scenario questions

What is the purpose of the --authorization-mode=RBAC flag on the API server?

A security engineer wants to enforce that all containers in a namespace run without any unnecessary Linux capabilities, dropping all capabilities by default and only adding back what is needed. Which Pod Security Standard should be applied to that namespace using PodSecurity admission?

Which TWO of the following are valid approaches to manage secrets in a Kubernetes cluster?

In a Falco rule, you have the condition: 'evt.type=execve and proc.name=bash and container.id!=host'. What does this rule detect?

A security admin wants to ensure that no container in a specific namespace runs as root. Which Gatekeeper ConstraintTemplate and Constraint configuration should be used?

To ensure a container's filesystem is read-only, which field should be set to 'true' in the container spec?

Which THREE of the following are tools used for static analysis of Kubernetes manifests?

A security auditor recommends limiting the use of host namespaces in pods. Which THREE of the following fields, if set to true, expose the host namespace to a container?

After running kube-bench, you see a failing check: '1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive'. What is the remediation?

Which TWO of the following are valid methods to secure the etcd datastore in a Kubernetes cluster?

You need to drop all Linux capabilities from a container. Which YAML snippet is correct?

An administrator wants to enable audit logging on the API server. Which three flags are required to set up basic audit logging?

You are tasked with securing the kubelet. Which flag must be set on the kubelet to enable the NodeRestriction admission plugin?

You need to audit all API requests to the cluster. Which set of apiserver flags should be configured?

Which tool can be used to generate an SBOM (Software Bill of Materials) for a container image?

You are managing a Kubernetes cluster that hosts multiple microservices. The cluster uses Kubernetes v1.25. Recently, a security audit identified that containers are running with the default seccomp profile (unconfined). The security team has requested that all containers use a seccomp profile that blocks unnecessary syscalls. You need to implement this cluster-wide without breaking existing applications. The audit also found that the kubelet's anonymous authentication is enabled, which should be disabled. Additionally, you need to ensure that the kubelet's NodeRestriction admission controller is enabled to limit what nodes can do. Which of the following is the most appropriate sequence of actions?

A microservice running as a Deployment in a Kubernetes cluster needs to authenticate to a third-party API using a static API key. Which is the most secure way to store and inject this secret into the container?

Which TWO of the following are valid Falco rule priorities?

Which TWO of the following are valid audit stages in Kubernetes audit logging?

A security team is hardening a Kubernetes cluster. They need to ensure that all control plane components run with the least privilege. Which approach should they take?

An administrator creates an EncryptionConfiguration with aescbc and saves it to /etc/kubernetes/enc/enc.yaml. Which flag must be added to the kube-apiserver to enable encryption at rest?

Which TWO AppArmor modes are available? (Select 2)

An etcd cluster uses TLS for peer and client communication. Which command correctly tests connectivity to an etcd member with client certificate authentication?

A cluster administrator wants to enforce the Pod Security Standard 'restricted' at the namespace level. Which command applies the PodSecurity admission label to the 'prod' namespace?

A cluster uses RBAC and a ServiceAccount 'monitor' in namespace 'observability'. The account needs to list pods in all namespaces. Which ClusterRole and binding should be created?

In a Falco rule, what does the 'priority' field indicate?

You need to encrypt Kubernetes secrets at rest. Which resource should you configure?

An administrator wants to ensure that containers in the 'secure-app' namespace cannot write to their own filesystem. Which pod security context setting should be used?

A developer wants to verify the signature of a container image before deploying it. Which command should they use along with Cosign?

A security engineer wants to encrypt secrets at rest in an existing Kubernetes cluster. The cluster is already running with the default encryption configuration. After creating an EncryptionConfiguration resource and updating the kube-apiserver manifest, which command should be used to ensure the new configuration is applied without restarting the API server?

A security auditor runs kube-bench on a Kubernetes node and reports that the check '1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive' fails. What is the most appropriate remediation?

You are investigating a pod that is suspected of being compromised. You need to preserve the container's filesystem for forensic analysis. Which `crictl` command should you use to export the container's filesystem as a tar archive?

You want to use an external secret management system like HashiCorp Vault to manage database credentials for your application. Which of the following are valid approaches to integrate Vault with Kubernetes?

You have a Kyverno policy that validates images are from a specific registry. However, a pod using an image from that registry is still blocked. The pod YAML includes 'imagePullPolicy: Always'. What could be the issue?

Which admission controller is responsible for validating and modifying images based on an external webhook in Kubernetes?

Which field in a PodSecurityContext ensures that the container cannot gain privileges beyond its parent process?

A DevOps team wants to ensure that all container images are pulled from a trusted registry only. Which cluster-level configuration should be applied?

Which TWO container sandboxing technologies are supported in Kubernetes via RuntimeClass? (Choose two)

A container is running with the following securityContext: securityContext: capabilities: drop: ["ALL"] add: ["NET_BIND_SERVICE"] Which capabilities will the container have?

Which Linux capability should be dropped to prevent a container from gaining new privileges via setuid binaries?

Which of the following is correct about dropping the 'NET_RAW' capability?

A security engineer runs the following command to inspect a container's security context. What vulnerability does this configuration expose?

A cluster uses ImagePolicyWebhook admission controller. After configuring it, deployments referencing images from an unauthorized registry are blocked. However, some deployments are still being admitted. What is a possible cause?

An administrator wants to use AppArmor to confine a container. They have loaded a profile named 'my-custom-profile' using apparmor_parser. Which annotation should be added to the pod to enforce this profile?

You need to ensure that the kubelet only serves authenticated and authorized requests. Which flag(s) should be set on the kubelet?

What is the primary benefit of using external secret managers (e.g., HashiCorp Vault) in Kubernetes?

What is the purpose of the 'seccomp' feature in Kubernetes?

You are writing a Falco rule to detect when a container tries to read /etc/shadow. Which condition should you use?

A cluster has been configured with the NodeRestriction admission plugin. A developer tries to create a pod that uses a hostPath volume pointing to /var/log. The pod's nodeSelector is set to 'kubernetes.io/hostname: worker-1'. Which statement is true?

You have enabled etcd encryption at rest using an EncryptionConfiguration with aescbc provider. After applying the configuration, you create a new Secret. Which of the following is true regarding the encrypted Secret?

Which flag must be set on the kube-apiserver to disable anonymous authentication?

Which kubectl command runs kube-bench against a Kubernetes cluster?

Which TWO are best practices for Dockerfile security? (Select 2)

Which TWO of the following are correct about container sandboxing technologies? (Select TWO)

Which of the following OPA Gatekeeper Rego policies would deny a pod that sets `securityContext.runAsUser: 0`?

A developer wants to run a container that needs to modify kernel parameters. What is the secure way to achieve this?

What is the purpose of the Kubernetes Dashboard?

You are auditing RBAC and find a ClusterRoleBinding that grants cluster-admin to a service account. Which command should you run to list all ClusterRoleBindings in the cluster?

A pod uses a Secret mounted as a volume. The Secret is updated. How can the pod consume the updated values without restarting?

You have configured an audit policy with level: Request. Which request information is logged?

An admin has deployed a ValidatingWebhookConfiguration that denies pods with `runAsNonRoot: false`. After creating a pod that does not set `runAsNonRoot` at all, the pod is created successfully. Why did the webhook not deny it?

An administrator needs to enforce that all pods in a namespace run with read-only root filesystem. Which Pod Security Standard should be applied?

Which kubectl command creates a Role named 'pod-reader' that allows only 'get', 'list', and 'watch' on pods in namespace 'ns1'?

Which tool can be used to perform static analysis of Kubernetes manifests for security issues?

A security scan reports that the etcd cluster does not encrypt data at rest. The cluster uses aescbc encryption. Which resource type should be created to configure encryption at rest?

An administrator runs 'kubectl run test-pod --image=nginx:latest' and the pod fails to start. The event log shows 'ImagePullBackOff' with error 'manifest for nginx:latest not found: manifest unknown'. The image 'nginx:latest' exists in the registry. What is the most likely cause?

You are the security engineer for a multi-tenant Kubernetes cluster. The cluster uses kubeadm and runs Kubernetes v1.24. Each tenant has a dedicated namespace. A new tenant, 'acme-corp', requires that all pods in their namespace run with a read-only root filesystem and must not be able to escalate privileges. They also need to run a legacy container that must listen on a port below 1024. The cluster currently uses PodSecurityPolicy (PSP) but is planning to migrate to Pod Security Admission (PSA). The legacy container needs to run as non-root with the NET_BIND_SERVICE capability to bind to port 80. You need to configure security policies for the 'acme-corp' namespace without affecting other tenants. Which approach best meets these requirements while following Kubernetes best practices?

A cluster administrator wants to enforce that containers run with a read-only root filesystem. Which security context field should be set?

Which three of the following are valid methods to restrict access to etcd? (Choose three.)

Which ONE of the following is a valid Rego policy construct used in OPA Gatekeeper ConstraintTemplates to enforce security policies?

Developer A runs 'cosign verify --key cosign.pub myregistry/myimage:tag' and receives an error: 'No signatures found'. Developer B previously ran 'cosign sign --key cosign.key myregistry/myimage:tag'. What is the most likely cause of the verification failure?

A cluster administrator wants to run some workloads in a sandboxed environment using gVisor. Which Kubernetes resource must be created first to allow pods to request the gVisor runtime?

A pod is scheduled on a node that has AppArmor enabled, and the pod has the annotation 'container.apparmor.security.beta.kubernetes.io/nginx: localhost/deny-write'. The profile 'deny-write' is loaded. However, the nginx container is able to write to the filesystem. What is the most likely issue?

You run 'kubectl auth can-i --list --as=system:serviceaccount:kube-system:my-sa' and see that my-sa has cluster-admin access. What is the BEST way to reduce privileges?

To disable service account token automount for a pod, which field should be set to false in the pod spec?

During a runtime incident, you suspect a container has a reverse shell. Which kubectl command can you use to examine the container's running processes?

A developer wants to create a Deployment that runs as a non-root user. Which YAML snippet correctly sets the security context to run the container with UID 1000?

A node in your cluster is running unnecessary services that increase the attack surface. Which of the following is the BEST approach to reduce the attack surface on the node?

Which of the following is the correct way to drop all capabilities from a container in a pod specification?

Match each etcd security configuration to its description.

Which TWO of the following are valid audit stages in Kubernetes? (Select 2)

After setting up etcd encryption at rest using EncryptionConfiguration with aescbc, which resource stores the encryption key?

Which of the following is a static analysis tool for Kubernetes manifests that can be used to find misconfigurations?

What is the correct way to specify a container image using a SHA digest instead of a tag for immutable deployments?

You are tasked with reducing the attack surface on a Kubernetes node. Which of the following actions is LEAST effective for hardening the node itself?

You are implementing supply chain security for container images. Which tool would you use to scan a local directory of Dockerfiles and Kubernetes manifests for known vulnerabilities?

Which admission controller is responsible for validating and mutating requests based on webhooks?

Which etcd security measure should be implemented to ensure only authorized clients can access the etcd cluster?

Which TWO of the following are recommended CIS benchmark practices for securing etcd? (Choose two.)

An administrator needs to encrypt secrets at rest in etcd. Which of the following steps is required?

To enforce Pod Security Standards at the namespace level, which admission plugin must be enabled on the API server?

A security policy requires that all containers in the 'staging' namespace drop all Linux capabilities and only add the necessary ones. Which pod security context configuration achieves this?

Which THREE of the following are recommended practices for securing container images in a Kubernetes environment?

Which TWO of the following are correct ways to apply a seccomp profile named 'audit.json' located on each node? (Select two.)

A development team uses a custom container image for their application, built from a base image that includes multiple CVEs. The security team requires that no container runs with known critical vulnerabilities. Which approach best ensures that only images with no critical vulnerabilities are deployed in production?

A pod is using a custom seccomp profile stored at /var/lib/kubelet/seccomp/custom-profile.json. Which securityContext configuration correctly references this profile?

Which TWO of the following are valid ways to enforce that a container runs as a non-root user?

You have a requirement to encrypt secrets at rest in etcd. Which resource and apiVersion should be used?

You are tasked with securing a Kubernetes cluster. You want to ensure that the kubelet only serves APIs that are explicitly allowed and that it does not allow anonymous requests. Which kubelet configuration flags should you set?

An admin wants to check which AppArmor profiles are loaded. Which command should they run?

A security team wants to enforce that no container in the 'restricted' namespace runs with added Linux capabilities beyond the default set (according to the restricted Pod Security Standard). Which PodSecurityConfiguration should be applied to the namespace?

Which command can be used to check if the API server has anonymous authentication enabled?

An administrator runs 'kubectl describe nodes' and notices that the node status shows 'Ready,SchedulingDisabled'. What is the most likely cause?

A security team wants to detect anomalous process executions in containers without modifying the container images or requiring agents inside containers. Which approach is most suitable?

Which admission plugin should be enabled on the kubelet to ensure it only registers nodes and sets labels as allowed by the Node REST API?

A pod has been compromised. You want to isolate it from other pods while preserving its network state for forensics. Which NetworkPolicy rule achieves this?

Which THREE of the following are correct statements about seccomp in Kubernetes? (Select 3)

Which TWO of the following Falco fields can be used in a rule condition to detect a shell spawned inside a container? (Choose two.)

Which tool can generate an SBOM for a container image?

Which of the following is a BEST practice for securing container images in a Dockerfile?

