CKS Kubernetes Runtime Security Quiz

1. What does the 'runAsNonRoot' security context setting enforce?

Containers must run with a non-root user

Pods cannot access the root filesystem

Root privileges are denied at the cluster level

The kubelet runs as a non-root user

2. What is the purpose of a NetworkPolicy's 'egress' field?

Controls outgoing traffic from pods

Defines incoming traffic to pods

Manages pod-to-service communication

Restricts external API calls

3. Which capability should be dropped by default for enhanced security in containers?

CAP_SYS_ADMIN

CAP_NET_BIND_SERVICE

CAP_CHOWN

CAP_SETUID

4. What is the main difference between a default seccomp profile and a localhost profile?

Localhost profiles are custom files on the node; defaults are built-in

Defaults are more restrictive than localhost profiles

Localhost profiles require elevated permissions

Defaults apply cluster-wide; localhost applies to single pods

5. Which Kubernetes admission controller validates Pod Security Standards?

PodSecurityPolicy admission controller

SecurityPolicy webhook

PodSecurityStandards validator

RuntimeSecurityController

6. In AppArmor, what does an 'enforce' mode do compared to 'complain' mode?

Enforce blocks violations; complain only logs them

Complain is more restrictive than enforce

Enforce applies to system calls; complain applies to files

They are functionally identical

7. What does the 'readOnlyRootFilesystem' setting in a security context do?

Prevents containers from writing to the root filesystem

Disables root user access

Encrypts the container's filesystem

Limits container CPU usage

8. Which runtime behavior detection tool integrates with Kubernetes to monitor syscalls?

Falco

Prometheus

Istio

CoreDNS

9. What is the primary benefit of using a 'restricted' Pod Security Standard?

Enforces security best practices and reduces attack surface

Increases container performance

Simplifies network policy configuration

Eliminates the need for RBAC

10. In Kubernetes, which field in a Pod spec defines the seccomp profile?

Spec.securityContext.seccompProfile

Spec.containers.seccomp

Spec.runtime.seccomp

Metadata.seccomp

11. What is the primary purpose of seccomp in Kubernetes runtime security?

Restrict system calls made by containers

Manage network traffic between pods

Encrypt data at rest in etcd

Control user authentication to the API server

12. Which Kubernetes object allows you to restrict pod-to-pod communication by labels?

NetworkPolicy

PodSecurityPolicy

ServiceAccount

ClusterRole

13. What is the purpose of SELinux in container runtime security?

Enforce mandatory access control at the kernel level

Manage container networking policies

Provide encryption for inter-pod communication

Control kubelet authentication

14. Which tool is commonly used to audit and enforce seccomp policies in Kubernetes?

Falco

Kubelet

Kube-apiserver

Etcd

15. In a Pod Security Policy, what does the 'privileged' field control?

Whether containers can run in privileged mode

Pod access to node resources

Network namespace sharing

Container image pull permissions

16. What does AppArmor use to define security policies for processes?

Profiles loaded into the kernel

Iptables rules

Container image labels

RBAC role definitions

17. Which Pod Security Standard level is most restrictive for workload isolation?

Baseline

Restricted

Privileged

Enforced

18. What is the default seccomp profile action when a system call is not explicitly allowed?

SCMP_ACT_ALLOW

SCMP_ACT_KILL_PROCESS

SCMP_ACT_LOG

SCMP_ACT_WARN

19. In Kubernetes, what does a NetworkPolicy control?

Traffic between pods and external networks

DNS resolution within the cluster

Image registry access for pod deployments

Container resource limits and quotas

20. Which Linux kernel module provides mandatory access control (MAC) for containers?

AppArmor

EBPF

Cgroups

Netfilter