320 questions total · 5pages · All types, answers revealed
Which NIST framework publication specifically addresses the security of container-based applications and orchestration systems?
SP 800-190 is dedicated to container and application security guidelines.
Why this answer
NIST SP 800-190 is the Application Container Security Guide, providing specific security guidance for container environments.
Which TWO of the following scenarios represent severe security misconfigurations in a Kubernetes cluster control plane? (Choose TWO)
Allows unauthenticated/unauthorized access.
Why this answer
Exposing the API server insecure port and allowing anonymous authentication are severe misconfigurations.
You are securing a highly regulated Kubernetes cluster and need to ensure that etcd data is encrypted at rest using a custom encryption key. After creating the EncryptionConfiguration file, which API server flag must be updated to point to this file?
This flag instructs the API server to load the encryption provider settings.
Why this answer
The --encryption-provider-config flag links the API server to the encryption configuration file.
Under the cloud native shared responsibility model for a managed Kubernetes service, which TWO tasks are typically the responsibility of the cloud provider? (Choose TWO)
Physical facilities and hardware security are provider responsibilities.
Why this answer
Cloud providers manage physical infrastructure and the control plane components in managed Kubernetes offerings.
When modeling threats for a Kubernetes cluster using the STRIDE methodology, identifying scenarios where an attacker intercepts unencrypted traffic between worker nodes or between a client and the API server addresses which TWO STRIDE categories? (Choose TWO)
Correct. Unencrypted data in transit can be intercepted and modified maliciously.
Why this answer
Interception of unencrypted network traffic falls under Information Disclosure (reading sensitive data in transit) and Tampering (if the traffic can also be modified in flight without integrity checks).
You are tasked with securing a Kubernetes cluster where control plane nodes are hosted in a private network segment. To prevent unauthorized access to the API server from compromised internal workloads, which mechanism restricts which service accounts can access the API server?
RBAC restricts what actions service accounts and users can perform against the API server.
Why this answer
Role-Based Access Control (RBAC) combined with least-privilege binding ensures service accounts only access permitted API resources.
An enterprise cluster requires that all incoming NetworkPolicies must default to denying all traffic unless explicitly allowed. A developer creates a namespace but forgets to apply any policies. What is the default behavior of Kubernetes regarding inter-pod traffic within a namespace when no NetworkPolicies are present?
Kubernetes network model is non-isolated by default until a NetworkPolicy selects a pod.
Why this answer
By default, Kubernetes namespaces are non-isolated (allow-all). All pods can communicate with all other pods unless a NetworkPolicy explicitly restricts traffic.
Which TWO of the following are valid ways to harden etcd against unauthorized access and data corruption? (Choose TWO)
mTLS ensures only trusted components can communicate with etcd.
Why this answer
Enforcing client certificate authentication and taking regular encrypted snapshots secure etcd.
An external penetration tester managed to achieve remote code execution inside a container. They attempt to query the Kubernetes API server using the service account token mounted inside the container. To minimize the blast radius of such an attack, which setting should be explicitly configured on the Pod spec?
Disabling automatic service account token mounting ensures pods that do not need to interact with the Kubernetes API server lack credentials inside the container filesystem.
Why this answer
Setting automountServiceAccountToken to false prevents Kubernetes from automatically mounting the service account API credentials into the container, effectively blocking unauthorized local API access if the container is compromised.
Which TWO of the following are primary components of the 4Cs of Cloud Native Security model? (Choose TWO)
Container is one of the 4Cs, encompassing base images and runtime.
Why this answer
The 4Cs of Cloud Native Security are Code, Container, Cluster, and Cloud.
You are troubleshooting a container image vulnerability scan report that flagged a high-severity CVE in a base image layer. The development team wants to ensure that vulnerable container images are automatically prevented from being deployed to any namespace in the cluster. Which Kubernetes mechanism should you implement?
Validating admission webhooks can block pods that use images with unresolved vulnerabilities.
