Minimize Microservice Vulnerabilities

Which TWO of the following are valid approaches to manage secrets in a Kubernetes cluster?

A security admin wants to ensure that no container in a specific namespace runs as root. Which Gatekeeper ConstraintTemplate and Constraint configuration should be used?

You need to drop all Linux capabilities from a container. Which YAML snippet is correct?

A microservice running as a Deployment in a Kubernetes cluster needs to authenticate to a third-party API using a static API key. Which is the most secure way to store and inject this secret into the container?

You need to encrypt Kubernetes secrets at rest. Which resource should you configure?

You want to use an external secret management system like HashiCorp Vault to manage database credentials for your application. Which of the following are valid approaches to integrate Vault with Kubernetes?

Which TWO container sandboxing technologies are supported in Kubernetes via RuntimeClass? (Choose two)

You are deploying a workload that must be isolated from other workloads on the same node. You want to use a container sandboxing runtime to provide an additional security boundary. Which TWO of the following are true regarding the use of gVisor or Kata Containers in a Kubernetes cluster? (Choose two.)

A security engineer runs the following command to inspect a container's security context. What vulnerability does this configuration expose?

What is the primary benefit of using external secret managers (e.g., HashiCorp Vault) in Kubernetes?

A cluster has a ValidatingWebhookConfiguration that intercepts Pod CREATE requests. The webhook server is unavailable. What happens when a user tries to create a pod?

Which TWO of the following are correct about container sandboxing technologies? (Select TWO)

A pod uses a Secret mounted as a volume. The Secret is updated. How can the pod consume the updated values without restarting?

An admin has deployed a ValidatingWebhookConfiguration that denies pods with `runAsNonRoot: false`. After creating a pod that does not set `runAsNonRoot` at all, the pod is created successfully. Why did the webhook not deny it?

Which ONE of the following is a valid Rego policy construct used in OPA Gatekeeper ConstraintTemplates to enforce security policies?

A cluster administrator wants to run some workloads in a sandboxed environment using gVisor. Which Kubernetes resource must be created first to allow pods to request the gVisor runtime?

Which TWO of the following are required to enable encryption of Kubernetes Secrets at rest?

Which admission controller is responsible for validating and mutating requests based on webhooks?

An administrator needs to encrypt secrets at rest in etcd. Which of the following steps is required?

Which TWO of the following are valid ways to enforce that a container runs as a non-root user?

An administrator wants to enforce mTLS between all services in the 'mesh' namespace using Istio. Which resource should be applied to require mutual TLS for all workloads in that namespace?

Which TWO of the following are valid ways to enforce that containers run with a read-only root filesystem?

Which THREE of the following are best practices for securing a Kubernetes cluster using OPA Gatekeeper? (Choose three.)

Which TWO of the following are valid methods to enforce mTLS in an Istio service mesh? (Select 2)

An administrator wants to use OPA Gatekeeper to enforce that all pods have a resource limits section defined. Which of the following is the correct combination to implement this policy?

You need to create a NetworkPolicy that denies all ingress traffic to pods with label 'app: web' in the 'frontend' namespace, except for traffic from pods with label 'app: ingress' in the 'ingress' namespace. Which NetworkPolicy spec correctly achieves this?

Which command can be used to view the current set of admission webhooks in the cluster?

A security scanner reports that a microservice container image contains a critical vulnerability (CVE-2024-1234) in a system library. The team cannot immediately rebuild the image. What is the most effective temporary mitigation at the Kubernetes level?

You have enabled encryption at rest for Kubernetes Secrets by configuring an EncryptionConfiguration object and restarting the API server. After the configuration, you create a new Secret. However, when you retrieve the Secret using 'kubectl get secret mysecret -o yaml', the 'data' field still shows base64-encoded plaintext. Is the Secret encrypted at rest?

A security engineer wants to enable mutual TLS (mTLS) between services in an Istio service mesh. Which Istio resource should be used to define the mTLS mode for the entire mesh?

A security best practice is to avoid storing sensitive data in environment variables. Instead, secrets should be mounted as volumes. Which of the following YAML snippets correctly mounts a Kubernetes Secret named 'db-secret' as a volume at /etc/secrets?

Which THREE of the following are characteristics of container sandboxing runtimes like gVisor and Kata Containers?

