A container fails to start with an AppArmor denial error. What is the most likely cause?

The seccomp profile is blocking a required syscall

The container image is missing a required binary

The pod's service account lacks permissions

The AppArmor profile is not loaded on the node

You have an AppArmor profile that is too restrictive and is causing a pod to crash. You want to temporarily disable the profile without removing it from the node, so you can debug the application. What is the correct command to do this?

Run 'aa-disable /etc/apparmor.d/secure-app'

Run 'aa-complain /etc/apparmor.d/secure-app'

Run 'apparmor_parser -R /etc/apparmor.d/secure-app'

You have loaded an AppArmor profile named 'secure-app' on a node. You want to verify it is active and then apply it to a new pod. Which command sequence should you use to verify the profile is loaded?

Run 'apparmor_parser -r /etc/apparmor.d/secure-app' to reload the profile.

Run 'cat /sys/module/apparmor/parameters/enabled' to check if AppArmor is enabled.

Run 'aa-status' and check for 'secure-app' in the list of loaded profiles.

Run 'systemctl status apparmor' to check the service status.

What is the primary function of a seccomp profile in a container runtime?

To limit file access based on pathnames

To restrict the system calls a process can make

To isolate containers into separate namespaces

To encrypt network traffic between containers

Certified Kubernetes Security Specialist (CKS)

Domain 5Objective 4

Appropriately Use Kernel Hardening Tools Such as AppArmor, Seccomp CKS Practice Questions (Page 1)

Part of the System Hardening domain, which accounts for 10% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

7concepts

10%of the exam

Questions 1–5

1foundation · easy
A container fails to start with an AppArmor denial error. What is the most likely cause?
Select an answer first
2application · medium
You have an AppArmor profile that is too restrictive and is causing a pod to crash. You want to temporarily disable the profile without removing it from the node, so you can debug the application. What is the correct command to do this?
Select an answer first
3application · easy
You have loaded an AppArmor profile named 'secure-app' on a node. You want to verify it is active and then apply it to a new pod. Which command sequence should you use to verify the profile is loaded?
Select an answer first
4foundation · easy
What is the primary function of a seccomp profile in a container runtime?
Select an answer first
5foundation · easy
What value should be used in the apparmor.beta.kubernetes.io annotation to apply a profile named 'my-profile' that is loaded on the node?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.