An administrator wants to enforce mTLS between all services in the 'mesh' namespace using Istio. Which resource should be applied to require mutual TLS for all workloads in that namespace?

Which command is used with Cosign to sign a container image?

An administrator wants to enforce that all pods in a namespace use the restricted Pod Security Standard. Which of the following commands correctly enables this enforcement?

Which TWO of the following are valid methods to apply a seccomp profile to a container? (Select 2 correct answers)

You need to encrypt Kubernetes secrets at rest using aescbc. Which YAML snippet defines the EncryptionConfiguration correctly?

An administrator runs 'kubectl describe pod secure-pod' and sees that the pod is in a Pending state with the event 'Error: ImagePullBackOff' and the message 'unauthorized: authentication required'. The image is stored in a private registry. What is the most likely cause?

A security team wants to ensure that no pod runs with privileged access. They have created a PodSecurityPolicy (PSP) that sets 'privileged: false'. However, a pod with privileged: true still gets created. What is the most likely cause?

Which TWO of the following are valid ways to enforce that containers run with a read-only root filesystem?

An administrator runs 'kubectl run test-pod --image=nginx --dry-run=client -o yaml > pod.yaml', then adds 'hostPID: true' and 'hostNetwork: true' to the pod's spec. After applying with 'kubectl apply -f pod.yaml', the pod is created but immediately goes into 'CrashLoopBackOff'. What is the likely cause?

You need to create a NetworkPolicy that allows only ingress traffic from pods with label 'app: frontend' in the same namespace. Which policyType and ingress rule should you use?

A security policy requires that all container images must have a signed attestation. Which Cosign command would an admin add to the CI pipeline to create this attestation?

An audit policy is configured with the following rule: - level: RequestResponse users: ["system:serviceaccount:kube-system:admin"] verbs: ["get", "list"] resources: - group: "" resources: ["secrets"] What will be logged when the service account 'admin' in kube-system performs a GET request on a Secret?

A custom seccomp profile is created at /var/lib/kubelet/seccomp/custom-profile.json. Which YAML snippet applies this profile to a container?

A compromised pod is making unexpected outbound connections. You want to isolate the pod by blocking all egress traffic while keeping it running for forensic analysis. Which action is correct?

You need to enforce that all images deployed in the cluster are signed by a trusted key. Which Kubernetes admission control mechanism would you use?

You need to configure a NetworkPolicy that allows egress traffic only to an external database at IP 10.0.0.5 on port 5432, and denies all other egress. Which policy BEST achieves this?

Which THREE of the following are valid methods to disable automount of service account tokens for a pod?

Which TWO of the following are best practices for securing secrets in Kubernetes? (Select 2)

Which THREE of the following are best practices for Dockerfile security? (Select THREE)

A pod is created with the following security context: securityContext: seccompProfile: type: Localhost localhostProfile: profiles/audit.json Where must the 'audit.json' file be placed on the node?

Which of the following securityContext settings prevents a container from using host network namespace?

Which THREE of the following are best practices for securing a Kubernetes cluster using OPA Gatekeeper? (Choose three.)

Which TWO of the following are valid methods to enforce mTLS in an Istio service mesh? (Select 2)

Order the steps to configure and use Falco for runtime security in a Kubernetes cluster.

A security audit reveals that a service account in the 'default' namespace has been granted cluster-admin privileges via a ClusterRoleBinding. What is the best mitigation?

You are reviewing RBAC permissions and notice a ClusterRoleBinding that binds the cluster-admin role to a service account in the 'monitoring' namespace. What is the best practice recommendation?

A security admin runs 'trivy image --severity CRITICAL,HIGH myrepo/myapp:latest' and sees many CVEs. The admin wants to ensure that only images with no CRITICAL or HIGH severity vulnerabilities are deployed to the cluster. Which admission controller should be configured to enforce this policy?

Which of the following is the correct command to load an AppArmor profile from a file named 'my-profile'?

Which THREE of the following are required to secure etcd in a Kubernetes cluster?

An administrator wants to use OPA Gatekeeper to enforce that all pods have a resource limits section defined. Which of the following is the correct combination to implement this policy?

A pod is running with AppArmor enabled using a profile named 'k8s-apparmor-profile'. You want to verify that the profile is loaded and set to enforce mode. Which command should you run on the node?

You need to enable audit logging for the Kubernetes API server. Which two flags must be set?

You are implementing a policy to ensure all containers in a namespace run as non-root. Which of the following is the most appropriate approach to enforce this at the cluster level?

Which THREE of the following are recommended steps during incident response for a compromised pod? (Choose three.)

Which kubectl command checks the CIS Benchmark compliance of a cluster node using the kube-bench tool?

A Falco rule triggers on 'Write below etc' and you see an alert about a process writing to /etc/shadow. Which syscall is Falco most likely using to detect this?

A pod with the following annotation is created: 'container.apparmor.security.beta.kubernetes.io/webserver: localhost/k8s-apparmor-profile'. However, the pod remains in 'Pending' state and the node logs show 'AppArmor not available'. What is the most likely cause?

You want to configure an audit policy to log all requests to the 'secrets' resource with the body at the 'RequestResponse' level. Other resources should be logged at 'Metadata' level. Which audit policy YAML snippet is correct?

Which YAML field in a Deployment specifies the container user should not run as root?

A DevOps team uses a CI/CD pipeline to build container images and push them to a private registry. To minimize the risk of supply chain attacks, which of the following is the most effective security control to implement?

An administrator discovers that a container has been running with root privileges despite a PodSecurityPolicy that should prevent it. What is the most likely cause?

A CI/CD pipeline uses cosign attest to add an SBOM attestation to an image. Later, during deployment, which command verifies the attestation?

Which tool is used to generate a Software Bill of Materials (SBOM) for a container image?

Which TWO of the following are valid AppArmor profile modes? (Select two.)

Which TWO of the following are valid methods to apply a seccomp profile to a pod in Kubernetes?

An administrator runs `kubectl run nginx --image=nginx:latest` and the pod remains in ImagePullBackoff. The cluster uses containerd as the container runtime. What is the most likely cause?

A security team wants to detect any attempt to read the /etc/shadow file inside a container. Which Falco rule condition would trigger an alert for such an event?

A security team wants to ensure that only approved container images can run in their production cluster. Which admission controller should be configured in the kube-apiserver to enforce this policy?

A security team wants to detect any attempt to read /etc/shadow from within a container using Falco. Which condition in a Falco rule would match this behavior?

You are a security engineer for a financial services company running a Kubernetes cluster on-premises. The cluster uses kubeadm for bootstrapping and Calico for network policy. Recently, a compliance audit revealed that all nodes in the cluster have the kubelet port 10250 open to the public network, allowing unauthenticated access to the kubelet API. This poses a severe security risk. The cluster has 10 worker nodes and 3 control plane nodes. You need to remediate this without disrupting running workloads. The nodes are behind a corporate firewall, but the internal network is considered untrusted. You have access to the node's iptables and can modify configuration files. Which course of action best secures the kubelet port while maintaining cluster functionality?

A pod is running with securityContext.seccompProfile.type: Unconfined. Which statement is true?

An administrator wants to enforce a custom AppArmor profile named 'k8s-apparmor-example' on a pod. The profile has been loaded on the node. Which annotation should be added to the pod's metadata to apply this profile?

Which of the following commands shows all loaded AppArmor profiles?

Which THREE of the following are best practices for minimizing host access from containers to reduce the attack surface? (Select three.)

You need to create a NetworkPolicy that denies all ingress traffic to pods with label 'app: web' in the 'frontend' namespace, except for traffic from pods with label 'app: ingress' in the 'ingress' namespace. Which NetworkPolicy spec correctly achieves this?

A cluster administrator wants to allow only images from a specific registry (e.g., 'myregistry.io') to be deployed in the cluster. Which tool can be used to enforce this via admission control?

Which of the following is a recommended setting from the CIS Kubernetes Benchmark for the kubelet?

Which TWO of the following are valid techniques to detect and respond to runtime incidents in a Kubernetes cluster? (Select TWO.)

Which of the following is a recommended CIS benchmark setting for the kubelet?

Which THREE of the following are valid methods to secure etcd in a Kubernetes cluster? (Select THREE)

You want to ensure that kubelet does not allow anonymous requests. Which flag must be set on the kubelet?

A cluster has enabled the NodeRestriction admission controller. A developer is trying to create a pod with hostNetwork: true but is getting an error. What is the most likely reason?

Which command can be used to view the current set of admission webhooks in the cluster?

Which THREE of the following are best practices for reducing the attack surface of Kubernetes nodes? (Select three.)

The Kubernetes Dashboard is deployed in the cluster. To secure it, which of the following is a recommended practice?

Which Falco rule priority is used to indicate a potentially malicious activity that should be investigated?

An administrator deploys a Pod with the following security context: securityContext: runAsNonRoot: true runAsUser: 1000 However, the Pod fails to start with an error: 'container has runAsNonRoot and image will run as root'. What is the most likely cause?

A security engineer runs kube-hunter against a production cluster and receives the above output. The cluster uses kubeadm with default settings. Which two actions should the engineer take to remediate the vulnerabilities?

A security scanner reports that a microservice container image contains a critical vulnerability (CVE-2024-1234) in a system library. The team cannot immediately rebuild the image. What is the most effective temporary mitigation at the Kubernetes level?

A developer creates a pod with the following YAML: apiVersion: v1 kind: Pod metadata: name: mypod spec: serviceAccountName: default automountServiceAccountToken: true containers: - name: app image: nginx What is the security concern with this configuration?

Which TWO of the following are tools for image signing and verification? (Select TWO)

You run 'kubectl exec -it <pod> -- /bin/sh' inside a pod that has an immutable root filesystem. What happens?

What is the purpose of the 'automountServiceAccountToken: false' setting in a Pod spec?

A DevOps engineer wants to ensure that a container image is signed and the signature is verified before deployment. Which Cosign command verifies an image signature?

Which TWO of the following are correct methods to verify a signed container image using Cosign?

Which flag should you set on the kube-apiserver to disable anonymous authentication?

A security engineer wants to enable mutual TLS (mTLS) between services in an Istio service mesh. Which Istio resource should be used to define the mTLS mode for the entire mesh?

What is the default seccomp profile applied when a pod's security context has 'seccompProfile.type: RuntimeDefault'?

Which THREE of the following are valid fields in an EncryptionConfiguration YAML to encrypt secrets at rest?

A security best practice is to avoid storing sensitive data in environment variables. Instead, secrets should be mounted as volumes. Which of the following YAML snippets correctly mounts a Kubernetes Secret named 'db-secret' as a volume at /etc/secrets?

You need to detect any attempt to read /etc/shadow inside a container using Falco. Which macro would you use in the condition?

Which THREE of the following are characteristics of container sandboxing runtimes like gVisor and Kata Containers?

Which TWO of the following are valid audit levels in a Kubernetes audit policy? (Select TWO.)

A cluster uses PodSecurity admission. A namespace has the label 'pod-security.kubernetes.io/enforce: baseline'. A user creates a pod that runs a container with 'privileged: true'. What happens?

A cluster has audit logging enabled with a policy that sets 'RequestResponse' level for all resources. The cluster is experiencing high etcd write load. Which change would reduce the load MOST effectively?

Which of the following is a best practice for securing container images?

A cluster administrator has configured EncryptionConfiguration to encrypt secrets at rest using a local key. After applying the configuration, the administrator creates a new secret. How can they verify that the secret is encrypted at rest?

Which THREE are valid ways to restrict access to the Kubernetes API server?

A cluster has the ImagePolicyWebhook admission controller enabled. A pod creation is denied with the message 'image policy check failed'. The webhook server returns an error. Which of the following could be a valid reason?

Which TWO tools can be used to directly interact with the container runtime (without going through the Kubernetes API) for troubleshooting?

You are writing a Rego policy for OPA/Gatekeeper to deny pods that do not have runAsNonRoot set to true. Which Rego statement should the ConstraintTemplate contain?

Which TWO of the following are valid priority levels in Falco rules?

Which TWO of the following are CIS Benchmark recommendations for securing the Kubernetes API server? (Select TWO)

Which two of the following are best practices for container image security? (Select TWO.)

Which kubectl command creates a validating webhook configuration that calls an external HTTPS endpoint for pod validation?

Which kubectl command can be used to view the audit log policy currently in use by the API server?

Which TWO of the following are valid AppArmor profile modes? (Select 2 correct answers)

You are investigating a pod suspected of being compromised. Which set of commands would provide the most useful forensic evidence without altering the container's state?

A CI pipeline uses 'checkov' to scan Kubernetes manifests. Which of the following is a common checkov check related to supply chain security?

You are responsible for securing a multi-tenant Kubernetes cluster that uses kubeadm for bootstrapping. The cluster has three control plane nodes and five worker nodes, all running Ubuntu 22.04. A recent security scan discovered that the etcd data directory is not encrypted at rest. The cluster stores sensitive customer data in secrets. You plan to enable encryption at rest for etcd. You have already created an encryption configuration file and placed it at /etc/kubernetes/encryption-config.yaml. The cluster is currently running Kubernetes v1.28.0 with etcd v3.5.9. You need to ensure that all existing and new secrets are encrypted. You also want to minimize downtime. Which of the following steps should you take?

Arrange the steps to configure and use kube-bench to audit a Kubernetes cluster's security.

Which flag should be set on the kube-apiserver to disable anonymous authentication?