Why this answer
An admission controller, specifically a validating webhook or a policy engine like OPA Gatekeeper or Kyverno, can intercept image creation requests and block images that fail vulnerability checks.
Under NIST guidelines for continuous monitoring in cloud-native environments, which Kubernetes mechanism allows operators to enforce cryptographic integrity of container images at runtime?
Cryptographic signatures verify image provenance prior to runtime admission.
Why this answer
Admission controllers like Gatekeeper or Kyverno working alongside image signature verification tools (like Cosign) enforce cryptographic image signatures before admission.
Which THREE mechanisms are used in a zero-trust platform security model for cloud-native applications? (Choose three)
Microsegmentation restricts lateral movement by explicitly defining allowed network paths.
Why this answer
A zero-trust model relies on continuous verification, including mutual TLS encryption, strict admission controls, and principle of least privilege via network and authorization policies.
An administrator wishes to defend against supply chain attacks involving malicious third-party Kubernetes operators installed from public catalogs. What security practice is most effective before installing such operators?
Malicious or overly permissive operators often request cluster-admin rights; reviewing manifests and RBAC scopes before installation prevents unauthorized privilege escalation.
Why this answer
Inspecting CustomResourceDefinitions (CRDs), controller manifests, RBAC permissions requested by the operator, and pulling container images from verified registries ensures the operator does not request excessive privileges (e.g., cluster-admin).
Which TWO of the following actions are risks associated with leaving the Kubernetes API server's insecure port enabled? (Choose TWO)
The insecure port does not require authentication.
Why this answer
The insecure port allows unauthenticated and unencrypted access.
A cluster operator is enforcing the Pod Security Standards "restricted" profile across a namespace. A developer attempts to deploy a container running as root (runAsUser: 0). What will happen during the admission phase?
The restricted profile forbids containers running as root, causing the Pod Security admission controller to deny the request.
Why this answer
The restricted Pod Security Standard explicitly prohibits containers from running as root and enforces a non-root user. The request will be rejected by the Pod Security admission controller.
Which TWO components are involved when an Ingress controller routes external HTTPS traffic to a backend service in Kubernetes? (Choose two)
The Ingress resource specifies the routing rules, hostnames, and TLS secret mappings.
Why this answer
Ingress routing involves the Ingress resource defining routing rules and the Ingress Controller (such as NGINX or Traefik) implementing those rules and terminating TLS.
An organization requires compliance auditing of etcd access to ensure unauthorized clients cannot communicate with the data store. According to CIS benchmarks, how should etcd client communication be secured?
CIS benchmarks dictate that etcd client-server communication must use client certificates (mTLS).
Why this answer
CIS benchmarks require etcd client communication to be authenticated and encrypted using mutual TLS (mTLS).
What is the primary function of the 'automountServiceAccountToken: false' setting in a Pod specification?
This setting disables token auto-mounting for enhanced security.
Why this answer
Setting automountServiceAccountToken to false prevents the automatic mounting of the ServiceAccount API token into the pod's filesystem, reducing the attack surface if the pod is compromised.
Which TWO of the following files or directories on a control plane node contain critical static pod manifests for core components? (Choose TWO)
Contains the etcd static pod definition.
Why this answer
The /etc/kubernetes/manifests directory holds static pod yaml files for kube-apiserver, etcd, etc.
Which TWO of the following metrics or health endpoints should be protected against unauthenticated access on control plane nodes? (Choose TWO)
Etcd metrics expose internal storage and performance data.
Why this answer
API server metrics and etcd health/metrics endpoints contain sensitive operational and cluster data.
This annotation informs the NGINX Ingress controller to use HTTPS when proxying traffic to backend pods.
Why this answer
The NGINX Ingress controller supports annotations like 'nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"' to instruct the proxy to communicate with backend pods over HTTPS.
