Minimize Host OS Footprint (reduce Attack Surface) CKS Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security administrator is hardening a Kubernetes node. They want to disable unnecessary services, but they are unsure which services are actually required for the cluster to function. Which approach best identifies unnecessary services without breaking the cluster?

   • ADisable services one by one and test the cluster after each change.
   • BUse a security scanner to automatically disable services.
   • CReview the list of enabled services and cross-reference with the cluster's requirements.
   • DDisable all services except `kubelet` and `containerd`.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a common tool or method used to audit host OS changes?

   • ARunning 'kubectl get pods' to list running containers.
   • BFile integrity monitoring (FIM) that checks for changes to critical files.
   • CChecking the system uptime with 'uptime'.
   • DUsing the 'top' command to monitor CPU usage.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security consultant is explaining to a client why minimizing the host OS footprint is important for Kubernetes security. Which statement best describes the relationship between host OS footprint and attack surface?

   • AA smaller footprint improves performance but has no impact on security.
   • BA smaller footprint reduces the number of potential vulnerabilities and entry points for attackers.
   • CA smaller footprint makes it harder to monitor the system.
   • DA smaller footprint eliminates the need for security patches.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard · select all that apply

   A company is adopting immutable infrastructure for its Kubernetes nodes. Which practices are essential to support this model? Select all that apply.

   • AUse a file integrity monitoring tool to detect unauthorized changes.
   • BAllow in-place configuration changes for quick fixes.
   • CStore all persistent state on external volumes.
   • DProvision nodes from a golden image.
   • EAutomatically replace nodes that drift from the golden image.
   Check answers Discussion Select an answer first
6. 5foundation · easy

   Which of the following is an example of a minimal base image commonly used to reduce container attack surface?

   • AUbuntu 22.04 with the full desktop environment installed.
   • BA custom image built from a full Linux distribution with all development tools included.
   • CCentOS with the GNOME graphical interface.
   • DA distroless image containing only the application and its runtime dependencies.
   Reveal Solution Discussion Select an answer first