A pod is in a CrashLoopBackOff state. You run 'kubectl logs pod-name' and see: 'Error: failed to start container: exec: "/app": stat /app: no such file or directory'. What is the most likely cause?

Order the steps to recover a Kubernetes cluster after a control plane failure where the API server certificate has expired.

Which of the following is a best practice when writing a Dockerfile for a containerized application?

A security team wants to ensure that all API requests to the cluster are authenticated and uses RBAC for authorization. Which two flags must be set on the kube-apiserver?

Which TWO of the following are valid methods to apply a seccomp profile to a Kubernetes pod? (Select two.)

Which TWO of the following are secure practices for managing secrets in Kubernetes? (Select TWO.)

Which of the following is the correct kubectl command to view the OPA Gatekeeper ConstraintTemplates in the cluster?

Which TWO practices improve supply chain security for container images? (Select two.)

Which THREE of the following are restrictions enforced by the 'baseline' Pod Security Standard? (Select three.)

Which TWO of the following are recommended actions to harden service account security in a Kubernetes cluster? (Select TWO)

You want to ensure that a pod only runs on nodes that have a specific label, 'disktype=ssd'. Which field should be specified in the pod spec?

A security incident occurred in a pod running in the 'default' namespace. You need to isolate the pod to prevent further damage while preserving evidence. Which set of commands would BEST achieve this?

A cluster uses a custom mutating admission webhook that adds a sidecar container to all pods. After an upgrade, the webhook crashes and pods cannot be created. What is the best way to prevent this scenario in future?

You are using Open Policy Agent (OPA) Gatekeeper to enforce pod security. You want to create a constraint that denies pods unless they have readOnlyRootFilesystem set to true. Which Rego rule in a ConstraintTemplate correctly implements this?

Which TWO of the following are true about AppArmor profiles in Kubernetes?

Which TWO admission plugins are recommended by the CIS benchmark to be enabled on the kube-apiserver? (Choose two.)

Which of the following is a characteristic of Kata Containers compared to gVisor?

What is the recommended way to provide TLS certificates to the API server?

Which of the following is a best practice for storing sensitive information like database passwords in Kubernetes?

You run 'kube-bench' and see a failure: '1.2.7 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate'. What is the impact of this misconfiguration?

A security auditor wants to ensure that no container in the cluster has the CAP_SYS_ADMIN capability. Which of the following is the most effective way to enforce this cluster-wide?

An administrator runs 'kube-bench run --targets=master' and sees a failing check for 'Ensure that the --audit-log-path argument is set'. What is the correct remediation?

You need to detect any unexpected outbound connections from pods in the 'production' namespace. Which Falco rule condition is MOST appropriate?

An administrator wants to ensure that no service account in the 'development' namespace has cluster-admin privileges. Which command should be used to identify such bindings?

A Kubernetes cluster is experiencing issues where pods cannot pull images from a private container registry. The registry requires authentication via imagePullSecrets. The cluster has a pod running with the following spec snippet. What is the likely cause of the failure?

You run kube-bench on a node and it reports a failure for control plane component etcd. The check says 'Ensure that the --cert-file and --key-file arguments are set as appropriate'. You examine the etcd manifest file and find that the cert-file and key-file are configured with a self-signed certificate. What is the BEST action to remediate this finding?

Which THREE practices help ensure the integrity and confidentiality of container logs in a Kubernetes cluster?

A pod runs with 'hostNetwork: true' and 'hostPID: true'. Which security concern is MOST directly increased?

Which two of the following are recommended by the CIS Kubernetes Benchmark? (Choose two.)

An administrator wants to ensure that only images from a specific registry (e.g., myregistry.internal) can run in the cluster. Which tool can be used to enforce this via admission control?

An admin wants to scan a local filesystem for vulnerabilities using Trivy. Which command should they use?

Which audit policy level logs the request metadata and the request body?

You need to ensure that all containers in your cluster run with a read-only root filesystem. Which field should be set in the container's security context?

A ClusterRoleBinding grants cluster-admin to a service account in the 'kube-system' namespace. What is the best way to audit this for least privilege?

You need to configure Kubernetes audit logging to log all requests at the Metadata level for a specific namespace. Which audit policy level should you use?

Which TWO admission plugins should be enabled to improve cluster security according to CIS benchmarks? (Choose two.)

You are a security engineer at a fintech startup. The company runs a Kubernetes cluster in production with hundreds of microservices. Recently, a container image from a public registry was compromised, and the attacker injected a backdoor that exfiltrated customer data. The CISO mandates that all images must come from an internal registry that only stores approved, scanned, and signed images. Currently, developers build images locally and push them to Docker Hub, then reference those images in Kubernetes manifests. You have deployed Harbor as a private registry with vulnerability scanning and Cosign for signing. However, you notice that some pods are still running images directly from Docker Hub. You need to enforce that only images from your internal Harbor registry can be used in the cluster. You cannot change the Kubernetes manifests immediately because of a large backlog. You have access to the cluster's kubelet configuration and can modify cluster-level components. Which single action will most effectively block any pod that tries to use an image not hosted on your internal registry?

Which TWO of the following are best practices for securing container images?

You need to generate an SBOM for a container image. Which command should you use?

A security engineer is hardening a Kubernetes node and wants to ensure that kubelet does not accept requests from unauthorized sources. Which kubelet configuration change should be made?

A security team wants to automatically reject any Pod that uses an image tagged with 'latest'. Which tool can be used to define this policy at the admission level?

Which kube-apiserver flag enables audit logging?

Which Kubernetes resource is used to define audit logging configuration?

Which flag enables the NodeRestriction admission plugin on the API server?

Which three of the following are valid ways to enforce supply chain security in a Kubernetes cluster? (Select THREE.)

An incident responder needs to isolate a compromised pod immediately without deleting it. Which action should they take?

Which THREE of the following are valid ways to restrict access to etcd? (Select 3)

A DevOps engineer wants to ensure that all microservice containers run with a read-only root filesystem to prevent unauthorized writes. What is the simplest way to enforce this at the Pod level?

Which annotation is used to apply an AppArmor profile to a pod?

Match each Kubernetes security component to its description.

Which THREE Falco priority levels sequences are correctly ordered from lowest to highest severity? (Choose three)

In an Istio service mesh, you want to enforce mutual TLS (mTLS) between services in a specific namespace. Which resource should you create to set the default mTLS mode to STRICT for all workloads in that namespace?

Falco detects a shell being opened inside a container. Which Falco rule field is used to specify the syscall condition for detection?

A security audit reveals that the kube-apiserver is using the default insecure port 8080 on a production cluster. Which is the most secure and recommended remediation?

A cluster administrator needs to run a workload that uses gVisor (runsc) for container sandboxing. Which Kubernetes resource is required to enable this?

Which of the following commands creates a ValidatingWebhookConfiguration that uses an OPA Gatekeeper webhook?

An administrator wants to set an immutable root filesystem for a container in a Pod. Which securityContext field should be set to true?

Which Pod Security Standard level allows the use of hostNetwork, hostPID, and hostIPC?

Which command would you run to check if anonymous authentication is enabled on the API server?

A DevOps team is tasked with upgrading a Kubernetes cluster from version 1.21 to 1.22. They want to minimize downtime and follow best practices. Which approach should they take?

Which TWO of the following are valid AppArmor profile modes?

You run 'trivy image myapp:latest' and the scan reports several critical CVEs. What is the best action to take?

During a security audit, you run kube-bench and find that the API server audit logging is not enabled. Which set of flags should be added to the kube-apiserver to enable audit logging with a policy file located at /etc/kubernetes/audit-policy.yaml?

You need to run kube-bench on a control plane node. Which command should you use?

To encrypt secrets at rest in Kubernetes, an administrator configures an EncryptionConfiguration. What is the correct flag to pass to the kube-apiserver to use this configuration?

Which command loads an AppArmor profile from a file into the kernel?

An admin creates the following EncryptionConfiguration to encrypt secrets at rest. After applying it, what must the admin do to ensure existing secrets are encrypted?

A cluster administrator wants to encrypt secrets at rest in etcd. Which resource must be created to configure encryption?

An administrator runs 'trivy image myapp:1.0' and receives an output with several CRITICAL vulnerabilities. What is the best next step to ensure the image is secure before deployment?

You need to enable Kubernetes audit logging with the following requirements: log all requests at the 'RequestResponse' level, but only for successful responses. Which audit stage should you specify in the policy?

What is the default seccomp profile for Kubernetes containers when no seccompProfile is specified?

You need to configure a Kubernetes Pod to have an immutable root filesystem. Which field should you set in the Pod spec?

Which of the following correctly adds the NET_ADMIN capability to a container in a Kubernetes pod?

An admin runs 'kubectl get pod web -o yaml' and sees the following security context. Which setting prevents privilege escalation?

Which field in a Pod's securityContext prevents privilege escalation by the container?

Which TWO actions are recommended by the CIS Kubernetes Benchmark for securing etcd?

You need to restrict access to etcd so that only the API server can communicate with it. Which method should you use?

You are a security engineer at a company running a Kubernetes cluster in production. The cluster uses containerd as the container runtime and has been configured with Node Authorizer and NodeRestriction admission controller. Recently, a security audit revealed that several pods running as root have been compromised via container escape vulnerabilities. The audit report recommends hardening the nodes to reduce the attack surface. Specifically, you need to ensure that even if an attacker gains root access inside a container, they cannot execute privileged operations on the host node, such as loading kernel modules, modifying host network settings, or accessing host devices. The cluster runs on Ubuntu 20.04 nodes with Linux kernel 5.4. You have access to modify node-level configurations but must minimize performance impact and avoid breaking existing workloads that rely on standard Linux capabilities. Which of the following actions would most effectively mitigate these risks?

A pod fails to start with the error 'Container runtime network not ready', and the node uses Kata Containers (RuntimeClass: kata). What is the most likely cause?

A DevOps engineer wants to enforce that all container images running in the cluster are signed using Cosign. Which Kubernetes admission controller is designed for this purpose?

Which TWO actions help minimize vulnerabilities in microservices by securing secrets? (Choose two)

A security audit reveals that the etcd datastore is not encrypted at rest. Which resource should be created to enable encryption of secrets at rest?

You run 'kube-bench' on a cluster node and get a failure for the test 'Ensure that the --anonymous-auth argument is set to false' (ID: 1.2.1). Which file do you need to modify to fix this issue?

Which TWO of the following are valid methods to restrict etcd access? (Choose two.)

Order the steps to configure and apply a NetworkPolicy to restrict pod-to-pod traffic.

A team needs to set up a highly available Kubernetes control plane across three availability zones. What is the minimum number of etcd members required to achieve fault tolerance against one zone failure?

An administrator runs kube-bench on a node and sees a warning about the kubelet anonymous authentication being enabled. Which kubelet flag should be set to disable anonymous access?

Which ONE of the following is a valid method to restrict a container's filesystem to read-only in Kubernetes?

Which TWO of the following are valid methods to secure the etcd cluster in a Kubernetes setup?

A security team wants to ensure that all pods in a namespace run with a restricted seccomp profile. Which Pod Security Standard admission controller mode should be used to enforce this without blocking necessary pods?

Which admission plugin enforces that kubelets cannot modify pods they do not own?

Which THREE of the following actions help reduce the attack surface of containers? (Select 3 correct answers)

Arrange the steps to create and enforce a Pod Security Policy (PSP) in a Kubernetes cluster.

You are configuring kubelet to protect kernel defaults. Which flag enables this?

You are creating a ServiceAccount that should not automatically mount its token to pods. Which field should be set in the ServiceAccount manifest?

An admin has created an EncryptionConfiguration to encrypt secrets at rest in etcd. After applying the configuration and restarting the kube-apiserver, existing secrets are still stored in plaintext. What is the most likely reason?

A developer reports that a pod cannot reach an external database at 192.168.1.100:3306. The pod's namespace is 'app'. You need to create a NetworkPolicy that allows egress to that IP only. Which policy is correct?

What is the purpose of an SBOM (Software Bill of Materials) in the context of supply chain security?

Which command loads an AppArmor profile from a file into the kernel?

A cluster administrator wants to ensure that all pods in a namespace run with the `seccomp` profile set to `RuntimeDefault`. Which OPA Gatekeeper ConstraintTemplate would achieve this?

You need to enable audit logging for the Kubernetes API server to capture all requests at the RequestResponse level. Which flag should you add to the kube-apiserver configuration?

You want to run crictl to list all running containers on a node. Which command should you execute?

Which THREE of the following are recommended actions to secure the Kubernetes Dashboard? (Choose three.)

Which stage of the Kubernetes API request processing should be audited to capture the final response sent to the client?

A pod spec includes 'hostPID: true' and 'hostNetwork: true'. What security concern does this raise?

A security policy requires that all container images must be signed using Cosign. Which admission controller enforces signature verification at pod creation time?

A DevOps team deploys a microservice that needs to access a third-party API using credentials stored in a Kubernetes Secret. The team wants to minimize the risk of credential exposure. Which approach best achieves this goal while following security best practices?

Which of the following is a MutatingAdmissionWebhook that is built into Kubernetes and can automatically inject a sidecar proxy for service mesh?

You need to sign a container image using cosign with a key stored in an environment variable. Which command should you use?

Which flag disables anonymous authentication on the API server?

Which TWO of the following are valid Pod Security Context settings to harden a container? (Select 2)

Which THREE of the following are valid approaches to enforce that all pods in a cluster run with a read-only root filesystem? (Select THREE)

A security team suspects a compromised pod is making unexpected outbound connections to an external IP. Which of the following is the BEST first step to investigate the network traffic from that pod?

