How can you verify that a seccomp profile is being enforced on a running container?

By checking the container's status in kubectl get pod

By reading the pod's annotations

By checking the node's system logs

By inspecting the container's /proc/ /status file for the Seccomp field

What is the effect of an AppArmor profile set to 'complain' mode?

The profile only restricts network access

The profile is enforced, and violations are logged

The profile is not enforced, but violations are logged

The profile is completely disabled

A security engineer is explaining AppArmor to a colleague. Which statement accurately describes AppArmor's security model?

AppArmor uses discretionary access control (DAC) to allow users to set permissions on files.

AppArmor restricts system calls by filtering them at the kernel level.

AppArmor uses mandatory access control (MAC) to confine processes based on a profile that specifies allowed file paths, network access, and capabilities.

AppArmor is a container runtime that provides isolation between containers.

An administrator has loaded an AppArmor profile on a node, but when they try to apply it to a pod, the pod fails to start with an error that the profile is not found. The profile is definitely loaded. What is a possible cause?

The annotation is missing the `localhost/` prefix.

The AppArmor profile is in complain mode.

The profile name in the annotation does not match the profile name defined in the profile file.

The pod is running on a node that does not have AppArmor enabled.

A pod is running with a seccomp profile that restricts system calls. The application inside the pod is failing with `Operation not permitted` errors. The administrator wants to verify that the seccomp profile is actually being applied. Which command or method should they use?

Run `kubectl exec` into the container and check `/proc/self/status` for the `Seccomp` field.

Check the container logs for seccomp violations.

Use `kubectl get pod -o yaml` to see if the seccomp profile is set.

Run `kubectl describe pod` and look for the seccomp profile in the events.

Certified Kubernetes Security Specialist (CKS)

Domain 3Objective 4

Appropriately Use Kernel Hardening Tools Such as AppArmor, Seccomp CKS Practice Questions (Page 4)

Part of the Cluster Hardening domain, which accounts for 15% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

7concepts

15%of the exam

Questions 16–20

16foundation · easy
How can you verify that a seccomp profile is being enforced on a running container?
Select an answer first
17foundation · easy
What is the effect of an AppArmor profile set to 'complain' mode?
Select an answer first
18application · medium
A security engineer is explaining AppArmor to a colleague. Which statement accurately describes AppArmor's security model?
Select an answer first
19application · medium
An administrator has loaded an AppArmor profile on a node, but when they try to apply it to a pod, the pod fails to start with an error that the profile is not found. The profile is definitely loaded. What is a possible cause?
Select an answer first
20application · medium
A pod is running with a seccomp profile that restricts system calls. The application inside the pod is failing with `Operation not permitted` errors. The administrator wants to verify that the seccomp profile is actually being applied. Which command or method should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.