A cluster administrator has configured EncryptionConfiguration to encrypt secrets at rest using a local key. After applying the configuration, the administrator creates a new secret. How can they verify that the secret is encrypted at rest?

You are writing a Rego policy for OPA/Gatekeeper to deny pods that do not have runAsNonRoot set to true. Which Rego statement should the ConstraintTemplate contain?

Which kubectl command creates a validating webhook configuration that calls an external HTTPS endpoint for pod validation?

Which TWO of the following are secure practices for managing secrets in Kubernetes? (Select TWO.)

You have a Pod that uses a ServiceAccount token mounted via a projected volume. You want to ensure that the token has an expiration time and that the pod is not using a long-lived token. What is the most secure way to mount the token?

Which of the following is the correct kubectl command to view the OPA Gatekeeper ConstraintTemplates in the cluster?

You are using Open Policy Agent (OPA) Gatekeeper to enforce pod security. You want to create a constraint that denies pods unless they have readOnlyRootFilesystem set to true. Which Rego rule in a ConstraintTemplate correctly implements this?

Which of the following is a characteristic of Kata Containers compared to gVisor?

A DevOps engineer wants to ensure that all microservice containers run with a read-only root filesystem to prevent unauthorized writes. What is the simplest way to enforce this at the Pod level?

In Kubernetes, you need to enforce a default deny-all network policy for pods in a specific namespace to ensure pods cannot communicate unless explicitly allowed by policy. Which resource should you create?

A cluster administrator needs to run a workload that uses gVisor (runsc) for container sandboxing. Which Kubernetes resource is required to enable this?

Which of the following commands creates a ValidatingWebhookConfiguration that uses an OPA Gatekeeper webhook?

To encrypt secrets at rest in Kubernetes, an administrator configures an EncryptionConfiguration. What is the correct flag to pass to the kube-apiserver to use this configuration?

An admin creates the following EncryptionConfiguration to encrypt secrets at rest. After applying it, what must the admin do to ensure existing secrets are encrypted?

An admin runs 'kubectl get pod web -o yaml' and sees the following security context. Which setting prevents privilege escalation?

Which field in a Pod's securityContext prevents privilege escalation by the container?

A pod fails to start with the error 'Container runtime network not ready', and the node uses Kata Containers (RuntimeClass: kata). What is the most likely cause?

Which TWO actions help minimize vulnerabilities in microservices by securing secrets? (Choose two)

Order the steps to configure and apply a NetworkPolicy to restrict pod-to-pod traffic.

Which ONE of the following is a valid method to restrict a container's filesystem to read-only in Kubernetes?

An admin has created an EncryptionConfiguration to encrypt secrets at rest in etcd. After applying the configuration and restarting the kube-apiserver, existing secrets are still stored in plaintext. What is the most likely reason?

A developer is deploying a pod that needs to access a sensitive database. The security team requires that the database credentials be stored in a Kubernetes Secret and mounted as a file, not exposed as environment variables. The credentials must be rotated without restarting the pod. Which volume type should be used?

A DevOps team deploys a microservice that needs to access a third-party API using credentials stored in a Kubernetes Secret. The team wants to minimize the risk of credential exposure. Which approach best achieves this goal while following security best practices?

Which TWO of the following are valid Pod Security Context settings to harden a container? (Select 2)

Which THREE of the following are valid approaches to enforce that all pods in a cluster run with a read-only root filesystem? (Select THREE)

Which TWO of the following are valid Rego keywords used in OPA policies for Gatekeeper? (Select TWO)

You want to run a container with gVisor for sandboxing. After installing gVisor and creating a RuntimeClass named 'gvisor', which Pod configuration enables it?

A security engineer needs to ensure that all containers in a cluster run as non-root users. Which Pod Security Context field should be set to enforce this requirement?

A cluster has EncryptionConfiguration with aescbc provider. After rotating the encryption key, what must be done to re-encrypt existing Secrets with the new key?

Which TWO of the following are valid ways to enable mTLS between services in a service mesh (e.g., Istio)?

What is the purpose of the `allowPrivilegeEscalation: false` setting in a container's security context?