You need to enable encryption at rest for secrets in the cluster. Which resource should you create to configure encryption providers?

What does SBOM stand for in the context of supply chain security?

Which etcd encryption provider is considered strongest for encrypting secrets at rest?

Which TWO of the following are recommended practices for securing the Kubernetes Dashboard? (Select TWO)

You are writing a Falco rule to detect when a container tries to read the file `/etc/shadow`. Which condition in the Falco rule correctly matches this event?

An administrator wants to ensure that a Deployment uses a specific image digest (SHA256) instead of a tag. Which field in the Deployment YAML should be modified?

An administrator wants to secure etcd communication. Which of the following is required to enable TLS for client-to-etcd communication?

Which static analysis tool is specifically designed to evaluate Kubernetes manifests against security best practices?

Which TWO actions are recommended by the CIS Kubernetes Benchmark to secure the API server?

Which TWO of the following are valid Rego keywords used in OPA policies for Gatekeeper? (Select TWO)

You run kube-bench on a node and it reports a failure for 'Ensure that the --anonymous-auth argument is set to false' for the kubelet service. Which file must you modify to fix this?

A security auditor recommends enabling audit logging for the Kubernetes API server with a policy that logs all requests at the Metadata level. Which configuration ensures this requirement?

Which kubectl command can be used to check the CIS benchmark compliance of a Kubernetes cluster?

You want to run a container with gVisor for sandboxing. After installing gVisor and creating a RuntimeClass named 'gvisor', which Pod configuration enables it?

A cluster has been compromised due to a container running with privileged escalation. The team wants to prevent any container from gaining new privileges. Which configuration should be applied?

An administrator runs 'falco --list' and sees many default rules. What is the correct way to load a custom Falco rules file?

Which annotation is used to apply an AppArmor profile to a pod in Kubernetes?

An organization uses a GitOps workflow with Argo CD to deploy applications to Kubernetes. The security team wants to ensure that container images are immutable and signed. They currently use a private container registry (Harbor) with vulnerability scanning and Cosign for signing. Which combination of controls best enforces that only signed and scanned images are deployed?

A security engineer needs to ensure that all containers in a cluster run as non-root users. Which Pod Security Context field should be set to enforce this requirement?

You have deployed a service mesh with Istio and want to enforce mutual TLS (mTLS) for all traffic between services in the 'mesh' namespace. Which resource should you create?

You are asked to generate an SBOM for a container image and attach it as an attestation using cosign. Which two commands would you run in sequence?

Which TWO of the following are CIS Benchmark recommendations for securing the API server?

You are investigating a pod that may have been compromised. Which kubectl command allows you to run a shell inside the running container without overwriting the container's filesystem?

A cluster has EncryptionConfiguration with aescbc provider. After rotating the encryption key, what must be done to re-encrypt existing Secrets with the new key?

What is the primary purpose of an SBOM in supply chain security?

Given the exhibit, what will happen when a user creates a pod with an image from an untrusted registry?

Which command is used to check whether AppArmor is enabled and which profiles are loaded on a Linux node?

Which TWO of the following are valid ways to verify a container image signature using cosign?

A cluster has been hardened by setting --anonymous-auth=false and enabling RBAC. However, kube-bench still reports a failure for the kubelet check 'Ensure that the --anonymous-auth argument is set to false'. What could be the reason?

Which TWO of the following are valid ways to enable mTLS between services in a service mesh (e.g., Istio)?

Which TWO are benefits of using a distroless base image over a full OS image like Ubuntu? (Select two.)

Which kubectl command can be used to exec into a running container for forensic analysis during an incident response?

What is the purpose of the `allowPrivilegeEscalation: false` setting in a container's security context?

Which TWO of the following are effective measures to minimize the impact of a compromised microservice container in a Kubernetes cluster? (Choose two.)

Which of the following flags should be set on the kube-apiserver to disable anonymous authentication?

You are auditing RBAC and find a ClusterRoleBinding named 'admin-binding' that binds the 'cluster-admin' ClusterRole to a service account in the 'default' namespace. What is the security concern?

You are configuring kubelet security. Which flag prevents containers from modifying kernel parameters?

You are deploying a ValidatingWebhookConfiguration. The webhook server is running in the 'webhook' namespace, service name 'svc', port 443. Which clientConfig should you specify?

Which tool is used to load AppArmor profiles on a node?

You suspect a container has been compromised. You want to preserve the container's filesystem for forensic analysis before terminating the pod. Which approach should you use?

During a security incident, you need to snapshot the processes running inside a container without using kubectl exec. Which crictl command sequence can you use?

Which crictl command is used to view the logs of a specific container in a node?

An audit policy is configured with level: Request. Which operations are recorded in the audit log?

Which kubectl command creates a valid webhook configuration that validates pods against a policy?

What is the effect of setting 'hostPID: true' in a pod's spec?

A pod is configured with a custom seccomp profile stored at /var/lib/kubelet/seccomp/custom-profile.json. The pod manifest uses securityContext.seccompProfile with type: Localhost and localhostProfile: "custom-profile.json". The pod fails to start with an error 'seccomp profile not found'. What is the most likely cause?

Which THREE of the following are required to configure encryption of secrets at rest in Kubernetes?

A security policy requires that all ServiceAccounts in a namespace do not automatically mount their tokens. How can this be achieved at the namespace level?

Which command creates a ResourceQuota in the 'team-a' namespace?

Match each Kubernetes API server flag to its security function.

You are configuring an Istio service mesh for mTLS between services. Which resource defines the TLS mode for traffic between services in a namespace?

Which crictl command can you use to view the logs of a specific container?

Which THREE of the following are valid approaches to prevent containers from running as root in a Kubernetes cluster?

A user creates a Deployment with image 'alpine:3.18' and the Pod status is 'ErrImagePull'. The admin checks the image policy and sees that only images with SHA digests are allowed. What is the fix?

Which THREE of the following are valid methods to enforce pod security standards in a Kubernetes cluster?

A cluster uses Kyverno to enforce that all images come from a trusted registry. A new Deployment fails with a message that the image 'docker.io/library/nginx:latest' is not allowed. What Kyverno policy rule likely caused this?

A developer wants to ensure that a pod can only receive traffic from pods with label 'app: frontend' in the same namespace. Which NetworkPolicy egress rule should be applied to the source pods?

Which TWO of the following are recommended practices for securing container images and runtime?

You are securing a Kubernetes cluster that runs workloads from multiple teams. The cluster uses a private container registry and an admission controller to enforce image policies. Which TWO of the following actions are most effective in preventing the use of unapproved or tampered container images? (Choose two correct answers.)

Which THREE of the following are recommended incident response steps when a container is compromised?

You need to configure the Kubernetes API server to log all requests at the Metadata level. Which flag should you use when starting kube-apiserver?

Which of the following is a valid way to check the status of AppArmor profiles on a node?

During a security incident, you need to isolate a compromised pod named 'malicious-pod' in namespace 'default' to prevent it from communicating with other pods. Which command should you run?

Which TWO of the following flags are used to secure the kubelet?

A security admin wants to ensure all pods in a cluster drop ALL Linux capabilities. Which of the following YAML snippets should be added to a PodSecurityPolicy (assuming PSP is enabled) or a pod spec?

You have an existing deployment that uses environment variables for secrets. Which kubectl command can be used to update the deployment to mount secrets as volumes without recreating the pods?

An administrator wants to prevent containers from using hostNetwork, hostPID, and hostIPC. Which Pod Security Standard level enforces these restrictions?

A pod is running in a namespace that has a Kyverno policy requiring all images to come from a trusted registry. The pod is using an image from an untrusted registry. What will happen when the pod is created?

A security auditor runs kube-bench and reports that the kubelet is not configured with --protect-kernel-defaults. What is the impact of this misconfiguration?

Which admission plugin should be used to enforce Pod Security Standards at the namespace level?

Which of the following is the best practice for injecting secrets into a pod?

An administrator wants to prevent the kubelet from serving anonymous requests. Which flag should be set on the kubelet?

Which kubectl command creates a secret named 'mysecret' from a file called 'credentials.json'?

A DevOps engineer notices that a container's stdout logs are not appearing in the `kubectl logs` output. The container runs a legacy application that writes logs to a file inside the container. What is the most efficient way to capture these logs without modifying the application?

A container runs as non-root and needs to perform operations that require CAP_SYS_PTRACE. Which YAML snippet correctly adds only this capability while following the principle of least privilege?

An administrator runs kube-bench on a cluster node and receives failures for CIS benchmark checks related to kubelet configuration. Which kubelet flag should be set to ensure that kernel defaults are not used when they might be insecure?

Which THREE of the following practices help protect microservice applications against supply chain attacks? (Choose three.)

What is the purpose of the --audit-log-path flag on the kube-apiserver?

Which of the following is NOT a valid seccomp profile type in Kubernetes?

Which TWO of the following are valid ways to securely manage secrets in Kubernetes? (Choose two.)

Which TWO of the following are valid ways to reduce the attack surface of a Kubernetes node? (Select 2)

What is the purpose of the CIS Kubernetes Benchmark?

A Kubernetes cluster has Kyverno installed. You want to enforce that all container images come from a trusted registry 'trusted-registry.example.com'. Which Kyverno policy rule type would you use?

You need to ensure that all pods in a namespace have the label 'security: high' added automatically upon creation. Which admission controller should you use?

You are configuring encryption at rest for Kubernetes secrets. After creating an EncryptionConfiguration with aescbc provider, which additional step is required to enable encryption?

Which THREE of the following are features of container sandboxing solutions like gVisor or Kata Containers?

A Falco rule is configured to detect privilege escalation via setuid binaries. Which syscall is commonly associated with this activity?

A pod runs with a service mesh sidecar (Istio). The team wants to enforce mutual TLS (mTLS) for all traffic between services in the 'production' namespace. Which resource should be applied?

You want to enable mutual TLS (mTLS) between services in a namespace using Istio. Which custom resource should you configure to enforce STRICT mTLS for all workloads in the namespace?

You suspect a pod is making unexpected outbound connections. Which tool can you use to inspect network connections from within the container?

An admin runs 'kubectl auth reconcile -f rbac.yaml' and gets an error that the user does not have permission to create ClusterRoleBindings. What is the most likely cause?

Which TWO actions should be taken to secure etcd in a Kubernetes cluster?

A security engineer wants to ensure that only images signed with a specific key are allowed to run in the cluster. Which tool can be used to sign container images?

You are tasked with enabling audit logging for the Kubernetes API server. Which API server flag must be used to specify the audit log file path?

Which TWO tools can generate an SBOM for a container image? (Select two.)

An auditor requires that all audit logs from the Kubernetes API server be stored for 90 days and be tamper-proof. Which TWO measures should be implemented?

What is the default authorization mode for a new Kubernetes cluster?

During a security audit, a team discovers that their microservice application, deployed on Kubernetes, is vulnerable to container breakout attacks. The containers run as root and have many Linux capabilities. Which set of Pod Security Standards (PSS) enforcement modes and policies would best mitigate this risk?

A security best practice is to avoid storing secrets in environment variables. Which is a secure alternative for injecting secrets into a pod?

After a security incident, you need to restrict which pods can communicate with each other in the 'finance' namespace. You want to allow only pods with label 'app: api' to connect to pods with label 'app: db' on TCP port 5432, and deny all other traffic. Which NetworkPolicy should you create?

Which admission plugin is recommended by the CIS Kubernetes Benchmark to restrict the kubelet's ability to modify nodes?

A cluster administrator wants to monitor network traffic between pods for security analysis. Which tool is designed specifically for this purpose and integrates with Kubernetes?

An OPA/Gatekeeper ConstraintTemplate is defined with the following Rego rule: violation[{"msg": msg}] { container := input.review.object.spec.containers[_] container.securityContext.runAsNonRoot != true msg := "Container must run as non-root" } What happens when a pod is submitted with a container that has runAsNonRoot: true?

A cluster administrator wants to prevent all containers in a namespace from running with the NET_RAW capability. They plan to use a PodSecurityPolicy (PSP) but PSP is deprecated. Which approach should they use instead?

Which Kubernetes resource can be used to enforce that a container's filesystem is read-only?

An administrator wants to use gVisor to sandbox containers in a Kubernetes cluster. Which resource must be created to enable this?

A team wants to use an external secret manager (HashiCorp Vault) to inject secrets into pods. Which approach is most aligned with Kubernetes best practices?

You are investigating a security incident where a container ran a shell inside a pod. Which Falco rule condition would trigger on a shell spawned in a container?

Which TWO of the following are valid ways to enforce that containers cannot run as root in a Kubernetes cluster? (Select TWO.)

Which THREE of the following are valid ways to enforce mTLS in an Istio service mesh? (Select 3)

Which command is used to sign a container image with Cosign?

A cluster uses Kubernetes v1.24 with Pod Security Admission enabled. The cluster administrator wants to enforce that all pods in the 'production' namespace run with the 'restricted' policy level, but some existing deployments use privileged containers. Which approach ensures that only new pods violating the policy are rejected, while existing pods continue to run?

An OPA/Gatekeeper constraint requires that all images' registries match a pattern. A Deployment uses 'myregistry.io/app:v1'. The admission controller rejects it. The admin runs 'kubectl get constraints' and sees the constraint is active. What is the next debugging step?

An administrator runs kube-bench and receives a failing result for CIS control 1.1.1. What does this control typically check?

