Select Two (Multi-Select) Questions

Always use the latest tag

Why wrong: Unpredictable and mutable.

Run containers as root

Why wrong: Increases risk.

Run containers in privileged mode

Why wrong: Grants excessive capabilities.

Set the kubelet flag --authentication-token-webhook=true

Why wrong: This enables token review but does not disable anonymous access.

Enable the NodeRestriction admission controller

Why wrong: NodeRestriction limits node self-updates to the API server, but does not secure the kubelet API.

Modify the kube-apiserver manifest to set --anonymous-auth=false

Why wrong: This affects the API server, not the kubelet's anonymous access.

Set container 'stdout' logging only, avoiding file-based logs.

Why wrong: Stdout logs are not encrypted unless the container output is encrypted.

Disable log rotation to prevent log tampering during rotation.

Why wrong: Disabling rotation causes disk full and data loss.

Set 'securityContext.seccompProfile.type: Unconfined' to allow all syscalls.

Why wrong: Unconfined disables seccomp, increasing risk.

Enable Kubernetes audit logging to capture exec commands.

Why wrong: Audit logs record events, not prevent breakouts.

Use PodSecurityPolicy to deny privileged containers.

Why wrong: PSP is deprecated and does not detect breakouts.

Use simple username and password authentication

Why wrong: Simple passwords are not recommended; TLS and RBAC provide stronger security.

Put etcd on the same network as the API server without firewall

Why wrong: This does not restrict access; it exposes etcd to potential network threats.

Use HTTP instead of HTTPS

Why wrong: HTTP is insecure and should not be used.

Disable client authentication for simplicity

Why wrong: Disabling authentication would allow anyone to access etcd.

kill

Why wrong: Kill is not an AppArmor mode; it is a seccomp action.

audit

Why wrong: Audit is not a valid AppArmor profile mode.

permissive

Why wrong: Permissive is not a valid AppArmor profile mode.

--client-cert-auth=true

Why wrong: This flag is for etcd, not kube-apiserver.

--profiling=false

Why wrong: While profiling should be disabled, the CIS benchmark recommends it for the kube-controller-manager and scheduler, not specifically for the API server in the basic recommendations.

--insecure-bind-address=0.0.0.0

Why wrong: The insecure bind address should not be enabled at all.

Using 'securityContext.seccompProfile.type: RuntimeDefault' with 'localhostProfile' set

Why wrong: RuntimeDefault does not use a localhostProfile; it uses the runtime's default.

Configuring the kubelet with --seccomp-default-profile flag

Why wrong: This sets a default profile for all pods, not a custom one for a specific pod.

Adding a seccomp profile to the container image and referencing it in the pod spec

Why wrong: Seccomp profiles are not part of container images; they must be placed on the node.

ContainerDefault

Why wrong: No such type.

Unconfined

Why wrong: Unconfined is a valid type but does not restrict syscalls. The question likely expects secure types, but it is technically valid. I'll mark it incorrect to have exactly two correct.

KubernetesDefault

Why wrong: No such type.

disabled

Why wrong: Disabled is not a valid AppArmor profile mode.

audit

Why wrong: Audit is not a profile mode; it is a flag.

unconfined

Why wrong: Unconfined means no AppArmor profile is applied, not a mode.

Install all available security patches and packages

Why wrong: Installing unnecessary packages increases attack surface.

Remove SSH access from all nodes

Why wrong: SSH may be needed for emergency access; better to restrict and audit.

Setting securityContext.seLinuxOptions.type

Why wrong: This is for SELinux, not seccomp.

Using the container.apparmor.security.beta.kubernetes.io annotation

Why wrong: This is for AppArmor, not seccomp.

Using the seccomp.security.beta.kubernetes.io/pod annotation

Why wrong: No such annotation exists.

Audit

Why wrong: Audit is not a mode; it is a flag.

Disable

Why wrong: Disable is not a mode; unconfined is used to disable.

Permissive

Why wrong: Permissive is not an AppArmor term.

docker

Why wrong: Docker is not a sandboxing runtime.

runc

Why wrong: runc is the default runtime for OCI containers, not a sandbox.

containerd

Why wrong: containerd is a container runtime that uses runc by default.

Host network access (hostNetwork) is not allowed

Why wrong: Baseline allows hostNetwork.

Seccomp profile must be set to RuntimeDefault or Localhost

Why wrong: Seccomp is not required in baseline.

Set hostNetwork: true for better network performance

Why wrong: This exposes the host network to the container, increasing attack surface.

Enable audit logging for all API requests

Why wrong: Audit logging is important for security monitoring but does not directly reduce attack surface.

Audit

Why wrong: Not a valid AppArmor mode.

Disabled

Why wrong: Not a valid AppArmor mode.

Unconfined

Why wrong: Unconfined is valid but not selected as we need only two.

secure

Why wrong: Not a valid level.

default

Why wrong: Not a valid level.

strict

Why wrong: Not a valid level.

Use environment variables from the pod spec referencing Secret keys.

Why wrong: While better than hardcoding, env vars can leak via /proc and logs; volumes are preferred.

Pass secrets as command-line arguments to the container.

Why wrong: Command-line arguments are visible in process listings.

Store secrets in ConfigMaps with base64 encoded data.

Why wrong: Secrets should be stored as Secrets, not ConfigMaps, and encoding is not encryption.