Kubernetes Threat Model

What is the security risk of configuring `privileged: true` in a container's SecurityContext?

A security auditor reviews a Kubernetes cluster threat model and identifies that the Kubelet API on port 10250 permits unauthenticated requests if not configured properly. What authentication and authorization mode should be enforced on the Kubelet to prevent unauthorized remote code execution?

An organization wants to prevent supply chain attacks where malicious code is injected into third-party Helm charts before deployment. What mitigation technique provides cryptographic verification of Helm chart integrity and authenticity?

A security engineer is performing a threat analysis on a Kubernetes cluster and identifies a risk where a compromised container can exhaust the available CPU and memory on the underlying worker node, causing a denial of service for other tenants. Which native Kubernetes admission mechanism is specifically designed to mitigate this threat vector?

A security engineer identifies that an enterprise Kubernetes cluster has several cluster-admin bindings granted to user accounts that have left the company. Which Kubernetes security principle has been violated?

An administrator notices that a compromised Pod is attempting to access the cloud provider metadata service to retrieve IAM role credentials. Which native Kubernetes resource is best suited to block this specific attack vector at the network layer?

Which THREE of the following mechanisms are essential for securing the Kubernetes control plane against unauthorized access and privilege escalation?

An attacker gains execution in a container and attempts to perform a denial of service attack on other workloads sharing the same Kubernetes node by consuming all available CPU and memory resources. What Kubernetes feature prevents this cross-workload resource exhaustion?

Which attack vector involves tricking a Kubernetes cluster user or service into executing unintended actions via authenticated sessions, frequently mitigated by robust CSRF defenses and proper API design?

In a zero-trust Kubernetes architecture, an attacker attempts to exploit the Kubernetes API server via a Server-Side Request Forgery (SSRF) flaw in a poorly written custom controller. Which defense-in-depth mechanism specifically protects against unauthorized API requests originating from inside the cluster network?

An administrator needs to analyze the STRIDE threat model category that encompasses an attacker gaining unauthorized elevation of privilege inside a Kubernetes cluster by exploiting a misconfigured RBAC ClusterRoleBinding. Which threat category does this represent?

When modeling threats related to Kubernetes secrets management, which TWO actions help protect secrets from unauthorized access?

A security engineer is analyzing supply chain risks for container images. An unsigned image from an untrusted public registry is pulled into a secure cluster. Which Admission Controller plugin can be leveraged to prevent the deployment of unsigned container images?

An adversary successfully compromises a workload and extracts the default service account token. By default, what permission level does this unconfigured service account token possess in modern Kubernetes clusters?

Which THREE of the following steps are recognized best practices for hardening worker nodes against attacks and container escapes?

An organization wants to analyze potential threats to their Kubernetes cluster using the STRIDE model. Which STRIDE category maps to an attacker eavesdropping on unencrypted internal cluster traffic between pods?

An attacker gains execution inside a container that has the `CAP_SYS_ADMIN` capability enabled and shares the host's IPC namespace. How does `CAP_SYS_ADMIN` facilitate container escape?

Which Kubernetes feature allows administrators to define mandatory security baselines, such as disallowing privileged containers, across an entire namespace or cluster?

Which THREE of the following configurations or features represent critical attack vectors or misconfigurations in a Kubernetes cluster threat model?

A developer configures a Kubernetes Pod with `hostNetwork: true`. Under the STRIDE threat model, which threat category is most directly introduced or elevated by this configuration?

An auditor is evaluating the Kubernetes control plane attack surface. Which component exposes the primary interface for cluster management and must be protected with strong authentication and authorization?

An auditor is evaluating the security posture of an on-premises Kubernetes cluster. The team notices that the etcd data directory is stored without encryption at rest. What is the primary threat this exposes the cluster to?

What is the primary risk associated with running containers as the `root` user (`runAsUser: 0` or omitting the user directive)?

An attacker who achieves remote code execution inside a misconfigured container discovers that the service account token mounted at /var/run/secrets/kubernetes.io/serviceaccount/token has cluster-wide administrative permissions. Which Kubernetes security feature should be enabled on the ServiceAccount to mitigate the risk of token theft and misuse?

Which of the following represents a common cloud-native supply chain attack vector where malicious actors publish packages with names similar to popular libraries?

An organization is building a secure software supply chain for Kubernetes. They want to ensure that containers running in the cluster were built from verified source code and passed automated security gates. Which tool combination supports this attestation and verification pipeline?

