Appropriately Use Kernel Hardening Tools Such as AppArmor, Seccomp CKS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A system administrator has created an AppArmor profile for a containerized application. They want to test the profile without breaking the application. They load the profile in complain mode. What is the expected behavior?

   • AThe profile will be inactive until it is switched to enforce mode.
   • BThe profile will block any operations that are not allowed, and log them.
   • CThe profile will allow all operations but log any that would be blocked in enforce mode.
   • DThe profile will only apply to new processes, not existing ones.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which command is used to load an AppArmor profile into the kernel?

   • Aapparmor_parser -a /etc/apparmor.d/profile
   • Bapparmor_parser -r /etc/apparmor.d/profile
   • Csystemctl start apparmor
   • Daa-enforce /etc/apparmor.d/profile
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of AppArmor in a Linux system?

   • ATo isolate containers using kernel namespaces
   • BTo restrict the system calls a process can make
   • CTo encrypt the filesystem of a container
   • DTo confine a process by enforcing a security profile that limits its access to files, capabilities, and network resources
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In AppArmor's security model, what is a profile attached to?

   • AAn executable file or process
   • BA specific network port
   • CA specific user or group
   • DA container image
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A DevOps engineer wants to restrict system calls for a container running a web server. They have created a custom seccomp profile that allows only the necessary syscalls. They apply it to the pod using the following securityContext: ```yaml securityContext: seccompProfile: type: Localhost localhostProfile: profiles/audit.json ``` The pod fails to start with an error that the profile cannot be loaded. The profile file is located at `/var/lib/kubelet/seccomp/profiles/audit.json` on the node. What is the most likely cause?

   • AThe `localhostProfile` path is relative to the kubelet's root directory, not the seccomp directory.
   • BThe seccomp profile type should be `RuntimeDefault` instead of `Localhost`.
   • CThe pod must have a service account with permission to use seccomp profiles.
   • DThe seccomp profile must be loaded into the kernel before use.
   Reveal Solution Discussion Select an answer first