A security team wants to enforce container immutability but also needs to detect if a container's root filesystem is modified after startup. They plan to use OPA/Gatekeeper for admission control. What additional measure should they implement to detect runtime modifications?

Use a NetworkPolicy to block all outbound traffic from containers.

Use a CronJob to periodically run `kubectl exec` and check file hashes.

Use a runtime security tool like Falco to monitor filesystem write events in containers.

Use a ResourceQuota to limit the number of containers per Pod.

Which Kubernetes API field enforces a read-only root filesystem for a container?

`spec.containers[].imagePullPolicy`

`spec.containers[].volumeMounts[].readOnly`

`spec.containers[].securityContext.readOnlyRootFilesystem`

An organization uses OPA/Gatekeeper to enforce security policies. They want to ensure that no container in any namespace can mount a hostPath volume, as this could allow writes to the host filesystem, breaking immutability. Which Gatekeeper resource should be created?

A ConstraintTemplate that checks for the absence of hostPath volumes in the Pod spec, plus a Constraint that applies it cluster-wide.

A PodSecurityPolicy that sets hostPath to false.

A ResourceQuota that limits the number of volumes a Pod can mount.

A NetworkPolicy that denies traffic to the host's kubelet port.

A security analyst suspects that a running container has been compromised and its root filesystem modified. The container was started with a read-only root filesystem. Which tool or command can the analyst use to inspect the container's filesystem for changes?

Use `kubectl describe pod` to check the container's status.

Use `docker diff` to compare the container's filesystem against the image.

Use `kubectl exec` to run `ls -la /` inside the container.

Use `kubectl logs` to check for write attempts.

A cluster runs workloads with a mix of containers that have read-only root filesystems and those that do not. The security team wants to enforce immutability for all new workloads without disrupting existing ones. Which approach achieves this with minimal risk?

Enable Pod Security Admission with the 'restricted' profile in warn mode cluster-wide, then review warnings and enforce after fixing workloads.

Immediately enforce the 'restricted' profile cluster-wide.

Use OPA/Gatekeeper to deny all Pods without readOnlyRootFilesystem, including existing ones.

Manually update all existing Deployments to add readOnlyRootFilesystem: true before enforcing.

Certified Kubernetes Security Specialist (CKS)

Domain 4Objective 4

Ensure Immutability of Containers at Runtime CKS Practice Questions (Page 1)

Part of the Supply Chain Security domain, which accounts for 20% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

20%of the exam

Questions 1–5

1expert · hard
A security team wants to enforce container immutability but also needs to detect if a container's root filesystem is modified after startup. They plan to use OPA/Gatekeeper for admission control. What additional measure should they implement to detect runtime modifications?
Select an answer first
2foundation · medium
Which Kubernetes API field enforces a read-only root filesystem for a container?
Select an answer first
3application · medium
An organization uses OPA/Gatekeeper to enforce security policies. They want to ensure that no container in any namespace can mount a hostPath volume, as this could allow writes to the host filesystem, breaking immutability. Which Gatekeeper resource should be created?
Select an answer first
4application · medium
A security analyst suspects that a running container has been compromised and its root filesystem modified. The container was started with a read-only root filesystem. Which tool or command can the analyst use to inspect the container's filesystem for changes?
Select an answer first
5expert · hard
A cluster runs workloads with a mix of containers that have read-only root filesystems and those that do not. The security team wants to enforce immutability for all new workloads without disrupting existing ones. Which approach achieves this with minimal risk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.