Minimize Host OS Footprint (reduce Attack Surface) CKS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A Kubernetes node has the `vsftpd` FTP service installed and running, but the node is only used for running container workloads. The security team wants to reduce the attack surface. What is the most appropriate action?

   • AStop and disable the `vsftpd` service and remove the package.
   • BConfigure `vsftpd` to allow only anonymous access.
   • CBlock port 21 with a firewall rule but keep the service running.
   • DChange the FTP service to use a non-standard port.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A development team is building a container image for a simple web service. They want to minimize the attack surface and reduce the number of packages that need patching. Which base image should they choose?

   • AThe latest image from Docker Hub without checking its contents.
   • BA minimal image like Alpine or distroless that contains only the runtime and necessary libraries.
   • CA full distribution image like Ubuntu with all standard tools included.
   • DA custom image built from scratch with no package manager.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which command is used to list all listening ports and the associated services on a Linux host?

   • Aps aux
   • Bnetstat -i
   • Ciptables -L
   • Dss -tulpn
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a recommended measure to restrict SSH access to a host OS?

   • AGrant root login via SSH for convenience
   • BAllow SSH access from any IP address
   • CUse the default port 22 without any changes
   • DDisable password authentication and use SSH keys only
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why does minimizing the host OS footprint reduce the attack surface of a Kubernetes node?

   • AIt prevents all network-based attacks on the host
   • BIt ensures the host OS uses less memory, making it harder for attackers to exploit
   • CIt automatically applies security patches to the remaining components
   • DIt reduces the number of software components that could contain vulnerabilities or be misconfigured
   Reveal Solution Discussion Select an answer first