Which TWO of the following are recommended practices for securing the Kubernetes API server? (Select TWO)

You are a platform engineer for a financial services company. Your Kubernetes cluster runs on bare-metal nodes with Ubuntu 20.04 and uses containerd as the container runtime. The cluster is in production with 50 worker nodes. A recent security scan shows that all nodes have the 'overlayfs' kernel module loaded, which is not required. The security policy requires minimal kernel modules. You need to disable the module without disrupting running containers. What should you do?

Which TWO of the following are tools that can be used to generate an SBOM for a container image?

A security engineer wants to integrate image scanning into a CI/CD pipeline. They are using a tool that can scan the filesystem of the build context before building the image. Which tool is best suited for this purpose?

Which Pod Security Standard level allows the most relaxed security controls?

Which TWO of the following are best practices for securing the software supply chain in a CI/CD pipeline?

A container runs with the default seccomp profile but the application needs to make a specific syscall that is blocked. Which approach should be taken?

You have created a ValidatingWebhookConfiguration to reject pods without resource limits. When you try to create a pod without limits, it is created successfully. What is the most likely reason?

An administrator wants to ensure that a service account used by a deployment cannot automatically mount its token. Which field should be set to `false` in the Pod spec?

An organization uses Kubernetes with multiple namespaces and wants to ensure that containers running as non-root cannot escalate to root via setuid binaries. Which combination of security contexts and Pod Security Standards achieves this?

An administrator wants to run a container that requires the SYS_TIME capability. Which field should be used in the securityContext to add this capability?

Which TWO of the following are best practices for securing the container supply chain? (Select 2)

Which TWO of the following are valid ways to restrict access to the Kubernetes API server?

You are auditing a cluster's supply chain security. You find that many pods are running images from public registries without any pinning or verification. Which TWO actions would most effectively reduce the risk of pulling malicious images?

Which flag must be set on the API server to enable audit logging?

Which kubectl command is used to create a Constraint object in OPA/Gatekeeper?

Which of the following is a best practice for storing sensitive data like passwords in Kubernetes?

A pod is configured with securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 The volume mounted at /data is owned by user 1000 and group 2000. The container process inside the pod writes to /data. Which statement about file ownership is true?

A security admin wants to drop all Linux capabilities for a container and then add only CAP_NET_BIND_SERVICE. Which YAML snippet correctly achieves this?

Which of the following is the best practice for providing sensitive data like passwords to a pod?

An admin runs 'kubectl get pods' and sees a pod in 'CrashLoopBackOff' state. The pod's containers have a restart policy of 'Always'. What is the most likely cause?

An administrator runs 'kubectl auth can-i --list --as=system:serviceaccount:ns1:my-sa' and sees that the service account has 'create pods' permission via a RoleBinding. Which command can be used to delete that RoleBinding?

Which THREE of the following are recommended practices for securing the etcd datastore?

You suspect a container is running an unexpected process. Which crictl command can you use to list all running containers on the node?

A DevOps engineer is setting up a CI/CD pipeline to scan container images for vulnerabilities. They want to fail the pipeline if any critical vulnerabilities are found. Which command should they use to scan the image and produce a JSON output that can be parsed?

Which TWO of the following are valid audit stages in Kubernetes audit logging?

An OPA/Gatekeeper constraint is configured to allow only images from 'trusted-registry.io'. A pod is created with image 'trusted-registry.io/app:v1' but is denied. Which is the MOST likely cause?

Which admission plugin should be enabled on the API server to enforce that kubelet cannot modify nodes other than its own?

Which TWO of the following are valid methods to securely manage secrets in Kubernetes?

Which THREE are valid methods to verify the integrity and origin of a container image? (Select 3)

You are a security engineer for a large e-commerce company. The Kubernetes cluster runs on-premises and hosts critical payment processing applications. Recently, a security scan revealed that several pods are running with privileged escalation enabled, and some have a writable root filesystem. The cluster uses Kubernetes v1.26 with PodSecurity admission controller enabled but currently set to 'privileged' profile for all namespaces. The development teams require flexibility for some legacy applications that need to run with hostNetwork or hostPID. However, the security team wants to enforce a restricted profile for most namespaces while allowing exceptions. The CISO has mandated that no pod should run as root, and all pods must have read-only root filesystem and privilege escalation disabled. Additionally, any pod that requires hostNetwork or hostPID must be explicitly approved and placed in a separate namespace. You need to design a solution that meets these requirements with minimal operational overhead. What is the best course of action?

An admin wants to enforce that all pods in a namespace use a read-only root filesystem except for a specific deployment that needs to write to a temporary directory. Which approach best meets this requirement?

Which two of the following are correct ways to enforce least privilege for service accounts? (Choose two.)

A pod in namespace 'secure' has the following securityContext: securityContext: runAsNonRoot: true runAsUser: 1000 capabilities: drop: ["ALL"] add: ["NET_BIND_SERVICE"] The pod fails to start. The namespace is enforced with the 'restricted' Pod Security Standard. What is the most likely reason?

A DevOps engineer wants to ensure that all pods in a namespace have seccomp set to RuntimeDefault unless explicitly overridden. Which approach should be used to enforce this?

Which THREE of the following are valid techniques for isolating a compromised pod during incident response? (Choose three)

Which command creates a validating webhook configuration that checks all pods in the cluster?

Which TWO of the following are recommended practices for securing the Kubernetes dashboard?

A security audit reveals that a ServiceAccount named 'monitor' has a ClusterRoleBinding to the cluster-admin role. What is the best remediation?

You are a security engineer for a financial services company running a Kubernetes cluster with 50 nodes. The cluster uses containerd as the container runtime and Calico for networking. The security team has detected unusual outbound network connections from a pod running in the 'payments' namespace to an external IP address known to be a command-and-control server. The pod is part of a Deployment named 'payment-processor' with 3 replicas. The cluster has a Falco daemonset deployed with default rules, and audit logging is enabled for the API server. You need to quickly identify the compromised container and contain the threat. Which action should you take FIRST?

A pod is running with a custom seccomp profile located at /var/lib/kubelet/seccomp/my-profile.json. Which securityContext configuration correctly applies this profile?

You need to encrypt etcd data at rest using AES-CBC. Which encryption provider should you specify in the EncryptionConfiguration?

Which TWO are tools for static analysis of Kubernetes manifests? (Select 2)

During a cluster upgrade, the kubelet on a worker node fails to start after updating the kubelet binary. The kubelet logs show: 'failed to load bootstrap client certificate: open /var/lib/kubelet/pki/kubelet-client-current.pem: no such file or directory'. What is the most likely cause?

Which flag must be provided to the kube-apiserver to enable audit logging?

Match each Kubernetes admission controller to its role in security.

Which TWO of the following are valid methods to ensure only signed images are deployed in a Kubernetes cluster?

Which THREE of the following are common indicators of a container compromise that Falco can detect? (Select 3)

A security team wants to use OPA/Gatekeeper to enforce that all namespaces must have a label 'security-tier' with value 'high' or 'medium'. What is the correct approach?

An administrator wants to prevent pods from using secrets as environment variables and enforce that secrets are only mounted as volumes. Which admission controller could be used to achieve this?

A pod is stuck in Pending state. You run 'kubectl describe pod' and see the event: '0/3 nodes are available: 3 Insufficient cpu'. What is the likely cause?

In a CI/CD pipeline, at which stage should container image scanning be performed?

Which of the following is the correct way to drop all Linux capabilities for a container?

You want to run a container with gVisor (runsc) runtime for sandboxing. Which resource is required to use a non-default runtime?

An admin runs 'kubectl describe pod secure-pod' and sees 'seccompProfile: RuntimeDefault' under the container's security context. Which seccomp profile is being used?

You have deployed a pod and set `securityContext.readOnlyRootFilesystem: true`. The pod is failing to start with an error about writing to `/tmp`. What is the most likely cause?

Which annotation is used to apply an AppArmor profile to a pod in Kubernetes?

Which TWO actions are effective for detecting and preventing container breakout attempts using runtime security tools?

A security team wants to detect any attempt to spawn an interactive shell inside a container. Which Falco rule condition would be appropriate?

Given the following PodSecurityPolicy (PSP) snippet, which statement about the allowed containers is correct?

Which THREE of the following are effective methods to preserve evidence during a container security incident?

An administrator runs 'crictl ps' and sees no containers listed, but kubectl shows running pods. What is the most likely cause?

Which audit stage is logged after the request is fully processed and the response is sent?

You need to detect any attempt to run a shell inside a container using Falco. Which macro or condition should you use?

A pod is running in the 'default' namespace with a container that has an immutable root filesystem (readOnlyRootFilesystem: true). The application writes logs to /var/log/app.log. What will happen?

Which THREE of the following are valid flags for the 'trivy image' command to output results in different formats?

Which audit policy level logs all requests and responses, including the request body and response body?

A ValidatingWebhookConfiguration is not working as expected. The webhook server is running and accessible. What is a common misconfiguration that would cause the webhook to not be called?

A Falco rule triggers when a shell is spawned inside a container. Which condition correctly identifies bash or sh being executed as the first process (PID 1)?

A security auditor wants to verify that the AppArmor profile 'my-profile' is in enforce mode on a running container. Which command should they run inside the node?

You need to ensure that all pods in a namespace can only communicate via mTLS. In Istio, which resource should you apply?

Which THREE of the following are recommended practices for securing Kubernetes Dashboard?

Which TWO of the following are best practices for hardening Kubernetes Dashboard?

Which TWO of the following are valid audit policy levels in Kubernetes? (Choose two.)

To protect kernel defaults on a node, which flag should be set on the kubelet?

An administrator runs 'kubectl get pods' and sees that a pod is in 'Pending' state. What is the most likely reason for this state?

A security best practice for Dockerfiles is to avoid hardcoded secrets. Which Dockerfile instruction is MOST likely to contain a hardcoded secret?

You need to configure Kubernetes audit logging to log all requests at the Metadata level except for requests to the 'kube-system' namespace, which should be logged at Request level. How should you structure the audit policy?

You need to create a ClusterRole that allows listing secrets, but only in namespaces that have a specific label 'security-level=high'. Which approach should you use?

A security audit reveals that a container image running in production contains a critical vulnerability (CVE-2024-1234). The image was built from a base image that had the vulnerability. What is the MOST effective long-term solution to prevent such issues?

A cluster is using kubeadm and the control plane components are running as static pods. Where are the static pod manifests for the API server located by default?

Which annotation is used to apply an AppArmor profile named 'custom-profile' to a container named 'app' in a pod?

Which TWO of the following are best practices for Dockerfile security according to CKS guidelines?

An administrator wants to disable anonymous authentication to the Kubernetes API server. Which flag should be added to the kube-apiserver configuration?

An administrator wants to enable audit logging for the Kubernetes API server. Which of the following is required?

You are tasked with creating a ConstraintTemplate in OPA/Gatekeeper that denies pods running with the 'latest' image tag. Which Rego rule should the ConstraintTemplate include?

Which THREE of the following are valid capabilities that should be dropped for a container running a typical non-privileged application to adhere to the principle of least privilege?

Which of the following is the correct way to apply an AppArmor profile named 'my-profile' to a pod using the annotation?

You have a pod that is in CrashLoopBackOff. You want to inspect the logs from the previous instance of the container. Which flag should you use with kubectl logs?

Which THREE stages can be configured for Kubernetes audit logging?

An administrator wants to secure etcd communication. Which of the following is required?

A pod's container tries to read environment variables that contain database credentials. The cluster has an external secrets manager (HashiCorp Vault) integrated via a sidecar. Which approach is MOST secure for exposing secrets to the container?

Arrange the steps to configure and use Trivy to scan container images for vulnerabilities in a CI/CD pipeline.

An administrator creates a custom seccomp profile and places it at /var/lib/kubelet/seccomp/myprofile.json. Which securityContext field is used to apply this profile to a container?

You are responsible for a production Kubernetes cluster running critical workloads. The cluster uses containerd as the container runtime. The security team has deployed Falco with default rules and it is running as a DaemonSet. Recently, the team noticed that several pods have been unexpectedly terminated by the OOMKiller. You suspect a container is performing a fork bomb attack, exhausting memory. You need to detect and prevent such attacks in real-time. Falco is already installed. Which single action should you take to best address this threat?

You have built a custom seccomp profile at /var/lib/kubelet/seccomp/audit.json. Which YAML snippet correctly applies this profile to a container?

You need to encrypt secrets at rest in a Kubernetes cluster. What must be configured?

You want to drop all Linux capabilities from a container. Which securityContext field should you set?

Which of the following is the correct flag to enable audit logging on the kube-apiserver?

You run 'crictl ps' and see no output, but the node has running pods. What is the most likely cause?

A security policy requires that all container images must reference a specific SHA256 digest instead of a tag. You need to enforce this using Kyverno. Which Kyverno rule type and pattern would you use?

Which TWO of the following are effective measures to harden the Kubernetes API server against unauthorized access?

Which crictl command lists all running containers on a node?

Which TWO admission plugins are recommended to be enabled for security hardening?

Which kubectl command(s) can you use to view the logs of a specific container in a multi-container pod? (Select all that apply)

An administrator wants to restrict which nodes a pod can be scheduled on using the NodeRestriction admission plugin. Which flag must be set on the kube-apiserver to enable this plugin?

Which flag enables the PodSecurity admission plugin in kube-apiserver?

