CKS System Hardening Practice Question
Which THREE of the following are best practices for reducing the attack surface of Kubernetes nodes?
⚠ Common exam trap
CNCF often tests the misconception that hostNetwork improves performance without security trade-offs, or that running as root is acceptable for legacy apps, but the CKS exam expects strict adherence to least privilege and namespace isolation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Minimize host access from containers (e.g., disable hostPID, hostNetwork)
Disabling hostPID and hostNetwork prevents containers from accessing the host's process namespace and network stack, which would otherwise allow privilege escalation or network sniffing. This aligns with the principle of least privilege and reduces the node's attack surface by isolating container workloads from the host OS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Minimize host access from containers (e.g., disable hostPID, hostNetwork)
Why this is correct
Reduces the container's ability to affect the host.
- ✓
Use minimal base container images
Why this is correct
Reduces the number of packages and vulnerabilities.
- ✓
Disable unnecessary system services on nodes
Why this is correct
Reduces potential attack vectors.
- ✗
Expose the host network to containers for better performance
Why it's wrong here
Exposing host network increases attack surface.
- ✗
Run containers as root to simplify permissions
Why it's wrong here
Running as root increases risk; use non-root users.
Go deeper
Related to this question
About these practice questions
One of 114 original CKS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.