An administrator needs to restrict a container from accessing any devices on the host system via device nodes. By default, how does Docker or containerd handle device access for containers when no custom security profile is applied?
Container runtimes apply a restrictive default device cgroup policy permitting only basic safe devices.
Why this answer
Container runtimes like containerd and Docker apply a default set of cgroups and device rules that restrict access, but can be further locked down using device plugins or cgroup rules.
A developer accidentally committed plain-text database passwords into a public Git repository. The password was stored in a Kubernetes Secret manifest. What immediate remediation step should be taken regarding the Secret?
Since the secret was exposed, the credential itself is compromised and must be rotated at the source.
Why this answer
Rotate the compromised password in the database immediately, then update the Kubernetes Secret with the new password.
A DevOps team is building container images using Dockerfiles. They decide to use official minimal distroless base images instead of standard Ubuntu images containing package managers and shell utilities. Which security benefit does this provide?
Removing shells and package managers prevents attackers from executing commands if a container is compromised.
Why this answer
Distroless images reduce the attack surface by excluding unnecessary binaries, package managers, and shells.
Why is running containers as the root user discouraged in Kubernetes platform security best practices?
Running as non-root limits the potential damage an attacker can do if they compromise the container application.
Why this answer
Running as root inside a container means that if an attacker achieves container escape or remote code execution, they may have elevated privileges on the host or inside the container namespace.
When managing Kubernetes clusters on Google Cloud Platform (GKE), Google manages the control plane infrastructure. Under the shared responsibility model, what is the customer primarily responsible for securing?
Customers are responsible for worker nodes, node OS updates, network policies, and cluster workloads.
Why this answer
In managed Kubernetes (like GKE or EKS), the cloud provider manages the control plane, while the customer is responsible for configuring worker nodes, IAM, cluster networking, and workloads.
You need to ensure that a Secret containing database credentials cannot be read by anyone except the database application controller, even if they have broad RBAC read permissions in the namespace. Which feature should you consider?
Avoiding Kubernetes Secret objects eliminates the risk of users with namespace Secret read permissions accessing the credentials.
Why this answer
Standard Kubernetes RBAC is resource-based and does not support cell-level or secret-value level restrictions natively within a namespace once read access to secrets is granted. However, migrating to an external secrets manager or using advanced admission control can restrict access. Within native Kubernetes, RBAC allows reading secrets if 'get' or 'list' is granted on 'secrets'.
To strictly isolate secrets, external secret operators injecting secrets via environment variables or volume mounts without granting direct secret API access is standard practice.
An administrator wants to ensure that no container in a specific namespace runs with a root User ID (UID 0). Which security context setting should be enforced?
runAsNonRoot ensures containers fail to start if they run as root.
Why this answer
Setting 'runAsNonRoot: true' in the security context forces the container runtime to reject containers that attempt to run as UID 0.
Which TWO statements are true regarding Kubernetes NetworkPolicy default behaviors?
Cluster networking is open by default until policies are applied.
Why this answer
By default, pods are non-isolated (all traffic allowed). When a NetworkPolicy selects pods and specifies ingress/egress, those specific directions become deny-by-default.
Which TWO actions help secure Ingress traffic in a Kubernetes cluster? (Choose two)
TLS encryption protects data in transit between clients and the ingress controller.
A security engineer is reviewing the NIST SP 800-190 container security application and needs to identify the primary control category for securing container image registries. Under NIST guidelines, which layer is primarily responsible for verifying the integrity of images before deployment?
Registry security involves securing image repositories and verifying image integrity/provenance.
Why this answer
NIST SP 800-190 emphasizes that image integrity must be validated at the registry and build pipeline level using cryptographic signing and vulnerability scanning.
You are hardening etcd and want to ensure that sensitive data stored in Kubernetes secrets is encrypted at rest within etcd. Which API server configuration file parameter specifies how secrets should be encrypted?
This flag points to the configuration file defining encryption providers like aescbc or secretbox.
