C.CI/CD pipeline build stage

D.Kubernetes API server audit logging

AnswerC

Scanning during the CI/CD build phase catches vulnerabilities early and prevents vulnerable images from entering registries.

Why this answer

Scanning images during the CI/CD pipeline build phase allows developers to patch or replace vulnerable packages before the image is ever pushed to a registry or deployed to production.

Practice this question →

Multi-Selecthard

Which THREE security controls can be enforced by admission webhook policy engines (like Kyverno or OPA Gatekeeper) regarding container images? (Choose three)

Select 3 answers

A.Verifying cryptographic image signatures using tools like Cosign

B.Requiring container images to be pulled exclusively from approved enterprise registries

C.Automatically updating kernel modules on the underlying worker node

D.Manually restarting unhealthy pods across worker nodes

E.Blocking deployments of images that contain unmitigated high-severity vulnerabilities

AnswersA, B, E

Policy engines can check signature annotations and public keys before allowing deployment.

Why this answer

Policy engines can enforce image security by requiring specific trusted registries, mandating cryptographic signatures, and blocking images with high/critical vulnerabilities.

Practice this question →

MCQmedium

You are reviewing a security alert indicating that a container running in your Kubernetes cluster attempted to modify host kernel parameters via /proc/sys. Which security configuration was likely missing or misconfigured for this container?

A.The CoreDNS deployment had too few replicas

B.The Ingress controller did not enable TLS termination

C.The PersistentVolumeClaim lacked a storage class

D.The container was run in privileged mode or lacked necessary capability and filesystem hardening

AnswerD

Privileged containers or those with SYS_ADMIN capabilities can modify kernel parameters in /proc and /sys.

Why this answer

Containers must have their capabilities dropped (such as CAP_SYS_ADMIN) and should not run in privileged mode or with writable sysfs/procfs to prevent kernel parameter tampering.

Practice this question →

Multi-Selecteasy

Which TWO configuration practices improve container runtime security on Kubernetes nodes? (Choose two)

Select 2 answers

A.Enforcing non-root execution via container securityContext

B.Mounting the Docker socket inside application containers

C.Using read-only root filesystems to prevent tampering with binaries

D.Disabling all seccomp and AppArmor profiles

E.Granting CAP_SYS_ADMIN to all containers by default

AnswersA, C

Running containers as non-root reduces the blast radius of container escapes.

Why this answer

Runtime security is improved by using non-root users and ensuring root filesystems are read-only where possible.

Practice this question →