A cluster administrator wants to enforce that all containers in the 'finance' namespace run with a read-only root filesystem. Which Kubernetes-native approach should be used?

Use a LimitRange to set default requests and limits for containers.

Apply a Pod Security Admission (PSA) label to the namespace with the 'restricted' profile.

Create a NetworkPolicy that denies all ingress traffic to the finance namespace.

Set a ResourceQuota in the finance namespace that limits CPU and memory.

A security team wants to verify that a Pod is running with a read-only root filesystem as part of a compliance audit. Which command provides this information?

Run `kubectl exec -- mount | grep ' / '`.

Run `kubectl get pod -o jsonpath='{.spec.containers[*].securityContext.readOnlyRootFilesystem}'`.

A container runtime is configured to run all containers with a read-only root filesystem. An application fails because it tries to write to /var/run/app.pid. The application cannot be modified. What is the most appropriate solution?

Set the securityContext.readOnlyRootFilesystem to false for this Pod.

Change the runtime configuration to allow writes to /var/run only.

Modify the container image to write the PID file to /tmp instead.

Mount an emptyDir volume at /var/run in the Pod spec.

Which command can be used to inspect a running container's filesystem to verify that it has not been modified?

`kubectl exec -- sha256sum /etc/passwd`

Certified Kubernetes Security Specialist (CKS)

Domain 4Objective 4

Ensure Immutability of Containers at Runtime CKS Practice Questions (Page 3)

Part of the Supply Chain Security domain, which accounts for 20% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

20%of the exam

Questions 11–15

11application · medium
A cluster administrator wants to enforce that all containers in the 'finance' namespace run with a read-only root filesystem. Which Kubernetes-native approach should be used?
Select an answer first
12foundation · medium
Which admission controller can be used to enforce that all Pods have `readOnlyRootFilesystem: true` in their security context?
Select an answer first
13application · easy
A security team wants to verify that a Pod is running with a read-only root filesystem as part of a compliance audit. Which command provides this information?
Select an answer first
14expert · hard
A container runtime is configured to run all containers with a read-only root filesystem. An application fails because it tries to write to /var/run/app.pid. The application cannot be modified. What is the most appropriate solution?
Select an answer first
15foundation · medium
Which command can be used to inspect a running container's filesystem to verify that it has not been modified?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.