Select Two (Multi-Select) Questions

InsecureServing

Why wrong: InsecureServing is not a valid admission plugin.

AlwaysAllow

Why wrong: AlwaysAllow bypasses validation and is rejected by security frameworks.

Kustomize

Why wrong: Kustomize customizes Kubernetes objects declaratively.

Helm

Why wrong: Helm is a package manager for Kubernetes, not a compliance auditor.

Kubectl

Why wrong: Kubectl is the standard command-line cluster management tool.

--service-account-lookup=false

Why wrong: CIS recommends setting --service-account-lookup to true, not false.

--enable-bootstrap-auth-only=true

Why wrong: This is not a standard CIS control plane audit requirement.

--profiling=true

Why wrong: CIS recommends disabling profiling (--profiling=false) to prevent information disclosure.

Enable anonymous authentication on the kubelet secure port.

Why wrong: Anonymous access increases exposure.

Run kubelet containers in privileged mode.

Why wrong: Kubelet runs directly on the host, not as a container, and privileged mode should be avoided.

Set authorization.mode to AlwaysAllow.

Why wrong: AlwaysAllow bypasses authorization checks.

Store audit logs in unencrypted public ConfigMaps.

Why wrong: ConfigMaps are unencrypted and public, making them unsuitable for sensitive audit logs.

Disable audit logging entirely to maximize API server performance.

Why wrong: Disabling audit logs removes vital security visibility.

Secret

Why wrong: Secrets store sensitive data, not subjects.

Namespace

Why wrong: Namespaces are objects, not subjects.

PersistentVolume

Why wrong: PersistentVolumes are storage resources, not subjects.

Disabling all automated security tooling to speed up commits

Why wrong: Disabling security tooling degrades security posture.

Waiting until a production breach occurs to audit logs

Why wrong: This is reactive security, the opposite of shifting left.

Relying entirely on manual code reviews post-release

Why wrong: Manual post-release reviews are slow and do not constitute shifting left.

Enforcement of strict TLS 1.3 encryption on all connections.

Why wrong: The insecure port uses plaintext HTTP, not TLS.

Mandatory mutual TLS client certificate verification.

Why wrong: It does not require client certificates.

Automatic activation of etcd encryption at rest.

Why wrong: It has no effect on etcd data encryption.

etcd auto-compaction is permanently disabled

Why wrong: Auto-compaction settings do not dictate security compliance.

etcd is exposed directly on the public internet without authentication

Why wrong: Exposing etcd publicly is a critical security vulnerability.

Allow all users to read Kubernetes Secrets by default

Why wrong: Secrets contain sensitive data and access must be strictly restricted.

Grant cluster-admin permissions to all application service accounts for ease of deployment

Why wrong: Granting cluster-admin broadly is a severe security violation.

Disallowing privileged containers.

Why wrong: Privileged containers are prohibited by both baseline and restricted profiles.

Prohibiting hostPort usage entirely.

Why wrong: Both baseline and restricted profiles disallow hostPort by default (or restrict them).

Secrets are strongly encrypted at rest using AES-256 encryption by default in etcd.

Why wrong: By default, secrets are only base64 encoded in etcd, not encrypted at rest unless an encryption configuration is explicitly enabled.

Secrets automatically expire and rotate every 30 days unless explicitly disabled.

Why wrong: Kubernetes Secrets do not have a built-in automatic expiration or rotation mechanism without external tools.

Secrets encoded in base64 provide cryptographic security comparable to robust symmetric encryption.

Why wrong: Base64 is an encoding scheme, not encryption; anyone with access to the object can decode it instantly.

Unencrypted HTTP basic auth files with default passwords.

Why wrong: Basic auth is deprecated, insecure, and disabled in hardened environments.

Anonymous packet sniffing via kube-proxy.

Why wrong: Packet sniffing is a network troubleshooting method, not an authentication method.

Direct root SSH access to etcd nodes.

Why wrong: SSH access is an infrastructure-level administrative method, not an API server authentication mechanism.

Configure the API server to use HTTP instead of HTTPS for performance.

Why wrong: Using HTTP exposes traffic in plaintext, which is a major security violation.

Store all kubeconfig credentials in public ConfigMaps.

Why wrong: ConfigMaps are unencrypted and public to namespace users, compromising security.

Grant cluster-admin permissions to all authenticated users by default.

Why wrong: This violates the principle of least privilege.

Allowing unrestricted use of the host network and host PID namespaces

Why wrong: Restricted profile disallows hostNetwork and hostPID.

Enabling privileged mode for all standard workloads

Why wrong: Privileged mode is explicitly prohibited in the restricted profile.

Store plaintext passwords directly inside Dockerfile ENV directives

Why wrong: Hardcoding secrets in images violates security guidelines.

Rely exclusively on public unverified base images to speed up development

Why wrong: Using unverified public images introduces significant supply chain risk.

Compiled directly into the container image binary

Why wrong: Secrets are runtime objects, not baked into container image binaries.

Injected through kernel sysctl parameters

Why wrong: Sysctl parameters configure kernel tunables, not secrets.

ConfigMap

Why wrong: ConfigMaps store non-sensitive configuration data and cannot hold RBAC roles.

Namespace

Why wrong: Namespaces are organizational boundaries, not subjects.

PersistentVolume

Why wrong: PersistentVolumes represent storage volumes, not security principals.

container runtime (e.g., containerd)

Why wrong: The container runtime runs on worker nodes to execute containers.

kube-proxy

Why wrong: Kube-proxy runs on worker nodes, not as a core control plane binary.

--anonymous-auth to enable unauthenticated cluster access.

Why wrong: Anonymous auth weakens security.

--insecure-port to allow unencrypted HTTP traffic.

Why wrong: Insecure ports reduce security.

--enable-http2=false to disable secure multiplexing.

Why wrong: HTTP/2 is standard and secure; disabling it is not a security hardening recommendation.