Ensure Immutability of Containers at Runtime CKS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the lifecycle of an emptyDir volume in Kubernetes?

   • AIt is created when the pod is scheduled and deleted when the pod is removed from the node.
   • BIt persists as long as the container runs, even if the pod is deleted.
   • CIt survives pod deletion but is cleared when the node is rebooted.
   • DIt is created at cluster creation time and shared across all pods.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which securityContext setting, when combined with readOnlyRootFilesystem, further enforces immutability by preventing the container's processes from gaining additional privileges?

   • Aprivileged: true
   • BrunAsUser: 0
   • CallowPrivilegeEscalation: false
   • DhostPID: true
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which securityContext field in a Kubernetes Pod spec enforces a read-only root filesystem for the container?

   • AreadOnlyRootFilesystem
   • BrunAsNonRoot
   • Ccapabilities
   • DallowPrivilegeEscalation
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In a Kubernetes Pod manifest, where is the readOnlyRootFilesystem setting typically specified?

   • AUnder spec.template.metadata.labels
   • BUnder spec.containers[].securityContext
   • CUnder spec.serviceAccountName
   • DUnder spec.volumes[].emptyDir
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is explaining to a developer why containers should be immutable. Which statement best describes the security benefit?

   • AIt ensures the container can only communicate with other containers in the same namespace.
   • BIt automatically patches vulnerabilities in the container image.
   • CIt prevents an attacker who compromises the container from modifying the container's filesystem, limiting persistence and tampering.
   • DIt guarantees the container cannot be deleted or restarted by an administrator.
   Reveal Solution Discussion Select an answer first