Why this answer
Encryption at rest is configured using an EncryptionConfiguration file passed to the API server via the --encryption-provider-config flag.
An auditor evaluates network security controls in a Kubernetes cluster. Which TWO configurations help mitigate lateral movement and network-based attacks between pods?
A service mesh encrypts traffic and authenticates service identities at layer 7.
Why this answer
Deploying CNI-level network policies and implementing a service mesh for mTLS traffic encryption and authentication mitigate lateral movement.
Which THREE of the following mechanisms are used by the Kubernetes API server to authorize requests after authentication succeeds? (Choose THREE)
Standard RBAC checks roles and bindings.
Why this answer
Kubernetes supports Node, RBAC, and Webhook authorization modes.
An auditor notices that default ServiceAccounts in newly created namespaces are automatically mounting their API tokens into pods, creating an unnecessary attack surface. How can an administrator permanently disable automatic token mounting for all new service accounts in a specific namespace?
Pods referencing that ServiceAccount will no longer automatically mount the token unless explicitly overridden in the pod spec.
Why this answer
Setting automountServiceAccountToken: false on the ServiceAccount resource prevents the token from being automatically mounted into pods using that service account.
Which RBAC verb allows a user to delete an existing resource in a Kubernetes namespace?
The 'delete' verb grants permission to remove resources.
Why this answer
The 'delete' verb specifically authorizes removing resources.
A security engineer needs to verify that control plane component pods (such as kube-apiserver and etcd) have correct file ownership on the control plane node. According to CIS benchmarks, who should own these manifest files located in "/etc/kubernetes/manifests"?
Manifest files must be owned by root:root to prevent unauthorized modification.
Why this answer
CIS benchmarks state that control plane manifest files must be owned by the root user and root group (root:root).
Which TWO of the following mechanisms help secure the kubelet API from unauthorized access and container inspection? (Choose TWO)
Webhook authorization delegates authz to the API server.
Why this answer
Setting authorization mode to Webhook and disabling anonymous access protect the kubelet API.
Where are static pods for a control plane node typically defined so that the kubelet can automatically create and manage them?
Kubelet watches this directory and automatically creates static pods for any yaml manifests found within.
Why this answer
Static pods are defined by manifest files placed in the directory specified by the kubelet's --pod-manifest-path flag or staticPodPath configuration setting.
A security team is implementing Pod Security Standards (restricted, baseline, privileged) across namespaces. Which THREE controls are enforced under the Restricted Pod Security profile? (Choose THREE)
Restricted profile requires dropping dangerous capabilities.
Why this answer
The restricted profile enforces running as non-root, dropping capabilities, and preventing privilege escalation.
Under the Pod Security Standards, a developer attempts to deploy a pod with 'privileged: true' in a namespace labeled with 'pod-security.kubernetes.io/enforce=baseline'. What will happen?
Privileged mode violates the baseline policy, causing the admission controller to deny the request.
Why this answer
The 'baseline' profile prohibits privileged containers. The admission controller will reject the pod creation request.
Which TWO entities can be assigned RBAC permissions in a Kubernetes cluster? (Choose TWO)
ServiceAccounts are standard non-human identities in Kubernetes.
Why this answer
RBAC bindings can be assigned to Users, Groups, and ServiceAccounts.
You are performing a security assessment on an existing Kubernetes cluster. You discover that the kubelet API permits users with valid service account tokens to read sensitive container environment variables and logs. How should you configure the kubelet authorization mode to prevent unauthorized token holders from reading arbitrary pod data?
Webhook authorization forces the kubelet to delegate access checks to the API server's RBAC authorizer.
Why this answer
Enabling Webhook authorization on the kubelet ensures that API server RBAC rules govern access to kubelet subresources like logs and exec.
An auditor notices that a cluster allows users to create Pods that mount host paths (`hostPath`). Which threat does this pose to the underlying node integrity?
