CKS · domain
System Hardening
Practise Certified Kubernetes Security Specialist CKS System Hardening practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.
Focused practice
Practice System Hardening questions
Scored sessions drawing only from this domain — pick a length below.
What this domain covers
What to know about System Hardening
System Hardening questions test whether you can apply the concept in context, not just recognise a definition.
How the topic appears in realistic exam-style scenarios.
Which detail in the question changes the correct answer.
How to eliminate plausible but wrong options.
How to connect the question back to the wider exam objective.
Watch out for
Common System Hardening exam traps
- ▸Answering from memory before reading the full scenario.
- ▸Missing a constraint such as cost, availability, security, scope or command context.
- ▸Choosing a broad answer when the question asks for the most specific fix.
- ▸Ignoring why the wrong options are tempting.
Question index
All System Hardening questions (11)
Click any question to see the full explanation, or start a practice session above.
Which TWO AppArmor modes are available? (Select 2)
Medium2You are tasked with reducing the attack surface on a Kubernetes node. Which of the following actions is LEAST effective for hardening the node itself?
Hard3A pod is running with AppArmor enabled using a profile named 'k8s-apparmor-profile'. You want to verify that the profile is loaded and set to enforce mode. Which command should you run on the node?
Medium4Which TWO of the following are valid AppArmor profile modes? (Select two.)
Easy5Which TWO of the following are valid methods to apply a seccomp profile to a pod in Kubernetes?
Medium6An administrator wants to enforce a custom AppArmor profile named 'k8s-apparmor-example' on a pod. The profile has been loaded on the node. Which annotation should be added to the pod's metadata to apply this profile?
Medium7Which TWO of the following are valid AppArmor profile modes?
Medium8Which TWO of the following are valid ways to reduce the attack surface of a Kubernetes node? (Select 2)
Medium9A security team wants to ensure that all containers in a pod run with only the minimum required Linux capabilities. Which of the following approaches is BEST?
Medium10Which of the following host access settings should be disabled to reduce the attack surface of a container?
Easy11Which THREE of the following are best practices for reducing the attack surface of Kubernetes nodes?
MediumOther domains
All CKS exam domains
Frequently asked questions
- What does the System Hardening domain cover on the CKS exam?
- System Hardening questions test whether you can apply the concept in context, not just recognise a definition.
- How many questions are in this domain?
- This page lists all 11 System Hardening questions in the CKS question bank. The actual exam draws from this domain proportionally to its weighting in the official exam blueprint.
- What is the best way to practise this domain?
- Start with a short focused session (10 questions) to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.
- Can I practise only System Hardening questions?
- Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.