CKS System Hardening Practice Question
Which of the following is the correct way to apply an AppArmor profile named 'my-profile' to a pod using the annotation?
⚠ Common exam trap
CNCF often tests the distinction between the `container.` prefix for per-container annotations versus the deprecated pod-level annotation, and the mandatory `localhost/` prefix for locally loaded profiles, causing candidates to omit one or both.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
annotations: { container.apparmor.security.beta.kubernetes.io/app: 'localhost/my-profile' }
The AppArmor profile annotation must follow the format `container.apparmor.security.beta.kubernetes.io/<container_name>`, and the profile value must be prefixed with `localhost/` to indicate a locally loaded profile. This annotation applies the 'my-profile' AppArmor profile to the container named 'app' in the pod.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
annotations: { apparmor.security.beta.kubernetes.io/app: 'localhost/my-profile' }
Why it's wrong here
The annotation key is missing the mandatory `container.` prefix. AppArmor annotations must be scoped per-container using `container.apparmor.security.beta.kubernetes.io/<container-name>`. With only `apparmor.security.beta.kubernetes.io/app`, kubelet does not recognize the annotation, so it silently ignores it and the chosen profile is never loaded under AppArmor.
- ✗
annotations: { container.apparmor.security.beta.kubernetes.io/app: 'my-profile' }
Why it's wrong here
The annotation key is correct, but the value lacks the required `localhost/` prefix. For profiles stored on the node, the value must be `localhost/<profile-name>`; a bare name like `my-profile` is not a valid profile reference in the AppArmor annotation format. Kubelet will reject this value and fail to start the pod or ignore the annotation, so the profile is not applied.
- ✓
annotations: { container.apparmor.security.beta.kubernetes.io/app: 'localhost/my-profile' }
Why this is correct
This is the correct AppArmor annotation. The key `container.apparmor.security.beta.kubernetes.io/app` targets the container named `app` with the `container.` prefix, and the value `localhost/my-profile` correctly references a node‑local AppArmor profile under `/etc/apparmor.d`. Kubelet loads and applies this profile before launching the container, enforcing the configured restrictions.
- ✗
annotations: { container.seccomp.security.beta.kubernetes.io/app: 'localhost/my-profile' }
Why it's wrong here
The key uses `container.seccomp.security.beta.kubernetes.io/app`, which is the seccomp annotation namespace, not AppArmor. Although the value looks plausible, seccomp annotations control syscall filtering via seccomp profiles, not AppArmor Mandatory Access Control. To apply the AppArmor profile, the key must be `container.apparmor.security.beta.kubernetes.io/app`; otherwise, the security policy you intend is not applied.
Go deeper
Related to this question
About these practice questions
This CKS question is part of Courseiva's 845-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.