Ensure Immutability of Containers at Runtime CKS Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A team is enforcing immutability for a stateful application that writes to a persistent volume. The application also writes temporary files to /tmp. Which configuration is correct?

   • ASet readOnlyRootFilesystem: true, mount a persistentVolumeClaim at the data directory, and mount an emptyDir at /tmp.
   • BSet readOnlyRootFilesystem: false and mount a persistentVolumeClaim at the data directory.
   • CSet readOnlyRootFilesystem: true and rely on the container's writable layer for /tmp.
   • DSet readOnlyRootFilesystem: true and mount a persistentVolumeClaim at /tmp.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A pod has a container that needs to write to /var/log and /tmp. The security team wants to enforce a read-only root filesystem, but the container runs as a non-root user. Which configuration is correct?

   • ASet readOnlyRootFilesystem: false and mount emptyDir volumes at /var/log and /tmp.
   • BSet readOnlyRootFilesystem: true and mount hostPath volumes at /var/log and /tmp.
   • CSet readOnlyRootFilesystem: true and rely on the container's writable layer for /var/log and /tmp.
   • DSet readOnlyRootFilesystem: true, mount emptyDir volumes at /var/log and /tmp, and ensure the emptyDir volumes are writable by the non-root user.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which statement best describes the container immutability principle in Kubernetes?

   • AContainers should be allowed to write to any part of the filesystem to support dynamic configuration and logging.
   • BContainers should be updated in place by patching binaries and configuration files while they are running.
   • CContainers should be treated as disposable units that are replaced with new instances built from an image, rather than modified after they start.
   • DContainers should be run with privileged access to the host kernel so they can manage their own security policies.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Why is an emptyDir volume commonly used in conjunction with a read-only root filesystem?

   • AIt allows the container to write temporary files without violating the read-only root filesystem constraint.
   • BIt automatically encrypts all data written by the container at rest.
   • CIt shares the container's filesystem with other containers in the pod for easier collaboration.
   • DIt provides persistent storage that survives pod restarts and rescheduling.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   You need to verify that a pod's container is actually running with a read-only root filesystem, not just that the spec says so. Which command provides the most reliable runtime evidence?

   • Akubectl logs <pod> | grep -i error
   • Bkubectl describe pod <pod> | grep -i readOnly
   • Ckubectl exec <pod> -- mount | grep ' / '
   • Dkubectl get pod <pod> -o yaml | grep readOnlyRootFilesystem
   Reveal Solution Discussion Select an answer first