You need to encrypt Secrets at rest in an existing Kubernetes cluster. You create an EncryptionConfiguration file specifying aescbc as the provider. After updating the API server kube-apiserver.yaml with the new configuration, you create a new Secret. Which of the following statements is true?

You are deploying a ValidatingWebhookConfiguration. The webhook server is running in the 'webhook' namespace, service name 'svc', port 443. Which clientConfig should you specify?

Which kubectl command creates a valid webhook configuration that validates pods against a policy?

Which THREE of the following are required to configure encryption of secrets at rest in Kubernetes?

You are reviewing a pod specification that mounts a hostPath volume to /var/run/docker.sock. Which security risk does this present, and what is the recommended mitigation?

You are configuring an Istio service mesh for mTLS between services. Which resource defines the TLS mode for traffic between services in a namespace?

You need to use gVisor as a container runtime for a set of workloads in the cluster. Which Kubernetes resource must be created to reference the runtime class?

Which TWO of the following are recommended practices for securing container images and runtime?

A security admin wants to ensure all pods in a cluster drop ALL Linux capabilities. Which of the following YAML snippets should be added to a PodSecurityPolicy (assuming PSP is enabled) or a pod spec?

Which of the following is the best practice for injecting secrets into a pod?

Which kubectl command creates a secret named 'mysecret' from a file called 'credentials.json'?

Which THREE of the following practices help protect microservice applications against supply chain attacks? (Choose three.)

Which TWO of the following are valid ways to securely manage secrets in Kubernetes? (Choose two.)

You need to ensure that all pods in a namespace have the label 'security: high' added automatically upon creation. Which admission controller should you use?

You are configuring encryption at rest for Kubernetes secrets. After creating an EncryptionConfiguration with aescbc provider, which additional step is required to enable encryption?

Which THREE of the following are features of container sandboxing solutions like gVisor or Kata Containers?

A pod runs with a service mesh sidecar (Istio). The team wants to enforce mutual TLS (mTLS) for all traffic between services in the 'production' namespace. Which resource should be applied?

You want to enable mutual TLS (mTLS) between services in a namespace using Istio. Which custom resource should you configure to enforce STRICT mTLS for all workloads in the namespace?

During a security audit, a team discovers that their microservice application, deployed on Kubernetes, is vulnerable to container breakout attacks. The containers run as root and have many Linux capabilities. Which set of Pod Security Standards (PSS) enforcement modes and policies would best mitigate this risk?

An OPA/Gatekeeper ConstraintTemplate is defined with the following Rego rule: violation[{"msg": msg}] { container := input.review.object.spec.containers[_] container.securityContext.runAsNonRoot != true msg := "Container must run as non-root" } What happens when a pod is submitted with a container that has runAsNonRoot: true?

An administrator wants to use gVisor to sandbox containers in a Kubernetes cluster. Which resource must be created to enable this?

Which TWO of the following are valid ways to enforce that containers cannot run as root in a Kubernetes cluster? (Select TWO.)

You want to run a workload in a sandboxed container using gVisor. You have created a RuntimeClass named 'gvisor' that references the 'runsc' handler. Which of the following Pod specs correctly uses this RuntimeClass?

You have created a ValidatingWebhookConfiguration to reject pods without resource limits. When you try to create a pod without limits, it is created successfully. What is the most likely reason?

Which of the following is a best practice for storing sensitive data like passwords in Kubernetes?

A pod is configured with securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 The volume mounted at /data is owned by user 1000 and group 2000. The container process inside the pod writes to /data. Which statement about file ownership is true?

Which of the following is the best practice for providing sensitive data like passwords to a pod?

A security engineer runs the following command to inspect a pod's security context: kubectl get pod secure-pod -o jsonpath='{.spec.containers[0].securityContext.capabilities}' The output is: {"drop":["ALL"]} What does this indicate?

Which TWO of the following are valid methods to securely manage secrets in Kubernetes?

An admin wants to enforce that all pods in a namespace use a read-only root filesystem except for a specific deployment that needs to write to a temporary directory. Which approach best meets this requirement?

Which command creates a validating webhook configuration that checks all pods in the cluster?

A security team wants to use OPA/Gatekeeper to enforce that all namespaces must have a label 'security-tier' with value 'high' or 'medium'. What is the correct approach?

