Appropriately Use Kernel Hardening Tools Such as AppArmor, Seccomp CKS Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A pod is configured with both an AppArmor profile and a seccomp profile. The pod fails to start with an error that the seccomp profile is not found. The AppArmor profile is correctly loaded. What is the most likely cause?

   • AThe pod is using an older Kubernetes version that does not support seccomp.
   • BThe seccomp profile file is not present on the node at the expected path.
   • CThe AppArmor profile is interfering with the seccomp profile.
   • DThe seccomp profile is not in the correct format.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team has created an AppArmor profile for a legacy application that runs in a pod. The profile is loaded on all worker nodes. The pod spec includes the annotation `container.apparmor.security.beta.kubernetes.io/nginx: localhost/nginx-profile`. When the pod is scheduled, it fails to start with an error indicating the profile cannot be found. The profile file exists at `/etc/apparmor.d/nginx-profile` on the node. What is the most likely cause?

   • AThe annotation uses the wrong profile name format; it should reference the profile name defined inside the profile file, not the file path.
   • BThe AppArmor kernel module is not loaded on the node.
   • CThe pod is running in a namespace that has a PodSecurity admission policy blocking AppArmor.
   • DThe AppArmor profile is not in enforce mode.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What does seccomp (secure computing mode) do in Linux?

   • AIt limits the file paths a process can access
   • BIt restricts the system calls a process can make
   • CIt isolates processes in separate namespaces
   • DIt encrypts network traffic of a process
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which field in a pod's securityContext is used to apply a seccomp profile in Kubernetes?

   • Asysctl
   • BappArmorProfile
   • Ccapabilities
   • DseccompProfile
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A pod with an AppArmor annotation fails to start with an error that the profile is not found. What is the most likely cause?

   • AThe AppArmor profile is not loaded on the node
   • BThe container image does not include the profile
   • CThe pod is running in a namespace that denies AppArmor
   • DThe kubelet does not support AppArmor
   Reveal Solution Discussion Select an answer first