An admin runs 'kubectl run test-pod --image=nginx:latest' and the Pod is created but immediately enters 'CrashLoopBackOff'. 'kubectl describe pod test-pod' shows 'Back-off restarting failed container'. Which admission controller might cause this if misconfigured?

An OPA Gatekeeper ConstraintTemplate uses a Rego rule that denies pods without a specific label. The Constraint is created but pods without the label are still being allowed. What is the MOST likely cause?

A pod runs with a service account that has a ClusterRoleBinding granting cluster-admin. What is the best practice to reduce the risk of privilege escalation?

You run 'kubectl auth can-i --list --as=admin' and see that the admin user has full cluster-admin access. Which command would create a ClusterRoleBinding for a user named 'viewer' with read-only access to all resources?

Which flag on the kubelet disables anonymous access?

A developer creates a Dockerfile with 'FROM ubuntu:latest'. The security team recommends using a minimal base image. Which change minimizes the attack surface?

An administrator wants to restrict a service account to only be able to create pods in the 'development' namespace. Which RBAC configuration should be used?

You want to isolate a compromised pod by blocking all network traffic to and from it. Which NetworkPolicy would you apply?

A developer created a ClusterRoleBinding that grants cluster-admin to a service account. What is the security concern?

A cluster administrator wants to ensure that pods cannot modify node objects. Which admission plugin should be enabled?

A pod runs with an immutable root filesystem (readOnlyRootFilesystem: true). The application attempts to write to /tmp. What is the expected behavior?

A pod manifests with securityContext: { runAsNonRoot: true, runAsUser: 1001 }. However, the container image expects to run as root (UID 0). What will happen when the pod is created?

Which of the following is a static analysis tool for Kubernetes manifests?

You are configuring ImagePolicyWebhook admission controller to reject images not signed by a trusted authority. After deploying the webhook, you notice that pods are being rejected even for images that are properly signed. Which configuration change is MOST likely to fix this?

A DevOps team is deploying a new microservice that processes sensitive payment data. The security policy requires that all file system writes outside the /tmp directory be logged and alerted. Which runtime security tool and configuration best achieves this requirement with minimal performance impact?

An admin runs 'crictl ps' on a node and sees multiple containers. Which command should they use to view the logs of a specific container?

Which THREE of the following are recommended measures to reduce the attack surface of Kubernetes nodes?

Which TWO of the following are valid modes for an AppArmor profile?

A security engineer needs to ensure that all communication between nodes and the control plane is encrypted. Which component must be configured with a TLS certificate to achieve this?

You are asked to secure a set of microservices running in a Kubernetes cluster. Which TWO of the following practices help minimize vulnerabilities in microservices?

A security scan reports that the etcd data directory is not encrypted at rest. The cluster uses etcd v3.5. Which steps are required to enable encryption?

You are implementing a Gatekeeper policy to deny pods that run as root. Which Rego rule should you include in the ConstraintTemplate?

You need to isolate a compromised pod named 'malicious-pod' in the 'default' namespace so that it cannot communicate with any other pod, but can still receive traffic from a specific monitoring pod. Which NetworkPolicy should you apply?

Which kubectl command would you use to create a ValidatingWebhookConfiguration from a YAML file?

Which kubectl command would you use to create a Secret from a file named 'db-password.txt'?

Which kubelet flag should be set to ensure the kubelet does not allow anonymous requests?

An administrator needs to preserve evidence from a compromised container. Which approach is BEST for capturing the container's filesystem and memory for later analysis?

A pod is stuck in Pending state. 'kubectl describe pod' shows the event: '0/4 nodes are available: 1 node had taint {node-role.kubernetes.io/control-plane: }, that the pod didn't tolerate, 3 Insufficient memory.' The pod YAML does not specify any tolerations. Which command would allow the pod to schedule on the control-plane node?

Which TWO of the following are valid Pod Security Standards levels?

To reduce the attack surface, a security best practice is to drop all capabilities from a container and add only those required. Which securityContext field is used to drop all capabilities?

You want to ensure that the Kubernetes Dashboard is accessed only by authenticated users with specific permissions. What is the BEST approach?

A Kubernetes cluster has Kyverno installed. A policy requires that all images come from a trusted registry 'trusted.example.com'. A Deployment uses the image 'nginx:latest'. When the Deployment is created, it is blocked. What Kyverno policy action is being used?

A DevOps engineer runs 'trivy image myapp:latest' and finds a critical CVE in the base image. Which Dockerfile change would BEST address this?

A Kyverno policy is written to require all images to use SHA256 digests instead of tags. The policy uses a 'validate' rule with 'pattern' on 'spec.containers[*].image'. Which pattern would match an image reference like 'registry.example.com/myapp@sha256:abc123...'?

In a CI/CD pipeline, which step is MOST effective for detecting known vulnerabilities in a container image before deployment?

You need to set up a ValidatingWebhookConfiguration to deny pods that run as root. The webhook server is deployed in the 'webhook' namespace with service 'webhook-svc' on port 443. Which of the following is a correct snippet for the webhook configuration?

Which of the following is the correct way to drop all capabilities in a container's security context?

Which TWO of the following are valid methods to verify the integrity of a container image in a Kubernetes supply chain? (Select 2)

Which kubectl command can be used to execute a shell inside a running container for forensic analysis?

A security engineer is configuring a Kubernetes cluster to meet CIS benchmark recommendations. The cluster uses kubeadm for bootstrapping. Which action should be taken to ensure the kube-apiserver is hardened against unauthorized access?

A cluster has a PodSecurityPolicy that requires 'RunAsAny' for the user. An administrator wants to enforce that all pods in namespace 'production' must run with a specific seccomp profile. Which approach is recommended given PSP is deprecated?

Which THREE of the following are valid methods to secure etcd?

An administrator wants to ensure that containers in a pod cannot run with any Linux capabilities except the minimal required for the container runtime. The pod is subject to the 'restricted' Pod Security Standard. Which capability configuration should be set in the pod's security context?

Which THREE of the following are valid ways to manage secrets in a Kubernetes environment? (Select THREE)

A security team wants to ensure that all containers in a pod run with only the minimum required Linux capabilities. Which of the following approaches is BEST?

An administrator runs 'kubectl get clusterrolebindings' and notices a ClusterRoleBinding named 'admin-binding' that binds the 'cluster-admin' ClusterRole to a service account in the 'default' namespace. What security concern does this raise?

Match each Kubernetes network security concept to its definition.

Which TWO of the following are valid methods to apply a custom seccomp profile to a pod in Kubernetes?

Which TWO of the following are best practices for minimizing microservice vulnerabilities in a Kubernetes cluster?

Which TWO crictl commands can be used to inspect a running container?

Which TWO of the following are best practices for securing secrets in Kubernetes?

Which of the following is NOT a recommended method to reduce the attack surface on Kubernetes nodes?

You are auditing a cluster for runtime security best practices. Which TWO of the following actions are recommended to improve container runtime security?

Which TWO resources can be used to implement RBAC in Kubernetes?

Refer to the exhibit. A cluster has the ClusterImagePolicy shown. A developer creates a pod with an image from registry.example.com/myapp:v1, which was built and signed by a GitHub Actions workflow that is NOT defined in the policy (different workflow). Which behavior will occur when the pod is created?

Arrange the steps to enable and configure audit logging in Kubernetes.

A cluster has PodSecurity admission enabled. A developer creates a pod with the following security context: 'securityContext: { capabilities: { drop: ["ALL"], add: ["NET_ADMIN"] } }'. The namespace is labeled 'pod-security.kubernetes.io/enforce: baseline'. Will the pod be allowed?

Which TWO of the following are recommended practices for etcd security?

You run 'kubectl auth can-i create pods --as=system:serviceaccount:default:sa1 -n default' and get 'no'. What does this mean?

During a CI/CD pipeline, you run 'trivy image myapp:latest' and get a high number of vulnerabilities. What is the BEST action to reduce the vulnerability count?

Which kubectl command is used to check the AppArmor status on a Kubernetes node?

During a security audit, you discover that a container running as root inside a pod has been compromised. The pod uses the default service account. Which two measures should you implement to harden the cluster? (Select TWO)

An administrator wants to enable Kubernetes audit logging with the following requirements: log all requests at the Metadata level, but log all responses at the Request level. Which audit policy configuration achieves this?

Which THREE of the following are valid audit stages in Kubernetes audit logging? (Select THREE.)

Which TWO of the following are recommended CIS Kubernetes Benchmark controls for securing the kube-apiserver?

You want to detect any attempt to run a shell inside a container that is not running as root. Which Falco condition would you use?

Which kubectl flag disables anonymous authentication on the API server?

Match each Kubernetes security tool or feature to its purpose.

You need to configure Kubernetes audit logging to log all requests to the 'secrets' resource at the RequestResponse level. Which audit policy rule would achieve this?

Which of the following host access settings should be disabled to reduce the attack surface of a container?

You deploy the Kubernetes Dashboard using the official YAML manifests. Which of the following is the MOST secure approach to expose the Dashboard?

A security engineer runs 'kubesec scan deployment.yaml' and receives a score of -1. What does this score indicate?

You are writing a Falco rule to detect privilege escalation via setuid binaries. Which syscall should the rule monitor?

Order the steps to perform a Kubernetes cluster upgrade from version 1.24 to 1.25.

You are configuring etcd encryption at rest. After placing the EncryptionConfiguration YAML file, you must modify which file to point the API server to it?

Which admission plugin should be enabled on the kube-apiserver to restrict kubelet permissions and prevent nodes from modifying their own Node objects?

A container has been compromised. You need to isolate it by denying all network traffic. Which NetworkPolicy manifest achieves this?

Which TWO of the following are valid audit stages in Kubernetes audit logging?

You are using `crictl` to debug a container that is not responding. Which command should you use to get the list of running containers?

Which flag on the kubelet helps ensure it runs securely by enforcing kernel defaults?

A security auditor requires that all container images used in the cluster are scanned for vulnerabilities before deployment. The team uses a private registry with image signing. Which solution enforces that only signed and scanned images are deployed?

Which RBAC resource should be used to grant cluster-wide permissions to a user?

Which kubectl command signs a container image using Cosign?

You need to enforce that no pod runs with privileged containers or runs as root. Which tool can define policies that block such pods at admission time?

You need to ensure that all pods in a cluster run with read-only root filesystems. Which Pod Security Standard (PSS) control field should be set to true?

A cluster administrator wants to ensure that a specific service account (my-sa) cannot have its token mounted automatically in pods. Which setting should be applied to the service account?

A security team wants to detect any attempt to read the /etc/shadow file inside a container. Which Falco rule condition would detect this syscall?

A ClusterRoleBinding named 'admin-binding' binds the cluster-admin ClusterRole to a service account 'sa-admin' in namespace 'ns1'. What is the security concern?

Which TWO kubelet flags are recommended by the CIS Kubernetes Benchmark to enhance security? (Select TWO)

You need to configure Kubernetes audit logging to log all requests to the 'secrets' API. Which audit policy level captures the body of the request?

You are tasked with ensuring that all container images in your cluster are scanned for vulnerabilities before being deployed. You have set up Trivy in your CI/CD pipeline and want to enforce that only images with no critical vulnerabilities are allowed. Which admission controller should you configure to reject pods using non-compliant images?

After deploying a pod with an AppArmor profile, the pod status shows 'ContainerCreating' for a long time and then fails. What is the most likely cause?

An administrator wants to enable encryption at rest for secrets in a Kubernetes cluster. They create the following EncryptionConfiguration and place it at /etc/kubernetes/enc/enc.yaml. Which flag must be added to the kube-apiserver to use this configuration?

Which Kubernetes resource should be used to restrict egress traffic from pods?

A Falco rule has the following output: 'Sensitive file opened for reading (user=root command=cat /etc/shadow)'. Which macro is most likely used in the rule condition?

A security engineer wants to ensure that all container images in a Kubernetes cluster have a non-root user. Which admission controller can enforce this requirement?

Which TWO actions would help secure the Kubernetes Dashboard?

Which THREE of the following are valid encryption providers that can be used in EncryptionConfiguration for encryption at rest?

Which TWO of the following are benefits of using an SBOM (Software Bill of Materials) in supply chain security?

Which TWO of the following are valid AppArmor profile modes? (Select two.)

You have a Kyverno policy that validates image registries. The policy should allow only images from `myregistry.example.com`. Which Kyverno rule field should be used to check the image registry?

Which admission plugin should be enabled to prevent kubelets from modifying nodes or pods they do not own?

What is the purpose of setting a container's filesystem to read-only in a Pod spec?

A security team wants to enforce that containers in a specific namespace cannot gain new capabilities. Which Pod security context field is used to achieve this?

Which THREE of the following are valid AppArmor profile modes?

An admin runs 'kubectl run test-pod --image=busybox --command -- sleep 3600' and then executes 'kubectl exec test-pod -- cat /var/run/secrets/kubernetes.io/serviceaccount/token'. The admin wants to prevent such access to the service account token. What is the correct action?

A Falco rule is written to detect when a shell is spawned inside a container. The rule condition is: `spawned_process and container and proc.name = bash`. The rule is not triggering. Which of the following is the most likely reason?

A developer creates a Deployment with the following container spec: ```yaml containers: - name: app image: myapp:latest env: - name: DB_PASSWORD valueFrom: secretKeyRef: name: db-secret key: password ``` Which of the following is a security concern with this approach?

A security auditor reviews a Kubernetes cluster and finds that several nodes have container runtimes with default configurations. Which TWO of the following actions should be taken to harden the container runtime?