Mounting host directories lets a compromised container modify critical host files, leading directly to host takeover.
Why this answer
hostPath mounts allow containers to read and write directly to the host node's filesystem, enabling attackers to tamper with system files, cron jobs, or SSH authorized keys for node takeover.
A security team is implementing NIST SP 800-190 guidelines for container runtime security. Which kernel feature is leveraged by container runtimes to restrict system calls and meet least-privilege execution requirements?
Seccomp restricts the system calls a containerized process can make.
Why this answer
Seccomp (secure computing mode) filters system calls made by containers, aligning with NIST guidelines to restrict container capabilities and reduce attack surface.
In the context of Kubernetes API server security, which TWO mechanisms are used to authenticate incoming API requests?
The API server validates client certificates signed by the cluster CA for authentication.
Why this answer
X509 client certificates and Service Account bearer tokens are standard Kubernetes authentication mechanisms.
A security engineer is reviewing the security posture of an enterprise Kubernetes deployment. They note that developers push container images directly to a private registry without vulnerability scanning. Which of the 4Cs is directly impacted by this gap?
Container image vulnerability management is a core component of Container security.
Why this answer
Unscanned container images introduce vulnerabilities into the Container layer.
An attacker with compromised Kubernetes credentials attempts to hide malicious activity by deleting Kubernetes audit logs on the worker node. Where should audit logs ideally be stored and managed in a securely hardened cluster to prevent tampering and ensure non-repudiation?
Centralized logging ensures that even if an attacker gains root access to control plane or worker nodes, they cannot alter or delete historical audit records.
Why this answer
Audit logs should be sent synchronously or asynchronously out of the control plane nodes to an external, write-once-read-many (WORM) storage or centralized SIEM system where local node compromise does not affect log integrity.
An administrator wants to prevent users from creating pods that mount the host network ('hostNetwork: true'). Which tool or feature is best suited to enforce this restriction natively across the cluster?
Both baseline and restricted Pod Security profiles disallow hostNetwork.
Why this answer
The Pod Security admission controller's 'restricted' or 'baseline' profile automatically blocks pods that set 'hostNetwork: true'.
A platform engineer needs to secure an Ingress resource using TLS termination, ensuring that sensitive private keys are stored securely within the cluster and referenced safely. Which Kubernetes resource should be created to store the TLS certificate and private key pair?
The kubernetes.io/tls secret type standardizes the storage of tls.crt and tls.key fields for Ingress and other components.
Why this answer
Kubernetes Secrets of type kubernetes.io/tls are specifically designed to store TLS certificates and private keys securely, allowing them to be referenced directly within the Ingress spec.
You want to enable encryption at rest for Kubernetes Secrets in your cluster using an external KMS (Key Management Service) provider. Which component on the control plane reads the EncryptionConfiguration file and handles this encryption?
The API server handles encryption at rest and integrates with the EncryptionConfiguration resource and KMS plugins.
Why this answer
The kube-apiserver is responsible for interacting with etcd and applies the EncryptionConfiguration to encrypt secrets before writing them to etcd and decrypting them when read.
An administrator needs to secure access to the Kubernetes API server from an external CI/CD pipeline. Which mechanism should be used to authenticate the pipeline using an existing external identity provider without embedding long-lived static tokens?
This is the native method for integrating external OIDC identity providers with the Kubernetes API server.
Why this answer
OpenID Connect (OIDC) tokens allow Kubernetes API servers to authenticate users and service accounts via an external identity provider, avoiding static tokens.
A cluster administrator needs to intercept and reject any resource creation requests that do not include a mandatory security-context label. Which admission controller type should be implemented?
Validating admission webhooks inspect incoming requests and can reject them if they fail specific organizational policies.
Why this answer
Validating admission webhooks are executed after all mutation phases are complete and can accept or reject requests based on custom validation logic.
