A developer wants to use seccomp to restrict system calls for a container. They are not sure which system calls the application needs. What is the best approach to create a seccomp profile?

Use a predefined profile from the Kubernetes documentation.

Use the `RuntimeDefault` profile and gradually add custom rules.

Set `seccompProfile.type: Unconfined` and rely on the container runtime's default.

Run the application with `seccomp=unconfined` and use `strace` to record system calls, then generate a profile from the trace.

A cluster administrator has applied an AppArmor profile to a pod using the annotation `container.apparmor.security.beta.kubernetes.io/container: localhost/restricted`. The pod starts successfully, but the application inside the container is failing with permission denied errors. The administrator wants to debug the profile without blocking the application. What is the best course of action?

Check the seccomp profile associated with the pod.

Use `kubectl exec` to run the application with `--apparmor=complain`.

Switch the profile to complain mode and reload it on the nodes, then check the system logs for violations.

Remove the annotation and restart the pod to see if the application works without the profile.

How is an AppArmor profile applied to a pod in Kubernetes?

By adding a label to the pod with the key apparmor-profile

By setting the seccompProfile field in the pod spec

By setting the securityContext.appArmorProfile field in the pod spec

By adding an annotation to the pod with the key container.apparmor.security.beta.kubernetes.io/

A cluster has a mix of nodes with different container runtimes. Some nodes use containerd, others use CRI-O. A pod with a custom seccomp profile is scheduled to a node using CRI-O, and the pod fails to start with an error that the profile is not found. The profile file is present on the node. What is the most likely cause?

The seccomp profile path is not correctly configured for CRI-O.

The pod is using an annotation that is not supported by CRI-O.

The seccomp profile is not loaded into the kernel.

The seccomp profile is not compatible with CRI-O.

A security administrator wants to confine a containerized application using AppArmor. They have written a profile and loaded it on the node. What is the next step to apply the profile to a pod?

Set `securityContext.appArmorProfile` in the pod spec.

Set the `apparmor` field in the container's command.

Use `kubectl apply -f profile.yaml` to apply the profile to the pod.

Add an annotation to the pod spec: `container.apparmor.security.beta.kubernetes.io/ : localhost/ `

Certified Kubernetes Security Specialist (CKS)

Domain 3Objective 4

Appropriately Use Kernel Hardening Tools Such as AppArmor, Seccomp CKS Practice Questions (Page 3)

Part of the Cluster Hardening domain, which accounts for 15% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

7concepts

15%of the exam

Questions 11–15

11application · medium
A developer wants to use seccomp to restrict system calls for a container. They are not sure which system calls the application needs. What is the best approach to create a seccomp profile?
Select an answer first
12expert · hard
A cluster administrator has applied an AppArmor profile to a pod using the annotation `container.apparmor.security.beta.kubernetes.io/container: localhost/restricted`. The pod starts successfully, but the application inside the container is failing with permission denied errors. The administrator wants to debug the profile without blocking the application. What is the best course of action?
Select an answer first
13foundation · easy
How is an AppArmor profile applied to a pod in Kubernetes?
Select an answer first
14expert · hard
A cluster has a mix of nodes with different container runtimes. Some nodes use containerd, others use CRI-O. A pod with a custom seccomp profile is scheduled to a node using CRI-O, and the pod fails to start with an error that the profile is not found. The profile file is present on the node. What is the most likely cause?
Select an answer first
15application · medium
A security administrator wants to confine a containerized application using AppArmor. They have written a profile and loaded it on the node. What is the next step to apply the profile to a pod?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.

Appropriately Use Kernel Hardening Tools Such as AppArmor, Seccomp CKS Practice Questions (Page 3)

Questions 11–15

A developer wants to use seccomp to restrict system calls for a container. They are not sure which system calls the application needs. What is the best approach to create a seccomp profile?

How is an AppArmor profile applied to a pod in Kubernetes?

A security administrator wants to confine a containerized application using AppArmor. They have written a profile and loaded it on the node. What is the next step to apply the profile to a pod?

Keep studying — Cluster Hardening