You want to run a container with gVisor (runsc) runtime for sandboxing. Which resource is required to use a non-default runtime?

Given the following PodSecurityPolicy (PSP) snippet, which statement about the allowed containers is correct?

A ValidatingWebhookConfiguration is not working as expected. The webhook server is running and accessible. What is a common misconfiguration that would cause the webhook to not be called?

You need to ensure that all pods in a namespace can only communicate via mTLS. In Istio, which resource should you apply?

Which THREE of the following security context settings help mitigate container breakout attacks? (Select 3)

You are tasked with creating a ConstraintTemplate in OPA/Gatekeeper that denies pods running with the 'latest' image tag. Which Rego rule should the ConstraintTemplate include?

Which THREE of the following are valid capabilities that should be dropped for a container running a typical non-privileged application to adhere to the principle of least privilege?

A microservice container needs to perform DNS lookups using TCP rather than UDP. Which Kubernetes security context setting should be configured to allow this?

You need to encrypt secrets at rest in a Kubernetes cluster. What must be configured?

You want to drop all Linux capabilities from a container. Which securityContext field should you set?

Which flag enables the PodSecurity admission plugin in kube-apiserver?

A pod manifests with securityContext: { runAsNonRoot: true, runAsUser: 1001 }. However, the container image expects to run as root (UID 0). What will happen when the pod is created?

You are asked to secure a set of microservices running in a Kubernetes cluster. Which TWO of the following practices help minimize vulnerabilities in microservices?

You are implementing a Gatekeeper policy to deny pods that run as root. Which Rego rule should you include in the ConstraintTemplate?

Which kubectl command would you use to create a ValidatingWebhookConfiguration from a YAML file?

Which kubectl command would you use to create a Secret from a file named 'db-password.txt'?

Which of the following is the correct way to drop all capabilities in a container's security context?

Which THREE of the following are valid ways to manage secrets in a Kubernetes environment? (Select THREE)

Match each Kubernetes network security concept to its definition.

Which TWO of the following are best practices for minimizing microservice vulnerabilities in a Kubernetes cluster?

Which TWO of the following are best practices for securing secrets in Kubernetes?

You run 'kubectl auth can-i create pods --as=system:serviceaccount:default:sa1 -n default' and get 'no'. What does this mean?

You need to enforce that no pod runs with privileged containers or runs as root. Which tool can define policies that block such pods at admission time?

You need to ensure that all pods in a cluster run with read-only root filesystems. Which Pod Security Standard (PSS) control field should be set to true?

A developer reports that a pod fails to start with the error 'container has runAsNonRoot and image will run as root'. The pod spec includes securityContext.runAsNonRoot: true but does not specify runAsUser. The container image's Dockerfile does not set a USER instruction. Which change should you make to the pod spec to resolve the error while still enforcing non-root execution?

A security team wants to enforce that containers in a specific namespace cannot gain new capabilities. Which Pod security context field is used to achieve this?

An admin runs 'kubectl run test-pod --image=busybox --command -- sleep 3600' and then executes 'kubectl exec test-pod -- cat /var/run/secrets/kubernetes.io/serviceaccount/token'. The admin wants to prevent such access to the service account token. What is the correct action?

A developer creates a Deployment with the following container spec: ```yaml containers: - name: app image: myapp:latest env: - name: DB_PASSWORD valueFrom: secretKeyRef: name: db-secret key: password ``` Which of the following is a security concern with this approach?

Which of the following is NOT a valid method to enforce pod security standards in a Kubernetes cluster?

You are deploying an application that needs to access a database password stored in a Kubernetes Secret. To minimize risk, you should mount the Secret as a volume rather than using environment variables. Which of the following is the primary security benefit of using mounted volumes over environment variables?

Which TWO of the following are valid Kubernetes RuntimeClass handlers for container sandboxing? (Choose two.)

You are using External Secrets Operator to sync secrets from HashiCorp Vault. The operator is deployed but secrets are not being created. Which resource defines the mapping between Vault secrets and Kubernetes secrets?

An administrator deploys a Gatekeeper ConstraintTemplate with the following Rego policy: package k8srequiredlabels deny[{"msg": msg}] { input.request.kind.kind == "Pod" not input.request.object.metadata.labels["security-tier"] msg := "Pod must have label 'security-tier'" } After creating the Constraint, a user creates a Pod without the 'security-tier' label. What is the expected behavior?

