CKS System Hardening Practice Question
Which of the following host access settings should be disabled to reduce the attack surface of a container?
⚠ Common exam trap
Many candidates confuse the boolean value that should be set to disable the feature (i.e., `false`) with the dangerous setting itself (i.e., `true`), so they might incorrectly select `hostPID: true` as the answer to disable, when the question explicitly asks for the disabled setting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
hostPID: false
Setting `hostPID: false` explicitly disables the container's access to the host's process ID namespace, which reduces the attack surface by preventing the container from seeing or interacting with host processes. In Kubernetes, when `hostPID` is set to `true`, the container shares the host's PID namespace, allowing it to potentially escalate privileges or interfere with other workloads. Disabling this setting (i.e., `false`) is a recommended security best practice to enforce process isolation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
hostNetwork: true
Why it's wrong here
When hostNetwork is true, the container shares the host's network namespace directly, allowing it to bind to host ports and IP addresses without NAT or port mapping. This bypasses network policies and firewall rules, expands the attack surface by exposing host-level network services, and can enable packet sniffing or ARP spoofing on the host's network interfaces.
- ✗
hostPID: true
Why it's wrong here
Setting hostPID to true shares the host's PID namespace, giving the container visibility into all host processes, not just its own. This breaks process isolation and can be leveraged to discover sensitive daemons, escalate privileges by injecting code, or signal processes to cause denial of service, significantly increasing the security risk.
- ✗
hostIPC: true
Why it's wrong here
With hostIPC set to true, the container uses the host's IPC namespace, granting access to shared memory segments, semaphores, and message queues used by other host processes. This can lead to cross-container data leakage, interference with host applications, or exploitation of inter-process communication vulnerabilities, making it a security hazard that should be avoided.
- ✓
hostPID: false
Why this is correct
The secure configuration is hostPID: false, which isolates the container's PID namespace so it can only see its own processes. This minimizes the attack surface by preventing a compromised container from inspecting or manipulating host-level processes, thereby maintaining strong isolation and reducing the potential for privilege escalation or information disclosure.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.