CKS System Hardening Practice Question
Which TWO of the following are valid ways to reduce the attack surface of a Kubernetes node? (Select 2)
⚠ Common exam trap
CNCF often tests the misconception that loading all kernel modules is beneficial for compatibility, when in fact it violates the principle of minimizing the attack surface by only loading required modules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict hostNetwork, hostPID, and hostIPC access from containers
Restricting hostNetwork, hostPID, and hostIPC access from containers is a valid way to reduce the attack surface of a Kubernetes node because it prevents containers from breaking out of their namespace isolation. When a container uses hostNetwork, it shares the node's network stack, potentially allowing it to sniff traffic or bind to privileged ports. Similarly, hostPID and hostIPC grant access to the host's process table and inter-process communication mechanisms, which can be leveraged for privilege escalation or information disclosure. By default, these should be disabled unless absolutely necessary, as they directly expose host-level resources to the container.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Load all kernel modules to support any workload
Why it's wrong here
Unnecessary kernel modules increase attack surface.
- ✓
Restrict hostNetwork, hostPID, and hostIPC access from containers
Why this is correct
These settings reduce a container's ability to access host resources.
- ✗
Enable SSH access for all users for troubleshooting
Why it's wrong here
SSH should be limited to authorized users only.
- ✓
Disable unnecessary system services on the node
Why this is correct
Reducing services reduces potential vulnerabilities.
- ✗
Allow containers to run as root
Why it's wrong here
Running as root increases risk of privilege escalation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.