Which TWO of the following mechanisms are standard methods used by container runtimes (such as containerd or CRI-O) to isolate container workloads from the host kernel and other containers? (Choose TWO)
Cgroups limit, account for, and isolate the resource usage (CPU, memory, disk I/O) of a collection of processes.
Why this answer
Container runtimes rely heavily on Linux kernel namespaces (to isolate system views such as network, process IDs, and mounts) and control groups (cgroups, to limit CPU, memory, and I/O resources).
You are troubleshooting a pod that fails to start because it attempts to run a container with privileges. The cluster enforces the 'baseline' Pod Security Standard. Which container configuration will cause the Pod Security Admission controller to reject the pod?
Privileged containers are explicitly prohibited by both baseline and restricted Pod Security Standards.
Why this answer
The baseline standard disallows privileged containers. Setting 'securityContext.privileged: true' violates the baseline standard and will be rejected.
Which of the following describes a recommended security practice when managing Kubernetes Secrets?
Principle of least privilege applies strongly to secrets access.
Why this answer
Restricting RBAC permissions to secrets ensures that only authorized users and workloads can read sensitive data.
Your team is storing sensitive database credentials in Kubernetes Secrets. A security review reveals that base64 encoding does not provide encryption at rest. What mechanism should you enable to ensure Secrets are encrypted when stored in etcd?
This is the native Kubernetes mechanism for encrypting Secret resources at rest in etcd.
Why this answer
Enabling EncryptionConfiguration with providers like aescbc or kms ensures that API server encrypts secret data before writing it to etcd.
You need to grant a monitoring tool permission to perform HTTP GET requests against health endpoints across all pods in the cluster, but no other API access. How should you define the RBAC rules?
Non-resource URLs grant access to cluster endpoints that do not correspond to API resource objects.
Why this answer
Non-resource URLs like '/healthz' or pod subresources like '/pods/{name}/proxy' are specified using 'nonResourceURLs' or subresource permissions in rules.
A security engineer is configuring a service mesh using Istio to ensure that all east-west traffic between microservices is mutually authenticated and encrypted. Which custom resource must be configured with a STRICT mTLS mode to enforce this requirement cluster-wide?
PeerAuthentication defines whether mTLS is enabled or disabled for workloads in a specific namespace or the entire mesh, supporting STRICT mode.
Why this answer
Istio uses the PeerAuthentication custom resource to define how traffic is authenticated between services. Setting it to STRICT mode ensures that all incoming traffic to the workload must be TLS encrypted and authenticated via mTLS.
An engineer is reviewing the threat model of a Kubernetes cluster exposed to the public internet via a LoadBalancer service. Which configuration flaw most commonly leads to unintended external exposure of administrative dashboards?
Unauthenticated or loosely secured dashboards exposed to the public internet allow arbitrary attackers to gain administrative cluster control.
Why this answer
Deploying management tools (like Kubernetes dashboards, monitoring UIs, or debugging tools) with external LoadBalancer services or NodePorts without authentication or network restriction is a major threat vector.
Which open-source auditing tool provides compliance scores and checks against Kubernetes security frameworks such as NSA-CISA and CIS?
Kubescape is an open-source Kubernetes security platform for risk and compliance analysis.
Why this answer
Datree or Kubescape are prominent tools for compliance scoring. Kubescape specifically evaluates Kubernetes clusters against multiple security frameworks including CIS and NSA-CISA.
Which THREE of the following features or configurations are associated with securing Ingress traffic in a Kubernetes cluster? (Choose THREE)
This enables secure HTTPS communication by terminating TLS at the Ingress controller using stored certificate keys.
You are troubleshooting a secure etcd cluster where a new control plane node cannot join the cluster. The logs indicate a TLS handshake failure between etcd peers. Which etcd configuration flag specifies the trusted CA certificate used to verify peer certificates?
This flag ensures peer certificates are validated against the correct CA.
Why this answer
The --peer-trusted-ca-file flag specifies the CA certificate used to verify peer-to-peer TLS connections in etcd.
