CKS System Hardening Practice Question
Which of the following is NOT a valid seccomp profile type in Kubernetes?
⚠ Common exam trap
Watch out — candidates often confuse the SeccompDefault feature gate with a valid seccomp profile type, especially since the feature gate name sounds like a profile type and is often mentioned in the context of default seccomp enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SeccompDefault
SeccompDefault is not a valid seccomp profile type in Kubernetes. The valid profile types are Unconfined, RuntimeDefault, and Localhost. SeccompDefault is a feature gate (introduced in Kubernetes 1.22) that, when enabled, tells the kubelet to use the RuntimeDefault seccomp profile by default for pods, but it is not itself a profile type.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SeccompDefault
Why this is correct
SeccompDefault is not a valid seccomp profile type in Kubernetes. The valid values for the `type` field under `securityContext.seccompProfile` are `RuntimeDefault`, `Localhost`, and `Unconfined`. While the `SeccompDefault` feature gate enables the runtime default profile for pods, it does not appear as a profile type value. The attempt to set `type: SeccompDefault` will be rejected by the API server.
- ✗
Unconfined
Why it's wrong here
Unconfined is a valid seccomp profile type. Setting `type: Unconfined` explicitly disables seccomp filtering for the container, meaning the kernel allows all syscalls without restriction. This is equivalent to running the container without a seccomp profile, and it is often used for debugging or when the container requires unrestricted syscall access. It is one of the three permitted types defined in the Kubernetes API.
- ✗
RuntimeDefault
Why it's wrong here
RuntimeDefault is a valid seccomp profile type that instructs the container runtime (e.g., containerd, CRI-O) to apply its default seccomp profile. This profile typically blocks a list of dangerous or commonly misused syscalls while allowing normal application operations. It provides a security baseline out of the box, and it is the recommended profile for most workloads unless a custom policy is needed.
- ✗
Localhost
Why it's wrong here
Localhost is a valid seccomp profile type that lets you reference a custom seccomp profile stored on the node's filesystem. When `type: Localhost` is set, you must also provide the `localhostProfile` field with the path to the profile file relative to the kubelet's seccomp profile root directory. This allows cluster administrators to deploy default-deny or highly customized syscall filtering policies tailored to their application's requirements.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 845 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.