Minimize Host OS Footprint (reduce Attack Surface) CKS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium · select all that apply

   A security team is hardening a Kubernetes node. Which of the following actions effectively reduce the host OS attack surface? Select all that apply.

   • ARemove unnecessary packages.
   • BDisable unused services.
   • CUse a minimal base image for containers.
   • DIncrease the number of kernel modules loaded.
   • EApply security patches regularly.
   Check answers Discussion Select an answer first
2. 7foundation · easy

   Why does minimizing the host OS footprint reduce the attack surface of a Kubernetes node?

   • AIt makes the host OS run faster, which reduces the time window for attacks to succeed.
   • BIt reduces the number of software components that could contain vulnerabilities or be misconfigured.
   • CIt prevents attackers from using the host OS to launch network scans against other cluster nodes.
   • DIt ensures the host OS uses less memory, which makes it harder for attackers to exploit buffer overflows.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary security benefit of using a minimal base image for containers?

   • AIt makes the container run faster by using less CPU.
   • BIt reduces the number of packages and libraries that could contain vulnerabilities.
   • CIt automatically enables SELinux or AppArmor for the container.
   • DIt ensures the container can only run as a non-root user.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the purpose of configuring secure defaults in host OS hardening?

   • ATo guarantee that the system cannot be compromised by any attacker.
   • BTo make the system easier to use by enabling all features by default.
   • CTo ensure that the system is secure even if an administrator forgets to apply additional settings.
   • DTo ensure that all services start automatically at boot.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A Kubernetes node is running a minimal OS, but an audit reveals that the `telnet` client is installed. The cluster does not use telnet. Which action best reduces the attack surface?

   • ARemove the `telnet` package using `apt purge telnet`.
   • BSet the telnet binary to non-executable using `chmod -x /usr/bin/telnet`.
   • CDisable the telnet service using `systemctl disable telnet`.
   • DAdd a firewall rule to block port 23.
   Reveal Solution Discussion Select an answer first