CKS Pod Security Standards Quiz

1. In the Restricted PSS level, which Linux capabilities must be dropped?

Only NET_RAW

All capabilities except NET_BIND_SERVICE

No capabilities are dropped

All Linux capabilities

2. Pod Security Standards evaluate pod security at which stage of the pod lifecycle?

During pod runtime

During pod admission

After pod creation

During container image pull

3. The Privileged Pod Security Standard level applies no security restrictions to pods. True or False?

True

False

4. Which PSS enforcement mode prevents pod creation if a violation occurs?

Audit

Warn

Enforce

Block

Submit

6. In Pod Security Standards, which of the following are restricted in the Restricted level? (Select all that apply)

Privilege escalation

Privileged containers

Host networking

Container resource requests

Submit

7. The 'warn' enforcement mode for PSS provides warnings without enforcing restrictions. True or False?

True

False

8. Which enforcement mode for Pod Security Standards logs violations but allows pod creation?

Enforce

Audit

Warn

Restrict

9. Pod Security Standards replace which deprecated Kubernetes security feature?

NetworkPolicy

PodSecurityPolicy

RBAC

SecurityContext

Submit

11. What are the three security levels defined by Kubernetes Pod Security Standards?

Restricted, Baseline, Privileged

Strict, Medium, Relaxed

High, Medium, Low

Enforced, Audit, Warn

12. Pod Security Standards use labels on namespaces to define enforcement. What is the label prefix used?

Security.kubernetes.io

Pod-security.kubernetes.io

Kubernetes.io/security

Pss.kubernetes.io

13. Which of the following volume types are restricted by the Restricted Pod Security Standard? (Select all that apply)

HostPath

EmptyDir

ConfigMap

HostNetwork

Submit

14. Match each Pod Security Standard level to its enforcement mode.

Baseline

Restricted

Privileged

Audit

Submit

15. The Restricted PSS level requires that containers run with read-only root filesystems. True or False?

True

False

16. Which annotation enables audit logging for Pod Security Standard violations in a namespace?

Pod-security.kubernetes.io/audit

Security.kubernetes.io/log

Audit-pod-security

Kubernetes.io/pss-audit

17. Pod Security Standards are enforced through which Kubernetes admission controller?

PodSecurityPolicy

Pod Security Admission

SecurityPolicy

AdmissionControl

18. In Pod Security Standards, what does the 'Restricted' level enforce regarding securityContext?

Containers must run as non-root and drop all capabilities

Containers may run as root but must limit resources

Containers must define resource limits only

No securityContext requirements are enforced

19. The Baseline Pod Security Standard allows which of the following? (Select all that apply)

Running as root user

Privileged containers

Host networking

Unrestricted volume types

Submit

20. Which Pod Security Standard level provides the strongest security controls and disallows privilege escalation?

Baseline

Restricted

Privileged

Standard

CKS Kubernetes Pod Security Standards Quiz

1. In the Restricted PSS level, which Linux capabilities must be dropped?

2.

What first name or nickname would you like us to use?

2. Pod Security Standards evaluate pod security at which stage of the pod lifecycle?

3. The Privileged Pod Security Standard level applies no security restrictions to pods. True or False?

4. Which PSS enforcement mode prevents pod creation if a violation occurs?

5. Pod Security Standards are configured at the ______ level using labels.

6. In Pod Security Standards, which of the following are restricted in the Restricted level? (Select all that apply)

7. The 'warn' enforcement mode for PSS provides warnings without enforcing restrictions. True or False?

8. Which enforcement mode for Pod Security Standards logs violations but allows pod creation?

9. Pod Security Standards replace which deprecated Kubernetes security feature?

10. The Baseline Pod Security Standard permits containers to use the ______ capability.

11. What are the three security levels defined by Kubernetes Pod Security Standards?

12. Pod Security Standards use labels on namespaces to define enforcement. What is the label prefix used?

13. Which of the following volume types are restricted by the Restricted Pod Security Standard? (Select all that apply)

14. Match each Pod Security Standard level to its enforcement mode.

15. The Restricted PSS level requires that containers run with read-only root filesystems. True or False?

16. Which annotation enables audit logging for Pod Security Standard violations in a namespace?

17. Pod Security Standards are enforced through which Kubernetes admission controller?

18. In Pod Security Standards, what does the 'Restricted' level enforce regarding securityContext?

19. The Baseline Pod Security Standard allows which of the following? (Select all that apply)

20. Which Pod Security Standard level provides the strongest security controls and disallows privilege escalation?