A pod is failing to start with: 'Error: container has runAsNonRoot and image will run as root'. The pod spec sets securityContext.runAsNonRoot: true. The container image is 'nginx:latest' which runs as root. Which change allows the pod to run while maintaining security?

A pod is stuck in 'Pending' state. You run 'kubectl describe pod mypod' and see the event: '0/1 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate'. What is the most likely solution?

An administrator runs `kube-bench` on a Kubernetes node and receives a warning that the kubelet is configured with `--anonymous-auth=true`. Which kubectl command should be used to fix this on the kubelet?

Which of the following is NOT a valid method to enforce pod security standards in a Kubernetes cluster?

Which admission plugin should be enabled to ensure that kubelet only serves pods bound to its node and prevents unauthorized node access?

You want to ensure that a container's root filesystem is immutable. Which field in the Pod spec should you set?

You are deploying an application that needs to access a database password stored in a Kubernetes Secret. To minimize risk, you should mount the Secret as a volume rather than using environment variables. Which of the following is the primary security benefit of using mounted volumes over environment variables?

A pod has the following security context: capabilities: { drop: ['ALL'] } and privileged: false. The pod fails to start because it requires the ability to run iptables commands. Which of the following should be added to the pod's security context?

Which TWO of the following are valid methods to verify the integrity of a container image? (Select 2)

An administrator wants to reduce the attack surface of a Kubernetes node by disabling unnecessary system services. Which of the following services is considered unnecessary on a dedicated Kubernetes worker node and can be safely disabled?

Which TWO of the following are valid Kubernetes RuntimeClass handlers for container sandboxing? (Choose two.)

Which of the following is a best practice for securing container images in a CI/CD pipeline?

A cluster administrator wants to apply a custom seccomp profile located at '/var/lib/kubelet/seccomp/audit.json' to a pod. Which YAML snippet correctly configures the pod's security context to use this profile?

Which crictl command is used to list all running containers managed by the container runtime?

Which of the following is a CIS benchmark recommendation for securing the Kubernetes API server?

A cluster's API server is configured with --authorization-mode=RBAC,Node. A kubelet attempts to create a ConfigMap. Which authorizer will evaluate the request?

Match each Kubernetes command to its function related to security.

Which of the following YAML snippets correctly configures a ServiceAccount with automountServiceAccountToken set to false?

You are using External Secrets Operator to sync secrets from HashiCorp Vault. The operator is deployed but secrets are not being created. Which resource defines the mapping between Vault secrets and Kubernetes secrets?

An administrator wants to enforce that only images signed by a trusted key can run in the cluster. They have configured cosign and want to use a Kubernetes admission controller. Which tool should they deploy?

A security team wants to detect attempts to read /etc/shadow inside containers. Which Falco rule condition would trigger on a container reading that file?

Which flag must be set on the kubelet to prevent it from using the default namespace for pods and to enforce that pods only use namespaces that match the node's assigned namespace?

An administrator wants to verify that an image was signed by a specific key before deploying. Which Cosign command should be used?

A developer created a ClusterRole 'pod-reader' with rules to get, list, and watch pods, and bound it to a user. The user reports they cannot list pods in namespace 'test', although the same commands work in the 'default' namespace. What is the most likely cause?

You need to enable encryption at rest for secrets in an existing cluster. Which resource should you create?

Which Linux capability must be added to a container to allow it to change the system time (e.g., using the 'date' command)?

Which crictl command is used to view the logs of a specific container?

You are a platform engineer at a financial services company. The production cluster runs a set of microservices that handle sensitive customer data. The cluster has been configured with Pod Security Standards (PSS) enforced via OPA/Gatekeeper. Recently, the security team identified that a new deployment of the `payment-processing` microservice is running with the `seccomp` profile set to `Unconfined`. This violates the company policy that requires all containers to use a runtime default seccomp profile. The deployment YAML does not explicitly set any security context for seccomp. The cluster's nodes are running containerd 1.6 with default seccomp profile enabled. The OPA constraint template checks that `securityContext.seccompProfile.type` is set to `RuntimeDefault` or `Localhost`. However, the deployment passes the OPA validation. What is the most likely reason the deployment is not being rejected by OPA, and how should you fix it?

An administrator deploys a Gatekeeper ConstraintTemplate with the following Rego policy: package k8srequiredlabels deny[{"msg": msg}] { input.request.kind.kind == "Pod" not input.request.object.metadata.labels["security-tier"] msg := "Pod must have label 'security-tier'" } After creating the Constraint, a user creates a Pod without the 'security-tier' label. What is the expected behavior?

You need to detect when a container attempts to mount the host's Docker socket. Which Falco macro or condition would you use?

A DevOps team wants to ensure that only signed images from a trusted registry are deployed in the cluster. They plan to use a webhook to intercept pod creation. Which tool is best suited for this task?

Which THREE of the following are true about Istio PeerAuthentication? (Select THREE.)

A service account 'monitor' needs to list pods in all namespaces. Which minimal RBAC configuration should you use?

You have deployed a DaemonSet to run a logging agent on every node. After an update, the new pods are stuck in 'Pending' state. You run 'kubectl describe pod ds-pod-xxxxx' and see '0/3 nodes are available: 3 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate'. What is the MOST likely cause?

A pod is in a Pending state with the event: 'failed to generate spec: failed to validate seccomp profile: seccomp profile not found'. The profile is stored at /var/lib/kubelet/seccomp/custom.json on the node. Which of the following is the MOST likely cause?

A cluster administrator wants to audit all pod creations and modifications using an admission webhook. Which resource type should be created to register the webhook?

A security audit reveals that etcd does not encrypt data at rest. Which resource must be created to enable encryption?

A pod named 'busybox-pod' is compromised. You want to isolate it from all other pods using a NetworkPolicy. Which YAML snippet correctly denies all ingress and egress traffic to/from the pod?

An administrator creates a custom seccomp profile and wants to apply it to a pod. The profile file is named 'audit.json' and is placed in the default seccomp directory on the node. Which securityContext field should be used?

A Falco rule has the condition: 'evt.type=open and fd.name contains /etc/shadow and container.id != host'. What is being detected?

A company uses kube-bench to scan their cluster. The report shows a warning: 'Ensure that the --authorization-mode argument is set to Node,RBAC'. What is the best way to fix this?

Which of the following fields in a PodSecurityPolicy (or Pod Security Standards) prevents a container from running as root?

Which TWO of the following are valid audit stages in Kubernetes? (Choose two.)

Which TWO of the following are recommended settings for the Kubernetes API server according to the CIS Kubernetes Benchmark? (Select TWO)

A ClusterRole named 'secret-reader' is defined with rules to get, list, and watch secrets. A RoleBinding in namespace 'app' binds this ClusterRole to a service account. Which of the following best describes the permissions of the service account?

In the context of service mesh (e.g., Istio), which resource is used to enforce mutual TLS (mTLS) between services in a specific namespace?

Which TWO of the following are valid arguments for the kubectl command to create a secret from a file? (Select TWO)

Which TWO actions are part of the CIS Kubernetes Benchmark recommendations?

Which THREE of the following are valid ways to secure etcd in a Kubernetes cluster? (Select THREE)

You are the lead security engineer for a large financial institution. The organization runs a Kubernetes cluster with 500+ microservices. The supply chain security team has implemented the following measures: (1) All images are built from a minimal base image (distroless) and scanned with Trivy before being pushed to a private registry. (2) Images are signed using cosign with a key stored in a hardware security module (HSM). (3) Kyverno policies enforce that only signed images from the private registry can run, and also enforce that containers run as non-root. (4) A binary authorization (binauthz) style admission controller verifies attestations. Recently, a critical vulnerability (CVE-2024-0001) was discovered in a popular open-source library used by several microservices. The library is included as a dependency in the base image. The vulnerability is remotely exploitable and has a CVSS score of 9.8. The security team needs to remediate this quickly. They have already patched the library and updated the base image. What is the BEST course of action to ensure all running pods use the new image?

Which of the following is a recommended practice for securing Kubernetes Dashboard?

An OPA/Gatekeeper ConstraintTemplate is written to enforce that all Deployments have the label 'app.kubernetes.io/name'. However, the Constraint does not deny Deployments without the label. What is the most likely cause?

A developer runs 'trivy image myapp:latest' and gets a report with several CRITICAL CVEs. Which action would BEST address the supply chain security risk?

Which of the following flags should be set to `false` to disable anonymous authentication to the Kubernetes API server?

A custom seccomp profile is defined as follows: { "defaultAction": "SCMP_ACT_ALLOW", "architectures": ["SCMP_ARCH_X86_64"], "syscalls": [ { "names": ["mkdir", "chmod"], "action": "SCMP_ACT_ERRNO" } ] } The profile is placed at /var/lib/kubelet/seccomp/deny-mkdir.json. Which pod securityContext configuration correctly applies this profile?

You are responding to a security incident where a pod named `compromised-pod` in namespace `default` is suspected of being used for cryptocurrency mining. You need to immediately isolate the pod from the network while preserving evidence. Which command sequence should you use?

A security team deploys the above pod and profile. The pod runs but a security scan reports that mount-related syscalls are being allowed instead of logged. What is the most likely reason?

A cluster administrator wants to ensure that all Secrets are encrypted at rest using AES-CBC with a key managed by the local Kubernetes API server. Which configuration is required?

Which Kubernetes admission controller is responsible for mutating and validating pod requests based on policies defined by OPA Gatekeeper?

A DevOps engineer needs to restrict the outbound network traffic from pods running in namespace 'secure-ns'. Which NetworkPolicy configuration achieves this by default?

An administrator wants to enforce mutual TLS (mTLS) between all services in an Istio service mesh. Which resource should be configured?

An administrator wants to enforce the Pod Security Standard 'restricted' for all pods in the 'secure' namespace. Which kubectl command correctly enables the PodSecurity admission controller for that namespace?

Which flag must be set on the kube-apiserver to disable anonymous authentication?

A CI pipeline fails with the error 'cosign: error: unable to verify image: no matching signatures' when running 'cosign verify --key pubkey.pem myregistry/myapp:latest'. The image was previously signed with a private key. What is the MOST likely cause?

Which TWO of the following are valid audit stages in Kubernetes?

A pod in namespace 'ns1' has automountServiceAccountToken: false. However, the container still has a mounted service account token at /var/run/secrets/kubernetes.io/serviceaccount. What is the most likely cause?

You need to enforce that all containers in a namespace run with a read-only root filesystem. Which OPA Gatekeeper resource would you use to define the policy?

Which flag disables anonymous authentication on the Kubernetes API server?

A security admin wants to ensure that only images signed with a specific key can run in the cluster. Which admission controller should be enabled?

Which flag is used when starting kube-apiserver to enable audit logging?

Which of the following is the recommended method to enable encryption at rest for secrets in etcd using the EncryptionConfiguration?

A developer wants to run a container that reads a secret from a mounted volume, not as an environment variable. Which volume type should they use?

Match each Kubernetes certificate type to its usage.

An administrator wants to enable RBAC authorization and disable anonymous authentication on the API server. Which set of flags should be added to the kube-apiserver configuration?

Which THREE of the following are recommended practices for minimizing microservice vulnerabilities related to container security?

A pod is failing with status 'CrashLoopBackOff'. The pod manifest includes a liveness probe that runs every 10 seconds. You suspect the probe is causing the crash. Which command would you use to verify the liveness probe configuration?

A security audit reveals that a service account 'monitor' is bound to the cluster-admin ClusterRole, which violates least-privilege. What is the best remediation?

Which of the following is a valid way to drop all capabilities from a container?

An administrator wants to monitor runtime security events in Kubernetes using Falco. Which component must be deployed as a DaemonSet to capture system calls from containers?

A developer wants to ensure that all containers in a pod run with a read-only root filesystem except for a specific volume mounted for writing logs. Which container-level security context field should be set to true?

Which THREE of the following are best practices for RBAC hardening in Kubernetes? (Select THREE)

A pod is using a RuntimeClass that specifies gVisor (runsc). Which of the following scenarios is most likely to cause the pod to fail?

You are a Kubernetes administrator for a fintech company that runs a payment processing service in a production cluster. The service consists of multiple microservices that communicate over the network. Recently, a security audit revealed that a compromised pod could potentially send malicious requests to other services because there are no network restrictions between pods. The security team has mandated that all inter-service traffic must be encrypted and authenticated, and that only necessary traffic should be allowed. You need to implement a solution that meets these requirements with minimal changes to the application code and minimal operational overhead. Which approach should you take?

An administrator wants to prevent pods from running as root. Which SecurityContext field should be set at the pod level?

A pod is running with the following security context: ```yaml securityContext: allowPrivilegeEscalation: false runAsNonRoot: true seccompProfile: type: RuntimeDefault ``` The pod is in a CrashLoopBackOff. The logs show: "exec user process caused: operation not permitted". What is the most likely cause?

Which admission plugin should be enabled to prevent kubelets from modifying Node objects they should not have access to?

Which of the following is a best practice for securing container images in a Kubernetes environment?

Which kubelet flag prevents the kubelet from serving anonymous requests?

Which of the following is a valid approach to enforce that containers cannot escalate privileges?

A cluster administrator wants to enforce that all pods in the 'restricted' namespace use the Restricted Pod Security Standard. Which command achieves this?

Which admission plugin is recommended by the CIS Benchmark to restrict what nodes can modify?

Which command can be used to view the logs of a container using the container runtime interface (crictl)?

