Cluster Hardening practice questions

A security team wants to ensure that all pods in a namespace run with a restricted seccomp profile. Which Pod Security Standard admission controller mode should be used to enforce this without blocking necessary pods?

Trap 1: Use a mutating admission webhook to automatically add seccomp…

This does not enforce the policy; it only mutates.

Trap 2: Enable the PodSecurity admission plugin with the 'baseline' policy…

'baseline' does not require a restricted seccomp profile.

Trap 3: Enable the PodSecurity admission plugin with the 'restricted'…

'warn' only logs violations, does not block pods.

A
Enable the PodSecurity admission plugin with the 'restricted' policy and 'enforce' mode
'enforce' blocks non-compliant pods, and 'restricted' requires seccomp.
B
Use a mutating admission webhook to automatically add seccomp profiles
Why wrong: This does not enforce the policy; it only mutates.
C
Enable the PodSecurity admission plugin with the 'baseline' policy and 'enforce' mode
Why wrong: 'baseline' does not require a restricted seccomp profile.
D
Enable the PodSecurity admission plugin with the 'restricted' policy and 'warn' mode
Why wrong: 'warn' only logs violations, does not block pods.

Question 2mediummultiple choice

A cluster uses RBAC and a ServiceAccount 'monitor' in namespace 'observability'. The account needs to list pods in all namespaces. Which ClusterRole and binding should be created?

Trap 1: Role with 'list' on pods, RoleBinding in observability

Role is namespace-scoped.

Trap 2: ClusterRole with 'get' on pods, ClusterRoleBinding

'get' is for a specific pod, not list.

Trap 3: ClusterRole with 'list' on pods, RoleBinding in observability

RoleBinding only grants access in its namespace.

A
Role with 'list' on pods, RoleBinding in observability
Why wrong: Role is namespace-scoped.
B
ClusterRole with 'get' on pods, ClusterRoleBinding
Why wrong: 'get' is for a specific pod, not list.
C
ClusterRole with 'list' on pods, RoleBinding in observability
Why wrong: RoleBinding only grants access in its namespace.
D
ClusterRole with 'list' on pods, ClusterRoleBinding
Correct scope and verb for listing pods across all namespaces.

Question 3easymultiple choice

An administrator wants to prevent pods from running as root. Which SecurityContext field should be set at the pod level?

Trap 1: fsGroup: 2000

Sets filesystem group for volumes.

Trap 2: runAsGroup: 3000

Only sets group ID.

Trap 3: runAsUser: 1000

Sets a specific user, but could be root if set to 0.

A
fsGroup: 2000
Why wrong: Sets filesystem group for volumes.
B
runAsGroup: 3000
Why wrong: Only sets group ID.
C
runAsUser: 1000
Why wrong: Sets a specific user, but could be root if set to 0.
D
runAsNonRoot: true
Explicitly prevents root.

Question 4mediummultiple choice

A company uses kube-bench to scan their cluster. The report shows a warning: 'Ensure that the --authorization-mode argument is set to Node,RBAC'. What is the best way to fix this?

Trap 1: Add --authorization-mode=AlwaysDeny to the API server

AlwaysDeny is not a valid mode; it should be Node,RBAC.

Trap 2: Restart the API server with --authorization-webhook-config-file

Webhook is additional, not a replacement.

Trap 3: Set --authorization-mode=RBAC only

Missing Node mode.

A
Add --authorization-mode=AlwaysDeny to the API server
Why wrong: AlwaysDeny is not a valid mode; it should be Node,RBAC.
B
Restart the API server with --authorization-webhook-config-file
Why wrong: Webhook is additional, not a replacement.
C
Set --authorization-mode=RBAC only
Why wrong: Missing Node mode.
D
Edit the kube-apiserver manifest to add --authorization-mode=Node,RBAC
Sets both Node and RBAC as required.

Question 5hardmultiple choice

A pod is failing to start with: 'Error: container has runAsNonRoot and image will run as root'. The pod spec sets securityContext.runAsNonRoot: true. The container image is 'nginx:latest' which runs as root. Which change allows the pod to run while maintaining security?

