Minimize Host OS Footprint (reduce Attack Surface) CKS Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a primary method to identify unnecessary packages installed on a host OS?

   • AExamining the kernel log for errors
   • BReviewing the list of installed packages and comparing it to the required baseline
   • CMonitoring CPU usage to find high-usage processes
   • DChecking the system uptime to see how long it has been running
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security scan of a Kubernetes node reveals that the installed version of OpenSSL has a known vulnerability. The node is running a production workload and cannot be rebooted immediately. What should you do to mitigate the risk while planning the patch?

   • ADisable the OpenSSL service and wait for the next maintenance window to patch.
   • BRemove OpenSSL from the node and rely on other libraries.
   • CApply the OpenSSL security patch and schedule a reboot for the next maintenance window.
   • DReboot the node immediately to clear the vulnerability.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which kernel parameter setting helps mitigate IP spoofing attacks?

   • Anet.ipv4.ip_forward = 1
   • Bnet.ipv4.conf.all.rp_filter = 1
   • Cnet.ipv4.tcp_syncookies = 0
   • Dkernel.randomize_va_space = 0
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A Kubernetes node is running an older version of the Linux kernel that has a known vulnerability. The node is part of a cluster that cannot be rebooted during business hours. The security team wants to mitigate the risk while planning the patch. What is the best approach?

   • AReplace the node with a new one running an older, unpatched kernel version.
   • BReboot the node immediately to clear the vulnerability.
   • CApply the kernel patch and schedule a rolling reboot of the node during the next maintenance window.
   • DDisable the vulnerable kernel module and continue running the current kernel.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security audit of a Kubernetes node shows that the `cups` service is running and listening on port 631, but the node is a dedicated worker node with no printing needs. The team wants to reduce the attack surface. What should you do?

   • AChange the service to listen only on localhost.
   • BLeave the service running but block port 631 with a firewall rule.
   • CStop and disable the `cups` service, and remove the `cups` package if it is not required.
   • DUpdate the `cups` package to the latest version.
   Reveal Solution Discussion Select an answer first