During a security audit, it was found that some pods have access to the host network. How can an administrator restrict host network access for all pods in the cluster?

Which kube-apiserver flag enables encryption at rest for secrets?

An administrator creates a Pod with the following securityContext: securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 The container image has a binary that requires read/write access to /data, which is an emptyDir volume mounted by the Pod. The container fails to start with 'Permission denied' when writing to /data. What is the most likely cause?

Which TWO of the following are valid Pod Security Standard levels? (Select 2)

Which tool can generate an SBOM (Software Bill of Materials) from a container image?

You need to enforce that all pods in the 'production' namespace run with read-only root filesystems. Which OPA Gatekeeper resource do you create first?

Which TWO of the following are valid approaches to restrict which nodes a pod can run on?

Which of the following is NOT a valid priority level in a Falco rule?

A Falco rule is written to detect access to /etc/shadow inside a container. Which condition should be used?

Which TWO checks are performed by kube-bench for the master node?

Which THREE are valid admission controllers in Kubernetes? (Select three.)

An administrator runs `kube-bench` and sees that the check 'Ensure that the --protect-kernel-defaults flag is set to true' has failed. Which component does this check apply to?

An administrator wants to restrict pods from running as root. Which admission controller should be enabled?

A CI/CD pipeline builds a Docker image and pushes it to a registry. To ensure supply chain security, the pipeline should scan the image for vulnerabilities before deployment. Which of the following is the correct command to scan a local Docker image using Trivy?

Which TWO of the following are valid steps to respond to a runtime security incident where a container is suspected to be compromised? (Select two.)

An etcd cluster uses TLS for peer and client communication. You need to secure etcd further by enabling RBAC. Which flag do you set on the etcd process to enable authentication?

You need to ensure that all containers in a pod run as non-root. Which security context field should you set to enforce this?

Which TWO admission plugins should be enabled to improve cluster security according to the CIS Benchmark? (Select 2)

Which of the following host access settings should be avoided to minimize the attack surface from containers? (Select the setting that increases risk the most.)

A Falco rule detects unexpected outbound connections. Which condition would identify a connection to an external IP not in the allowed list?

You need to preserve forensic evidence from a compromised pod. Which TWO actions should you take?

You are creating a custom seccomp profile for a container that runs a binary requiring the 'write' syscall only. You place the profile JSON file at '/var/lib/kubelet/seccomp/profiles/write-only.json'. In the pod spec, which seccomp configuration correctly uses this profile?

An AppArmor profile is loaded in 'complain' mode. What happens when a pod with that profile attempts an action that violates the profile?

Which tool is commonly used to generate a Software Bill of Materials (SBOM) for a container image?

An administrator runs 'kube-bench master' and receives a warning that etcd has no client certificate authentication. What is the recommended remediation?

Which kubectl command lists all MutatingWebhookConfigurations in the cluster?

Which TWO practices help secure the Kubernetes Dashboard?

Which TWO are valid stages in a Kubernetes audit event? (Select 2)

Which THREE of the following are capabilities required for a Falco rule to detect privilege escalation via setuid binary execution? (Choose three.)

Which TWO of the following are valid ways to restrict access to etcd? (Select 2)

Order the steps to rotate a Kubernetes API server certificate.

A cluster has both ImagePolicyWebhook and a mutating webhook that adds a sidecar. The admin notices that even when ImagePolicyWebhook rejects an image, the mutating webhook has already added the sidecar. What admission ordering issue is occurring?

You want to allow only images from a specific registry (e.g., myregistry.io) to be deployed in your cluster. Which tool or approach is best suited for this requirement?

An administrator runs 'aa-status' on a node and sees a profile in 'complain' mode. What does this indicate?

An organization uses a private container registry and wants to ensure that only images built from a specific CI/CD pipeline are deployed. Which combination of measures provides the strongest guarantee?

You need to create an RBAC role that allows reading secrets only in namespace 'production'. Which ClusterRole and RoleBinding combination is correct?

Which of the following is a valid method to disable automatic mounting of service account tokens for a pod?

Which TWO of the following are valid methods to verify the integrity of a container image before deployment?

A security policy requires that all pods drop ALL Linux capabilities and disable privilege escalation. Which YAML snippet correctly implements this in the pod's security context?

A security team wants to ensure that all communication between the kubelet and the API server is encrypted. Which flag must be set on the kubelet to enforce this?

You suspect a container has been compromised and want to perform forensics using kubectl exec. Which command safely collects the container's process list without affecting the container?

Which container runtime is specifically designed for sandboxing containers with a lightweight kernel?

You are securing a cluster and want to ensure that service account tokens are not automatically mounted in pods that do not need them. Which THREE actions should you take?

You are using crictl to debug a container. Which command lists all running containers on the node?

You need to ensure a container's filesystem is immutable at runtime except for a temporary volume. Which Pod spec configuration achieves this?

An administrator applies the following manifest to enable audit logging: apiVersion: audit.k8s.io/v1 kind: Policy metadata: name: audit-policy rules: - level: Metadata resources: - group: "" resources: ["secrets"] Which audit level is being used for requests to the Secrets API?

Which THREE of the following are valid Falco rule priorities? (Select THREE.)

Which flag must be set on the kube-apiserver to disable anonymous authentication?

Which TWO of the following are valid audit stages in Kubernetes audit logging? (Choose two)

An audit policy is configured with the following rule: - level: Metadata resources: - group: "" resources: ["secrets"] What does this rule log for requests to the Secrets API?

In an Istio service mesh, you want to enforce mutual TLS (mTLS) between all services in the 'default' namespace. Which resource should you create?

A security audit reveals that several pods have the service account token mounted automatically. Which annotation should be added to the pod's service account to prevent automatic mounting?

Which of the following is the correct way to disable swap on a Kubernetes node to improve security?

Which THREE of the following are valid methods to restrict access to the Kubernetes Dashboard? (Choose three.)

You are tasked with enabling audit logging for the Kubernetes API server. You have created an audit policy file at /etc/kubernetes/audit-policy.yaml. Which flag must be added to the API server manifest to enable audit logging?

A security scanner reports that the Kubernetes dashboard is publicly accessible. Which recommended action should be taken?

Which of the following is the correct annotation to apply an AppArmor profile named 'my-profile' to a container named 'app' in a pod?

Which of the following is a static analysis tool for Kubernetes manifests that can identify security misconfigurations?

What is the primary purpose of using a service mesh like Istio for microservices security?

You need to configure the Kubernetes API server to enable audit logging at the 'Metadata' level for all requests. Which flag should be used when starting the kube-apiserver?

You are tasked with creating a Kubernetes admission controller that validates image signatures before allowing pods to run. Which admission controller should you configure?

Which THREE of the following are recommended practices for hardening RBAC in a Kubernetes cluster? (Select 3)

Which command correctly creates a secret from a file named 'config.json'?

Which THREE of the following are required when setting up a Kubernetes control plane with kubeadm for a production environment?

A cluster administrator wants to enforce Pod Security Standards at the namespace level using the built-in PodSecurity admission controller. The namespace 'test' should reject any pod that violates the 'baseline' level. Which command applies this correctly?

A security auditor runs kube-bench on your cluster and reports that the apiserver is using default service account tokens. Which admission plugin should be enabled to address this?

Refer to the exhibit. The pod fails to start with the error 'container has runAsNonRoot but image will run as root'. Which change would fix the issue?

Which admission plugin should be enabled on the kube-apiserver to enforce that kubelets cannot modify nodes they are not assigned to?

You need to run a container with a sandboxed runtime using gVisor (runsc). Which Kubernetes resource must be created first to enable this?

An administrator runs kubectl get clusterrolebindings and sees a binding named 'system:node'. This binding is part of the legacy node authorization. According to CIS benchmarks, what should be done with it?

Which of the following is a best practice for securing container images?

You are asked to ensure that a specific Kubernetes dashboard (e.g., kubernetes-dashboard) is not publicly accessible. The dashboard is deployed in the 'kube-system' namespace. Which NetworkPolicy should you apply?

A security auditor requires that all pods in a cluster must not run as root. Which Pod Security Standard (PSS) and enforcement mode should be applied at the namespace level?

Which THREE options are valid methods to secure etcd in a Kubernetes cluster?

Which of the following is a recommended practice when securing the Kubernetes Dashboard?

You want to ensure that kubelets only serve pods that have been scheduled by the API server. Which admission plugin should be enabled?

Which THREE flags should be set on the kubelet to comply with the CIS Benchmark for worker node security?

A security audit reveals that a Deployment uses an image with a mutable tag 'app:latest'. Which change ensures the image is immutable and traceable?

An administrator wants to enforce a policy that all containers must drop ALL capabilities and not allow privilege escalation. Which YAML snippet correctly implements this requirement in a PodSecurityPolicy-like manner using a security context? (Note: PodSecurityPolicy is deprecated; consider using a ValidatingAdmissionPolicy or OPA/Gatekeeper, but for this question choose the correct security context fields.)

You are deploying a microservice that must run as a non-root user and have a read-only root filesystem. Which two fields must be set in the PodSecurityContext or container SecurityContext?

You have a Falco rule that triggers on 'spawned a shell in a container'. The rule is firing too many false positives. Which field in the Falco rule could you modify to reduce false positives?

Arrange the steps to secure etcd in a Kubernetes cluster.

An administrator wants to enforce that all containers in a Kubernetes cluster run as non-root and have read-only root filesystems using OPA/Gatekeeper. Which two resources must be created?

Which TWO tools can be used to directly interact with a container runtime on a Kubernetes node without using kubectl?

Which THREE of the following are capabilities that should typically be dropped from a container to minimize vulnerabilities?

To encrypt secrets at rest, which file must be modified on the control plane nodes?

Which audit stage in Kubernetes audit logging captures the stage after a request is processed and before a response is sent?

Which kubectl command can be used to view the live logs of a container in a pod named 'my-pod'?

A pod named 'compromised-pod' is suspected of making unauthorized outbound connections. You want to isolate the pod using a NetworkPolicy. Which policy correctly denies all egress traffic from the pod?

Which Falco rule condition would detect an attempt to read the /etc/shadow file in a container?

Which TWO of the following are best practices for securing the container supply chain?

Which TWO of the following are recommended practices according to the CIS Kubernetes Benchmark? (Select 2)

Which THREE of the following are best practices for reducing the attack surface of Kubernetes nodes?

A NodePort service is not accessible from outside the cluster. Which command should you use to check if the service's endpoints are correctly populated?

An administrator wants to prevent a container from accessing the host's network. Which pod security context field should be set to false?

Which THREE of the following are required to implement a secure software supply chain using Kubernetes native features?

Which TWO of the following tools can generate an SBOM (Software Bill of Materials) for a container image?

Which TWO of the following are recommendations from the CIS Kubernetes Benchmark?

You are securing etcd. Which of the following is required to enable TLS client authentication for etcd?

Which THREE of the following are valid flags for enabling admission plugins on the API server?

An administrator runs `kubectl exec -it nginx-pod -- sh` and inside the container runs `curl http://example.com`. This succeeds. However, the administrator wants to detect such outbound connections using Falco. Which syscall should Falco monitor to detect this network connection?

An etcd cluster is configured with TLS. You need to enforce that only the API server can read and write to etcd. Which method should you use?

A security team wants to ensure that only container images from a trusted registry (mytrustedregistry.io) are deployed in the cluster. They plan to use OPA/Gatekeeper. Which kind of Gatekeeper constraint template and constraint should they create?

A pod is scheduled on a node that has the AppArmor profile 'my-profile' loaded in complain mode. The pod annotation specifies 'localhost/my-profile' but the container is running without the profile being enforced. What is the most likely cause?

A developer asks you to run a container with gVisor runtime. The cluster has a RuntimeClass named 'gvisor' defined. Which field must be added to the Pod spec to use gVisor?

Which Istio resource is used to enforce mutual TLS (mTLS) for all services in a namespace, ensuring that traffic between services is encrypted?

Match each Kubernetes object or feature to its primary security purpose.

Which THREE of the following are recommended steps when responding to a compromised pod?

You are investigating a compromised pod. You need to capture the contents of a file in the container without modifying the container. Which kubectl command should you use?

You have configured Kyverno to enforce that all Pods must have an image from a trusted registry. However, a newly created Pod is not being rejected even though it uses an untrusted image. What is the most likely reason?

Match each container security context setting to its effect.

A pod running in the cluster is in a CrashLoopBackOff state. You run 'kubectl describe pod <pod>' and see the following event: 'Warning BackOff Back-off restarting failed container'. Which command would you run to see the standard error output of the container?

Which TWO of the following are true about Kubernetes audit logging?

A cluster administrator has applied a PodSecurityPolicy (PSP) to restrict privileged containers. After upgrading to Kubernetes 1.25, they notice that PSPs are no longer working. What is the MOST likely reason?

You are auditing RBAC and find a ClusterRoleBinding named 'admin-binding' that binds the 'cluster-admin' ClusterRole to the service account 'default' in namespace 'kube-system'. What is the risk?

Which kubectl command can be used to determine if anonymous authentication is enabled on the API server?

A Gatekeeper Constraint is not blocking pods that violate the policy. The constraint references a ConstraintTemplate that has been successfully created. What is the most likely cause?

An admin runs 'kubectl run nginx --image=nginx' and the pod fails with 'ImagePullBackOff'. The cluster has an OPA/Gatekeeper constraint that only allows images from 'myregistry.io'. How can the admin quickly test the restriction?

Which command loads an AppArmor profile into the kernel?