Trap 1: Remove runAsNonRoot: true

This relaxes security.

Trap 2: Add a PodSecurityPolicy that allows root

PSP is deprecated and not the direct fix.

Trap 3: Use a mutating webhook to change the image

Too complex and not immediate.

A
Remove runAsNonRoot: true
Why wrong: This relaxes security.
B
Add a PodSecurityPolicy that allows root
Why wrong: PSP is deprecated and not the direct fix.
C
Set runAsUser: 1000 in the container securityContext
Runs as non-root user, satisfying runAsNonRoot.
D
Use a mutating webhook to change the image
Why wrong: Too complex and not immediate.

Question 6easymultiple choice

Which Kubernetes resource should be used to restrict egress traffic from pods?

Trap 1: PodSecurityPolicy

Deprecated and does not control network.

Trap 2: iptables rules on nodes

Not a Kubernetes resource.

Trap 3: NetworkPolicy with ingress rules

Controls inbound traffic.

A
NetworkPolicy with egress rules
Directly restricts egress.
B
PodSecurityPolicy
Why wrong: Deprecated and does not control network.
C
iptables rules on nodes
Why wrong: Not a Kubernetes resource.
D
NetworkPolicy with ingress rules
Why wrong: Controls inbound traffic.

Question 7mediummultiple choice

A developer created a ClusterRole 'pod-reader' with rules to get, list, and watch pods. They bound it to a user via ClusterRoleBinding. The user reports they cannot list pods in namespace 'test'. What is the most likely cause?

Trap 1: The ClusterRole must be bound with a RoleBinding

ClusterRoleBinding is correct for cluster-wide access.

Trap 2: The user needs a ServiceAccount

Users authenticate via certificates, not ServiceAccounts.

Trap 3: The pod-reader ClusterRole is missing 'list' verb

The stem says it includes list.

A
The ClusterRole must be bound with a RoleBinding
Why wrong: ClusterRoleBinding is correct for cluster-wide access.
B
The user needs a ServiceAccount
Why wrong: Users authenticate via certificates, not ServiceAccounts.
C
The ClusterRoleBinding might have a namespace set
If namespace is set, it becomes namespace-scoped, breaking access.
D
The pod-reader ClusterRole is missing 'list' verb
Why wrong: The stem says it includes list.

Question 8hardmultiple choice

A cluster has a PodSecurityPolicy that requires 'RunAsAny' for the user. An administrator wants to enforce that all pods in namespace 'production' must run with a specific seccomp profile. Which approach is recommended given PSP is deprecated?

Trap 1: Create a new PSP with seccomp profile and assign it to the namespace

PSP is deprecated and not recommended.

Trap 2: Set seccomp profile in the kubelet configuration

Kubelet sets default, but does not enforce per namespace.

Trap 3: Use a mutating admission webhook to add seccomp profile

Does not enforce; some pods could still run without it.

A
Enable PodSecurity admission with 'restricted' policy in enforce mode
Enforces seccomp as part of the restricted policy.
B
Create a new PSP with seccomp profile and assign it to the namespace
Why wrong: PSP is deprecated and not recommended.
C
Set seccomp profile in the kubelet configuration
Why wrong: Kubelet sets default, but does not enforce per namespace.
D
Use a mutating admission webhook to add seccomp profile
Why wrong: Does not enforce; some pods could still run without it.

Question 9mediummulti select

Which TWO of the following are valid ways to restrict access to the Kubernetes API server?

Trap 1: Use static token file

Insecure and deprecated.

Trap 2: Enable NodeRestriction admission plugin

Limits kubelet, not API server clients.

Trap 3: Enable anonymous access

Allows unauthenticated access.

A
Use static token file
Why wrong: Insecure and deprecated.
B
Use webhook token authentication
Valid authentication method.
C
Enable NodeRestriction admission plugin
Why wrong: Limits kubelet, not API server clients.
D
Configure RBAC authorization
RBAC is the standard authorization mode.
E
Enable anonymous access
Why wrong: Allows unauthenticated access.