Which THREE of the following are true about Istio PeerAuthentication? (Select THREE.)

A cluster administrator wants to audit all pod creations and modifications using an admission webhook. Which resource type should be created to register the webhook?

In the context of service mesh (e.g., Istio), which resource is used to enforce mutual TLS (mTLS) between services in a specific namespace?

Which TWO of the following are valid arguments for the kubectl command to create a secret from a file? (Select TWO)

Which field must be set in a Pod's security context to prevent the container from running as the root user?

A cluster administrator wants to ensure that all Secrets are encrypted at rest using AES-CBC with a key managed by the local Kubernetes API server. Which configuration is required?

An administrator wants to enforce mutual TLS (mTLS) between all services in an Istio service mesh. Which resource should be configured?

You need to enforce that all containers in a namespace run with a read-only root filesystem. Which OPA Gatekeeper resource would you use to define the policy?

A developer wants to run a container that reads a secret from a mounted volume, not as an environment variable. Which volume type should they use?

Which THREE of the following are recommended practices for minimizing microservice vulnerabilities related to container security?

Which of the following is a valid way to drop all capabilities from a container?

A developer wants to ensure that all containers in a pod run with a read-only root filesystem except for a specific volume mounted for writing logs. Which container-level security context field should be set to true?

A pod is using a RuntimeClass that specifies gVisor (runsc). Which of the following scenarios is most likely to cause the pod to fail?

You are a Kubernetes administrator for a fintech company that runs a payment processing service in a production cluster. The service consists of multiple microservices that communicate over the network. Recently, a security audit revealed that a compromised pod could potentially send malicious requests to other services because there are no network restrictions between pods. The security team has mandated that all inter-service traffic must be encrypted and authenticated, and that only necessary traffic should be allowed. You need to implement a solution that meets these requirements with minimal changes to the application code and minimal operational overhead. Which approach should you take?

Which of the following is a valid approach to enforce that containers cannot escalate privileges?

You need to enforce that all pods in the 'production' namespace run with read-only root filesystems. Which OPA Gatekeeper resource do you create first?

You need to ensure that all containers in a pod run as non-root. Which security context field should you set to enforce this?

Which kubectl command lists all MutatingWebhookConfigurations in the cluster?

A security policy requires that all pods drop ALL Linux capabilities and disable privilege escalation. Which YAML snippet correctly implements this in the pod's security context?

Which container runtime is specifically designed for sandboxing containers with a lightweight kernel?

In an Istio service mesh, you want to enforce mutual TLS (mTLS) between all services in the 'default' namespace. Which resource should you create?

What is the primary purpose of using a service mesh like Istio for microservices security?

Which command correctly creates a secret from a file named 'config.json'?

You need to run a container with a sandboxed runtime using gVisor (runsc). Which Kubernetes resource must be created first to enable this?

A security auditor requires that all pods in a cluster must not run as root. Which Pod Security Standard (PSS) and enforcement mode should be applied at the namespace level?

An administrator wants to enforce a policy that all containers must drop ALL capabilities and not allow privilege escalation. Which YAML snippet correctly implements this requirement in a PodSecurityPolicy-like manner using a security context? (Note: PodSecurityPolicy is deprecated; consider using a ValidatingAdmissionPolicy or OPA/Gatekeeper, but for this question choose the correct security context fields.)

An administrator wants to enforce that all containers in a Kubernetes cluster run as non-root and have read-only root filesystems using OPA/Gatekeeper. Which two resources must be created?

Which THREE of the following are capabilities that should typically be dropped from a container to minimize vulnerabilities?

To encrypt secrets at rest, which file must be modified on the control plane nodes?

A developer asks you to run a container with gVisor runtime. The cluster has a RuntimeClass named 'gvisor' defined. Which field must be added to the Pod spec to use gVisor?

Which Istio resource is used to enforce mutual TLS (mTLS) for all services in a namespace, ensuring that traffic between services is encrypted?

Match each Kubernetes object or feature to its primary security purpose.

A Gatekeeper Constraint is not blocking pods that violate the policy. The constraint references a ConstraintTemplate that has been successfully created. What is the most likely cause?