CKS System Hardening Practice Question
You are tasked with reducing the attack surface on a Kubernetes node. Which of the following actions is LEAST effective for hardening the node itself?
⚠ Common exam trap
Watch out — candidates often confuse container-level security controls (like dropping capabilities) with node-level hardening, assuming any security measure applied to containers also hardens the underlying node, when in fact node hardening requires direct OS and infrastructure changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Drop the NET_RAW capability from all containers running on the node
The least effective for hardening the node itself because dropping NET_RAW from containers is a container-level security control (e.g., via Pod Security Standards or seccomp), not a node-level hardening measure. Node hardening focuses on the host OS and Kubernetes components, not container capabilities. While it reduces attack surface for containers, it does not directly secure the node's kernel, services, or network access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restrict SSH access to the node using firewall rules
Why it's wrong here
Limiting SSH access reduces the risk of unauthorized access to the node.
- ✗
Disable unnecessary system services (e.g., telnet, rsh) on the node
Why it's wrong here
Disabling unused services reduces attack vectors on the node.
- ✓
Drop the NET_RAW capability from all containers running on the node
Why this is correct
This is a container-level hardening measure. While beneficial, it does not directly harden the node itself.
- ✗
Apply the latest security patches to the host kernel
Why it's wrong here
Patching the kernel fixes known vulnerabilities, directly hardening the node.
Go deeper
Related to this question
Learn chapter
Kubernetes Security Fundamentals
Key term
Pod Security Admission
Pod Security Admission is a Kubernetes feature that enforces security standards on pods at creation time to prevent running containers with dangerous privileges.
Key term
Seccomp Profiles
Seccomp profiles are security filters that restrict which system calls a containerized application can make to the Linux kernel, reducing the attack surface.
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.