Ensure Immutability of Containers at Runtime CKS Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A pod is running with readOnlyRootFilesystem: true, but an administrator suspects that a process inside the container is still able to write to the root filesystem. What is the most likely reason?

   • AThe container is using a hostPath volume mounted at /.
   • BThe container is running in privileged mode, which can bypass the read-only root filesystem.
   • CThe readOnlyRootFilesystem field is set at the pod level, not the container level.
   • DThe container image has a writable layer that overrides the read-only setting.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which kubectl command can be used to verify that a running container has readOnlyRootFilesystem set to true?

   • Akubectl logs <pod-name>
   • Bkubectl describe node <node-name>
   • Ckubectl get pod <pod-name> -o yaml
   • Dkubectl exec <pod-name> -- ls /
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A pod spec currently has no securityContext. You need to enforce a read-only root filesystem for a single container in the pod. Which YAML snippet should you add?

   • AsecurityContext: readOnlyRootFilesystem: false
   • BsecurityContext: privileged: false
   • CsecurityContext: readOnlyRootFilesystem: true
   • DsecurityContext: runAsNonRoot: true
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Besides inspecting the pod's YAML, which method can verify that a container's root filesystem is actually read-only at runtime?

   • ARun kubectl top pod <pod-name> to check CPU and memory usage.
   • BRun kubectl rollout status deployment <deployment-name> to check the deployment status.
   • CRun kubectl exec <pod-name> -- touch /test.txt and check if it fails with a read-only file system error.
   • DRun kubectl port-forward <pod-name> 8080:80 to test network connectivity.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security team is enforcing immutability for all containers. However, a legacy application writes configuration files to /etc/app on startup. The team cannot modify the application. What is the best approach to maintain immutability while allowing the application to run?

   • AModify the application to write to a different directory.
   • BSet readOnlyRootFilesystem: false and rely on the container's writable layer.
   • CMount an emptyDir volume at /etc/app and set readOnlyRootFilesystem: true.
   • DUse a ConfigMap to mount the configuration files at /etc/app.
   Reveal Solution Discussion Select an answer first