Appropriately Use Kernel Hardening Tools Such as AppArmor, Seccomp CKS Practice Questions (Page 4)

Questions 16–19

1. 16foundation · easy

   Which statement correctly describes how seccomp profiles filter system calls?

   • AThey restrict access to specific file paths
   • BThey encrypt syscall arguments to protect sensitive data
   • CThey limit the number of syscalls a process can make per second
   • DThey allow or deny syscalls based on rules defined in the profile
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What does the RuntimeDefault seccomp profile do in Kubernetes?

   • AIt loads a custom profile from a file on the node
   • BIt only allows syscalls required for basic container operation
   • CIt uses the container runtime's default seccomp profile, which blocks dangerous syscalls
   • DIt disables seccomp entirely, allowing all syscalls
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   You are deploying a legacy application that requires the 'chroot' syscall, which is not in the default Docker seccomp profile. You want to use a seccomp profile that is as restrictive as possible while still allowing this syscall. What is the best approach?

   • AUse the 'RuntimeDefault' profile and add a custom rule to allow 'chroot'.
   • BUse the 'Localhost' profile and point it to the runtime's default profile file.
   • CSet the seccompProfile type to 'Unconfined'.
   • DCreate a custom profile that starts from the runtime's default profile and adds 'chroot' to the allowed syscalls.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In Kubernetes, which annotation is used to apply an AppArmor profile to a container?

   • Aapparmor.beta.kubernetes.io/<container-name>
   • Bcontainer.apparmor.security.kubernetes.io/<container-name>
   • Cseccomp.security.alpha.kubernetes.io/pod
   • Dkubernetes.io/apparmor/<container-name>
   Reveal Solution Discussion Select an answer first