CKS System Hardening Practice Question
Which THREE of the following are best practices for reducing the attack surface of Kubernetes nodes?
⚠ Common exam trap
CNCF often tests the misconception that hostNetwork improves performance without security trade-offs, or that running as root is acceptable for legacy apps, but the CKS exam expects strict adherence to least privilege and namespace isolation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Minimize host access from containers (e.g., disable hostPID, hostNetwork)
Option A is correct because disabling hostPID and hostNetwork prevents containers from sharing the node's process namespace and network stack, which blocks container escapes and lateral movement to host processes or interfaces. Option B is correct because minimal base images (e.g., distroless or Alpine) contain fewer packages, libraries, and utilities, shrinking the exploitable vulnerability surface inside the container. Option C is correct because disabling unnecessary system services on nodes (e.g., unused daemons, package managers, or listening ports) removes potential entry points and reduces the node's overall attack surface. Option D is incorrect because exposing the host network to containers increases risk by allowing direct access to node interfaces and services, which is the opposite of a hardening best practice. Option E is incorrect because running containers as root grants excessive privileges and makes privilege escalation or container breakout far more damaging; least-privilege non-root users are preferred.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Minimize host access from containers (e.g., disable hostPID, hostNetwork)
Why this is correct
Disabling hostPID and hostNetwork stops containers sharing the node's process and network namespaces, so a compromised pod cannot inspect host processes or bypass network policy. This directly reduces node attack surface by removing privileged namespace access that would otherwise permit container escape and lateral movement across the cluster.
- ✓
Use minimal base container images
Why this is correct
Minimal base images such as distroless or Alpine contain fewer packages, shells and libraries, so fewer exploitable vulnerabilities ship with each container. This reduces the node's attack surface by shrinking the software an attacker can leverage after compromising a pod.
- ✓
Disable unnecessary system services on nodes
Why this is correct
Disabling unused node services closes listening ports and removes daemons that attackers could exploit or abuse for lateral movement. This directly reduces the node's attack surface by eliminating unnecessary entry points on the host itself.
- ✗
Expose the host network to containers for better performance
Why it's wrong here
Host network exposure lets containers bypass network namespaces and reach node interfaces directly, enlarging the node's attack surface rather than shrinking it. It is tempting because host networking removes NAT overhead and can improve throughput for latency-sensitive workloads, but that performance gain is exactly what node-hardening guidance advises against.
- ✗
Run containers as root to simplify permissions
Why it's wrong here
Running containers as root grants full privileges inside the container, so a breakout reaches the node with root capability, contradicting attack-surface reduction. It is tempting because root avoids permission errors during image builds and volume mounts, but the correct practise is a non-root user with dropped capabilities and read-only root filesystems.
Go deeper
Related to this question
About these practice questions
One of 845 original CKS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.