Which TWO types of selectors can be used within a Kubernetes NetworkPolicy ingress rule to specify allowed traffic sources?
namespaceSelector matches entire source namespaces based on labels.
Why this answer
Ingress 'from' blocks support podSelector and namespaceSelector to match traffic sources.
When configuring the Kubernetes API server authorization modes, which mode evaluates requests against Kubernetes RBAC policies?
RBAC is the standard authorization mode for defining fine-grained user and service account permissions.
Why this answer
The RBAC (Role-Based Access Control) authorization mode uses cluster roles and bindings to govern access.
An enterprise is enforcing the CIS Kubernetes Benchmark for control plane configuration. Which TWO parameters must be correctly configured on the kube-apiserver to meet strict compliance auditing standards? (Choose TWO)
An audit policy file must be specified to govern what events are recorded.
Why this answer
CIS benchmarks require enabling auditing via audit log path and audit policy file configuration on the kube-apiserver.
Which of the following is a key component of the Kubernetes threat model concerning the compromise of node kubelets via insecure configuration?
Port 10255 provides unauthenticated read access to node data, exposing sensitive environment variables and pod metadata.
Why this answer
Exposing the Kubelet read-only port (10255) allows unauthenticated retrieval of pod specifications, container logs, and environment variables without any credentials.
An attacker manages to compromise a low-privilege pod inside a Kubernetes cluster and attempts to escalate privileges or pivot to other cluster components. Which THREE of the following misconfigurations or weaknesses would significantly aid the attacker's lateral movement or privilege escalation? (Choose THREE)
Correct. Overly permissive RBAC allows the compromised token to control the entire cluster.
Why this answer
Attackers exploit weak RBAC rules, insecure access to the API server or cloud metadata, and overly permissive host namespaces to move laterally or escape.
Which component provides network routing and iptables/IPVS rule management across worker nodes for Kubernetes Services?
Kube-proxy manages service networking on nodes.
Why this answer
kube-proxy maintains network rules on nodes allowing network communication to pods.
A security team discovers that an application container running as root has successfully mounted the host's Docker socket (`/var/run/docker.sock`). What is the primary attack vector enabled by this misconfiguration?
The Docker socket is the API endpoint for the container engine; sending commands to it lets the container spawn arbitrary containers on the underlying host node.
Why this answer
Access to the Docker socket allows a container to create sibling containers on the host, often mounting the host root filesystem (`/`) and achieving full node compromise.
When designing a defense-in-depth strategy across the 4Cs, which THREE independent security controls can be applied at different layers? (Choose THREE)
Image signing secures the Container layer.
Why this answer
Defense-in-depth spans multiple layers: SAST/SCA for Code, image signing for Container, and NetworkPolicies for Cluster.
What is the primary security benefit of using immutable container base distroless images?
Removing package managers and shell utilities stops attackers from downloading or executing arbitrary scripts even if remote code execution is achieved.
Why this answer
Distroless images contain only the application and its runtime dependencies, stripping out shells, package managers, and utilities, which drastically reduces the attack surface and prevents attackers from executing shell commands if compromised.
An organization is performing a STRIDE-based threat model on their Kubernetes deployment. Which TWO of the following threats map directly to the 'Tampering' category in a Kubernetes environment?
Modifying image contents in a registry constitutes tampering with the software supply chain.
Why this answer
Tampering involves unauthorized modification of data or code. Modifying container images in a registry and tampering with Kubernetes manifests in etcd/Git repository are prime examples.
Which THREE practices are critical for securing container registries and image distribution pipelines? (Choose three)
Scanning images immediately upon upload ensures vulnerabilities are identified before distribution.
Why this answer
Securing container registries involves implementing role-based access control, enabling vulnerability scanning on push, and enforcing image signing.
Practice KCSA by domain
Target a specific domain to shore up weak areas.