CKS System Hardening Practice Question
You are tasked with reducing the attack surface on a Kubernetes node. Which of the following actions is LEAST effective for hardening the node itself?
⚠ Common exam trap
Watch out — candidates often confuse container-level security controls (like dropping capabilities) with node-level hardening, assuming any security measure applied to containers also hardens the underlying node, when in fact node hardening requires direct OS and infrastructure changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Drop the NET_RAW capability from all containers running on the node
The least effective for hardening the node itself because dropping NET_RAW from containers is a container-level security control (e.g., via Pod Security Standards or seccomp), not a node-level hardening measure. Node hardening focuses on the host OS and Kubernetes components, not container capabilities. While it reduces attack surface for containers, it does not directly secure the node's kernel, services, or network access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restrict SSH access to the node using firewall rules
Why it's wrong here
Firewall rules limiting SSH reduce one remote-access path, but the node's dominant attack surface is the kubelet, container runtime and host OS packages, which remain exposed. It is tempting because network access control is a standard hardening control, and it would be correct when the requirement is to restrict administrative access to a management subnet.
- ✗
Disable unnecessary system services (e.g., telnet, rsh) on the node
Why it's wrong here
Disabling telnet, rsh and similar unused services removes listening daemons and is a standard, effective node-hardening step, so it is not the least effective action. It would be the right choice where legacy remote-access services remain enabled on nodes.
- ✓
Drop the NET_RAW capability from all containers running on the node
Why this is correct
Dropping NET_RAW restricts container capabilities, which is a pod-level control, not node hardening. Node hardening targets the host itself: kubelet flags, file permissions, kernel parameters and package updates. Capability removal leaves the underlying node configuration untouched, making it least effective here.
- ✗
Apply the latest security patches to the host kernel
Why it's wrong here
Patching the host kernel closes known privilege-escalation and container-escape vulnerabilities, directly shrinking the node's exploitable attack surface. Kernel patching is the correct priority when nodes run outdated kernels exposed to published CVEs, so it is not the least effective action.
Go deeper
Related to this question
Learn chapter
Microservice Vulnerabilities: Pod Security Standards
Key term
Pod Security Admission
Pod Security Admission is a Kubernetes feature that enforces security standards on pods at creation time to prevent running containers with dangerous privileges.
Key term
Seccomp Profiles
Seccomp profiles are security filters that restrict which system calls a containerized application can make to the Linux kernel, reducing the attack surface.
About these practice questions
Courseiva writes every CKS question from scratch — 845 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.