An auditor is reviewing the Kubernetes attack surface and notes that a container is running with privileged: true in its securityContext. Which threat model risk does this setting introduce?

A developer accidentally hardcodes a database password directly into a container's environment variables within a Deployment manifest. According to the Kubernetes threat model, what is the primary risk associated with storing plaintext secrets as environment variables?

A security team is evaluating the attack surface of the Kubernetes control plane. They notice that the kubelet API port 10250 is accessible from the internal pod network without proper authorization checks if authentication defaults are misconfigured. What is the primary threat vector associated with an unauthenticated, accessible kubelet API?

An attacker with read access to Kubernetes Secrets inspects a secret containing TLS private keys. Under the STRIDE threat model, what specific threat category does this represent regarding confidentiality?

An attacker compromises a cluster node and attempts to inspect container communication. By default, how is pod-to-pod network traffic handled across different nodes in a standard Kubernetes cluster without a service mesh or CNI encryption enabled?

During a supply chain security audit, a platform engineer discovers that container images deployed into the cluster are being pulled from public registries without cryptographic verification of their provenance or integrity. Which integrated Kubernetes security control should be implemented alongside an admission webhook to verify image signatures before admission?

A security engineer discovers that an attacker has gained access to a container and is attempting to modify container files in a way that persists across pod restarts if the container image is faulty. However, the root filesystem is marked as readOnlyRootFilesystem: true. What is the impact of this setting on the attack?

Which THREE of the following capabilities or runtime configurations pose extreme risks of container escape when granted to an untrusted workload?

A cluster administrator is conducting a threat analysis regarding supply chain vulnerabilities in container registries and deployment pipelines. Which TWO of the following practices directly mitigate supply chain threats in Kubernetes? (Choose TWO)

When modeling threats for a Kubernetes cluster using the STRIDE methodology, identifying scenarios where an attacker intercepts unencrypted traffic between worker nodes or between a client and the API server addresses which TWO STRIDE categories? (Choose TWO)

An administrator wishes to defend against supply chain attacks involving malicious third-party Kubernetes operators installed from public catalogs. What security practice is most effective before installing such operators?

An auditor evaluates network security controls in a Kubernetes cluster. Which TWO configurations help mitigate lateral movement and network-based attacks between pods?

An auditor notices that a cluster allows users to create Pods that mount host paths (`hostPath`). Which threat does this pose to the underlying node integrity?

In the context of Kubernetes API server security, which TWO mechanisms are used to authenticate incoming API requests?

An attacker with compromised Kubernetes credentials attempts to hide malicious activity by deleting Kubernetes audit logs on the worker node. Where should audit logs ideally be stored and managed in a securely hardened cluster to prevent tampering and ensure non-repudiation?

An engineer is reviewing the threat model of a Kubernetes cluster exposed to the public internet via a LoadBalancer service. Which configuration flaw most commonly leads to unintended external exposure of administrative dashboards?

Which of the following is a key component of the Kubernetes threat model concerning the compromise of node kubelets via insecure configuration?

An attacker manages to compromise a low-privilege pod inside a Kubernetes cluster and attempts to escalate privileges or pivot to other cluster components. Which THREE of the following misconfigurations or weaknesses would significantly aid the attacker's lateral movement or privilege escalation? (Choose THREE)

A security team discovers that an application container running as root has successfully mounted the host's Docker socket (`/var/run/docker.sock`). What is the primary attack vector enabled by this misconfiguration?

What is the primary security benefit of using immutable container base distroless images?

An organization is performing a STRIDE-based threat model on their Kubernetes deployment. Which TWO of the following threats map directly to the 'Tampering' category in a Kubernetes environment?

A cluster administrator wants to mitigate supply chain risks stemming from vulnerable base images used by developers. Where in the software lifecycle should vulnerability scanning ideally be integrated first to shift-left security?

A Kubernetes cluster experiences an attack where an untrusted pod attempts to access the Kubernetes API server and discover cluster secrets. The cluster uses RBAC. What is the mechanism that prevents this pod from reading secrets in other namespaces?

Which THREE of the following supply chain vulnerabilities or risks can impact Kubernetes application deployments during the build or deployment phase?

A DevOps team uses mutable image tags like `:latest` in their deployment manifests. Under supply chain threat modeling, what vulnerability does this practice introduce?