Question 10hardmulti select

Which THREE of the following are required to secure etcd in a Kubernetes cluster?

Trap 1: Configure RBAC for etcd

Etcd does not use RBAC.

Trap 2: Allow anonymous access for monitoring

Insecure.

A
Configure RBAC for etcd
Why wrong: Etcd does not use RBAC.
B
Allow anonymous access for monitoring
Why wrong: Insecure.
C
Require client certificate authentication
Authenticates clients.
D
Enable encryption at rest for secrets
Protects data at rest.
E
Use TLS for peer and client communication
Encrypts data in transit.

Question 11easymulti select

Which TWO of the following are best practices for securing container images?

Trap 1: Always use the latest tag

Unpredictable and mutable.

Trap 2: Run containers as root

Increases risk.

Trap 3: Run containers in privileged mode

Grants excessive capabilities.

A
Always use the latest tag
Why wrong: Unpredictable and mutable.
B
Use minimal base images like distroless
Reduces attack surface.
C
Run containers as root
Why wrong: Increases risk.
D
Run containers in privileged mode
Why wrong: Grants excessive capabilities.
E
Use image vulnerability scanning
Identifies known vulnerabilities.

Question 12hardmulti select

Which THREE of the following are valid methods to enforce pod security standards in a Kubernetes cluster?

Trap 1: Run kube-bench on the cluster

Audits, does not enforce.

Trap 2: Manual review of all pod specs

Not scalable or automated.

A
Use Kyverno policy engine
Another admission controller.
B
Run kube-bench on the cluster
Why wrong: Audits, does not enforce.
C
Manual review of all pod specs
Why wrong: Not scalable or automated.
D
Use Open Policy Agent (OPA) with Gatekeeper
External admission controller.
E
Enable PodSecurity admission plugin
Native Kubernetes enforcement.

Question 13hardmultiple choice

You are the security engineer for a multi-tenant Kubernetes cluster. The cluster uses kubeadm and runs Kubernetes v1.24. Each tenant has a dedicated namespace. A new tenant, 'acme-corp', requires that all pods in their namespace run with a read-only root filesystem and must not be able to escalate privileges. They also need to run a legacy container that must listen on a port below 1024. The cluster currently uses PodSecurityPolicy (PSP) but is planning to migrate to Pod Security Admission (PSA). The legacy container needs to run as non-root with the NET_BIND_SERVICE capability to bind to port 80. You need to configure security policies for the 'acme-corp' namespace without affecting other tenants. Which approach best meets these requirements while following Kubernetes best practices?

Trap 1: Enable Pod Security Admission with the 'baseline' policy in enforce…

Baseline does not enforce readOnlyRootFilesystem; mutating webhook adds complexity.

Trap 2: Use Pod Security Admission with the 'privileged' policy and rely on…

Privileged policy allows everything, defeating security.

Trap 3: Create a new PSP that allows NET_BIND_SERVICE and requires…

PSP is deprecated and not recommended for new deployments.

A
Enable Pod Security Admission with the 'baseline' policy in enforce mode for acme-corp namespace, and add a mutating webhook to set readOnlyRootFilesystem
Why wrong: Baseline does not enforce readOnlyRootFilesystem; mutating webhook adds complexity.
B
Use OPA/Gatekeeper to create a ConstraintTemplate that requires readOnlyRootFilesystem and allows only NET_BIND_SERVICE capability, then apply it to acme-corp namespace
OPA can enforce both requirements flexibly.
C
Use Pod Security Admission with the 'privileged' policy and rely on the legacy container's securityContext
Why wrong: Privileged policy allows everything, defeating security.
D
Create a new PSP that allows NET_BIND_SERVICE and requires readOnlyRootFilesystem, then bind it to the acme-corp namespace via RoleBinding
Why wrong: PSP is deprecated and not recommended for new deployments.

Question 14mediumdrag order

Arrange the steps to enable and configure audit logging in Kubernetes.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 15mediummatching