Appropriately Use Kernel Hardening Tools Such as AppArmor, Seccomp CKS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of an AppArmor profile in a Linux system?

   • ATo encrypt data at rest on the filesystem
   • BTo isolate processes in separate namespaces
   • CTo limit a process's access to files, network, and capabilities based on a security profile
   • DTo restrict the system calls a process can make
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which command is used to load a new AppArmor profile from a file on a node?

   • Aapparmor_parser -r /etc/apparmor.d/profile
   • Baa-status
   • Csystemctl start apparmor
   • Dkubectl apply -f profile.yaml
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which field in a pod's securityContext is used to specify a seccomp profile in Kubernetes?

   • AseccompProfile
   • BappArmorProfile
   • Csysctl
   • Dcapabilities
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which command would you use to check whether an AppArmor profile is currently loaded on a node?

   • Asystemctl status apparmor
   • Bapparmor_parser -a /etc/apparmor.d/foo
   • Caa-status
   • Dls /etc/apparmor.d
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A development pod is failing with a 'Operation not permitted' error when trying to use the 'uname' syscall. The pod was deployed with a custom seccomp profile that only allows a minimal set of syscalls. The developer insists 'uname' is essential. You need to update the pod to allow this syscall. What is the most efficient way to achieve this?

   • AEdit the existing seccomp profile JSON to add 'uname' to the 'syscalls' list and re-apply it to the pod.
   • BChange the pod's seccompProfile type to 'RuntimeDefault'.
   • CRemove the seccompProfile field from the pod's securityContext.
   • DSet the pod's securityContext.seccompProfile.type to 'Unconfined'.
   Reveal Solution Discussion Select an answer first