Appropriately Use Kernel Hardening Tools Such as AppArmor, Seccomp CKS Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A container is running but a specific operation fails with a 'Operation not permitted' error. Which tool would you use to check if a seccomp profile is blocking a syscall?

   • Aaa-status
   • Bsystemctl status kubelet
   • Ckubectl logs
   • Ddmesg
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which annotation can be used to apply a seccomp profile to a pod in Kubernetes?

   • Aapparmor.beta.kubernetes.io/pod
   • Bcontainer.seccomp.kubernetes.io/pod
   • Ckubernetes.io/seccomp/pod
   • Dseccomp.security.alpha.kubernetes.io/pod
   Reveal Solution Discussion Select an answer first
4. 8expert · medium

   A pod is running with an AppArmor profile that denies write access to /tmp. The application needs to write temporary files to /tmp. You have updated the profile to allow this and reloaded it with 'apparmor_parser -r'. However, the pod is still failing to write to /tmp. What is the most likely reason?

   • AThe profile file has a syntax error.
   • BThe profile is in complain mode.
   • CThe pod was not restarted after the profile was reloaded.
   • DThe kubelet is caching the old profile.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which statement accurately describes how AppArmor profiles restrict applications?

   • AThey limit CPU and memory usage of the application
   • BThey enforce mandatory access control by allowing or denying access to paths, network, and capabilities
   • CThey encrypt the application's binary to prevent tampering
   • DThey filter each system call and deny those not in an allowlist
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   An application pod is running with an AppArmor profile that denies access to /etc/shadow. The application now needs to read this file for a new feature. You want to make the change with minimal disruption and maintain the security posture. What is the best course of action?

   • ARemove the AppArmor annotation from the pod and redeploy it.
   • BChange the pod's annotation to use a different, more permissive profile that allows /etc/shadow access.
   • CUse 'aa-complain' to set the profile to complain mode, then restart the pod.
   • DUpdate the AppArmor profile to allow read access to /etc/shadow, reload it with 'apparmor_parser -r', and restart the pod.
   Reveal Solution Discussion Select an answer first