Ensure Immutability of Containers at Runtime CKS Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security policy requires that all containers run with a read-only root filesystem. However, a container needs to write to a directory that is not known at deployment time. Which approach best satisfies the policy?

   • AMount an emptyDir volume at the root of the filesystem and set readOnlyRootFilesystem: true.
   • BSet readOnlyRootFilesystem: false and rely on the container's writable layer.
   • CUse a hostPath volume mounted at the unknown directory.
   • DSet readOnlyRootFilesystem: true and mount an emptyDir at a known writable path, then configure the application to use that path.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team is reviewing container security best practices. They want to reduce the risk of an attacker modifying binaries inside a running container. Which control directly addresses this?

   • ASetting readOnlyRootFilesystem: true in the container's securityContext.
   • BSetting allowPrivilegeEscalation: false in the container's securityContext.
   • CSetting privileged: false in the container's securityContext.
   • DSetting runAsNonRoot: true in the container's securityContext.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary security benefit of treating containers as immutable rather than allowing runtime modifications?

   • AIt reduces the attack surface by preventing attackers from persistently altering the container's filesystem or executing unauthorized changes.
   • BIt guarantees that the container will never be terminated or restarted, ensuring continuous availability.
   • CIt allows the container to share the host's kernel and kernel modules, improving performance and reducing overhead.
   • DIt eliminates the need for image scanning by ensuring all images are automatically patched at runtime.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A container needs to write to /var/run and /var/log. The team wants to enforce a read-only root filesystem. Which volume configuration is correct?

   • AMount a single emptyDir volume at /var and set readOnlyRootFilesystem: true.
   • BMount a single emptyDir volume at /var/run and rely on the container's writable layer for /var/log.
   • CMount a single emptyDir volume at /var/log and rely on the container's writable layer for /var/run.
   • DMount an emptyDir volume at /var/run and another at /var/log.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A pod is running with readOnlyRootFilesystem: true, but the application fails to start because it tries to write to a directory that is not mounted. Which action best resolves the issue while maintaining immutability?

   • AModify the application to write to a different directory that is already writable.
   • BMount an emptyDir volume at the directory the application needs to write to.
   • CSet readOnlyRootFilesystem: false to allow the application to write.
   • DAdd a hostPath volume at the directory the application needs to write to.
   Reveal Solution Discussion Select an answer first