Minimize Host OS Footprint (reduce Attack Surface) CKS Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team wants to harden the kernel parameters on Kubernetes nodes. They plan to set `net.ipv4.conf.all.rp_filter=1` and `net.ipv4.tcp_syncookies=1`. Which additional step is necessary to ensure these settings persist across reboots?

   • AAdd the settings to `/etc/sysctl.conf` or a file in `/etc/sysctl.d/`.
   • BRun `sysctl -w` for each parameter immediately.
   • CReboot the node after applying the settings with `sysctl -w`.
   • DUse `echo` to write the settings to `/proc/sys/net/ipv4/`.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security audit of a Kubernetes worker node reveals that the SSH service is listening on port 22, and the host has several unnecessary packages installed, including a telnet client. The node is managed via a configuration management tool that enforces the desired state. The team wants to reduce the attack surface without breaking the node's ability to receive management commands. What should you do?

   • ARemove the telnet client and restrict SSH access to only the management network via firewall rules.
   • BChange the SSH port to a non-standard port and leave the telnet client installed for emergency use.
   • CInstall a host-based intrusion detection system and leave the current configuration unchanged.
   • DDisable SSH and remove the telnet client from the node's configuration management manifest.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which tool is used to configure kernel parameters at runtime on a Linux host?

   • Amodprobe
   • Biptables
   • Csysctl
   • Dsystemctl
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a best practice for managing security updates on a host OS?

   • ADisable automatic updates to avoid system reboots
   • BApply updates only when a vulnerability is publicly disclosed
   • CAutomate the patching process and test updates in a staging environment
   • DApply updates only to the kernel, not to user-space packages
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What does the principle of least privilege mean in the context of host OS access?

   • AAccess should be granted based on the user's seniority
   • BAll users should have the same level of access for simplicity
   • CAdministrators should use the root account for all tasks
   • DUsers and processes should have only the minimum permissions necessary to perform their tasks
   Reveal Solution Discussion Select an answer first