CKS System Hardening Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Run 'swapoff -a' and remove swap entry from /etc/fstab

  Why this is correct

  Running 'swapoff -a' deactivates all currently active swap devices and files immediately, while removing the swap entry from /etc/fstab guarantees that swap will not be re-enabled at boot. This dual action is required for Kubernetes because the kubelet, when using cgroup v2, treats any active swap as a failure condition; even a persistent swap that is only occasionally used can cause unpredictable memory allocation behavior. Without editing fstab, the system would re-enable swap on restart, leaving the node non-compliant.

• ✗

  Set kernel parameter 'vm.swappiness=0'

  Why it's wrong here

  Setting 'vm.swappiness=0' only reduces the kernel's preference for swapping anonymous memory pages relative to page cache; it does not disable swap as a memory backend. Under memory pressure, the kernel can still evict pages to swap, and kubelet detection of swap is based on presence of active swap space, not the swappiness value. Since Kubernetes' memory isolation through cgroups assumes no swap exists, any remaining swap—even with swappiness at zero—will cause kubelet to fail on node startup.

• ✗

  Run 'systemctl stop swap'

  Why it's wrong here

  The command 'systemctl stop swap' is invalid because swap is not a single systemd unit; swap devices and files are managed by individual units such as 'dev-sda2.swap' or by the swapon/swapoff commands directly. Running it would produce a 'Unit swap.service not found' error, and it would not affect any existing swap regardless of whether the unit is named something else. A correct systemd-based approach would be to disable the specific swap unit via 'systemctl disable <device>.swap', but simply stopping a nonexistent unit does nothing.

• ✗

  Run 'kubelet --disable-swap'

  Why it's wrong here

  There is no kubelet flag called '--disable-swap'; the kubelet has never had the ability to disable swap itself. The relevant kubelet flag is '--fail-swap-on', which defaults to true, meaning kubelet will refuse to start if swap is enabled; setting it to 'false' would allow it to run with swap, but that is not a supported way to meet the swap-off requirement. The kubelet cannot modify kernel swap configuration—that must be done with 'swapoff' and fstab edits.

Go deeper

Related to this question