A company is building a container image for a Java application. The application requires a JRE and some native libraries. The team wants to minimize the attack surface and reduce the number of packages that need patching. They are considering using a distroless base image. What is the primary trade-off they should consider?

Distroless images cannot run Java applications.

Distroless images have no package manager, so installing additional libraries or debugging tools is more difficult.

Distroless images are not supported by Kubernetes.

Distroless images are larger than full distribution images.

A Kubernetes cluster runs on Ubuntu nodes. A vulnerability scan reports that the host OS kernel has a known privilege-escalation vulnerability. The team wants to mitigate the risk while minimizing downtime. What should you do first?

Apply the latest kernel security patch and reboot the node during the next maintenance window.

Immediately reboot the node without applying the patch to clear the vulnerability.

Disable the vulnerable kernel module and continue running the current kernel.

Replace the node with a new one running an older, unpatched kernel version.

Certified Kubernetes Security Specialist (CKS)

Domain 5Objective 1

Minimize Host OS Footprint (reduce Attack Surface) CKS Practice Questions (Page 6)

Part of the System Hardening domain, which accounts for 10% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

7concepts

10%of the exam

Questions 26–27

26expert · hard
A company is building a container image for a Java application. The application requires a JRE and some native libraries. The team wants to minimize the attack surface and reduce the number of packages that need patching. They are considering using a distroless base image. What is the primary trade-off they should consider?
Select an answer first
27application · medium
A Kubernetes cluster runs on Ubuntu nodes. A vulnerability scan reports that the host OS kernel has a known privilege-escalation vulnerability. The team wants to mitigate the risk while minimizing downtime. What should you do first?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.

Minimize Host OS Footprint (reduce Attack Surface) CKS Practice Questions (Page 6)

Questions 26–27

A Kubernetes cluster runs on Ubuntu nodes. A vulnerability scan reports that the host OS kernel has a known privilege-escalation vulnerability. The team wants to mitigate the risk while minimizing downtime. What should you do first?

Keep studying — System Hardening