Which container runtime configuration option makes the container's root filesystem read-only, preventing any writes to it during runtime?

Adding `readOnly: true` to the container's image manifest

Adding `readOnlyRootFilesystem: true` to the container's security context

Setting the `--read-only` flag on the container runtime CLI when starting the container

Setting the `--read-only-rootfs` flag on the container runtime daemon

What is the primary role of an admission controller like OPA/Gatekeeper in enforcing container immutability?

To modify container images to make their root filesystems read-only

To monitor running containers and kill any that attempt to write to their root filesystem

To scan container images for vulnerabilities before they are deployed

To intercept Pod creation requests and validate that they meet immutability policies

When a container's root filesystem is read-only, where should the application write temporary files that do not need to persist after the container terminates?

To a `PersistentVolumeClaim` with a `Retain` reclaim policy

To a `hostPath` volume mounted from the node's filesystem

To the container's `/tmp` directory, which is always writable even with a read-only root filesystem

To an `emptyDir` volume mounted at a writable path

A security auditor needs to verify that a running container's root filesystem has not been modified since the image was pulled. The container is running with a read-only root filesystem. Which command should the auditor use to confirm immutability?

Run `docker diff ` and check that the output shows no changes to the root filesystem.

Run `docker logs ` and look for write attempts to the root filesystem.

Run `docker inspect ` and check the `ReadonlyRootfs` field.

Run `docker exec cat /etc/hostname` and compare it to the image's original value.

A DevOps engineer is updating a Deployment for a legacy application that writes to /var/lib/app. The security team mandates a read-only root filesystem. The application cannot be modified. What should the engineer do to make the Deployment compliant?

Set securityContext.readOnlyRootFilesystem: false and rely on runtime security tools to detect changes.

Set securityContext.readOnlyRootFilesystem: true and add a command to copy data to a tmpfs at startup.

Use a ConfigMap to mount /var/lib/app with the application's initial data.

Add securityContext.readOnlyRootFilesystem: true and mount an emptyDir volume at /var/lib/app.

Certified Kubernetes Security Specialist (CKS)

Domain 4Objective 4

Ensure Immutability of Containers at Runtime CKS Practice Questions (Page 2)

Part of the Supply Chain Security domain, which accounts for 20% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

20%of the exam

Questions 6–10

6foundation · medium
Which container runtime configuration option makes the container's root filesystem read-only, preventing any writes to it during runtime?
Select an answer first
7foundation · medium
What is the primary role of an admission controller like OPA/Gatekeeper in enforcing container immutability?
Select an answer first
8foundation · medium
When a container's root filesystem is read-only, where should the application write temporary files that do not need to persist after the container terminates?
Select an answer first
9application · medium
A security auditor needs to verify that a running container's root filesystem has not been modified since the image was pulled. The container is running with a read-only root filesystem. Which command should the auditor use to confirm immutability?
Select an answer first
10application · medium
A DevOps engineer is updating a Deployment for a legacy application that writes to /var/lib/app. The security team mandates a read-only root filesystem. The application cannot be modified. What should the engineer do to make the Deployment compliant?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.