How does immutable infrastructure improve the security of Kubernetes hosts?

It prevents unauthorized changes from persisting because hosts are replaced rather than modified.

It allows administrators to apply emergency patches directly to running hosts.

It eliminates the need for monitoring and auditing.

It ensures that all hosts have the same IP address.

A Kubernetes node has several kernel modules loaded that are not required for the cluster's operation. Which action best reduces the attack surface without breaking functionality?

Blacklist the unnecessary modules in `/etc/modprobe.d/` and unload them with `modprobe -r`.

Leave the modules loaded but restrict access to them.

Remove the kernel modules from the filesystem.

Disable the kernel module loader entirely.

What does the term 'host OS footprint' refer to in the context of Kubernetes cluster hardening?

The total amount of disk space consumed by the host operating system, including logs and temporary files.

The network bandwidth used by the host operating system for cluster communication and external traffic.

The set of software components, services, and features installed and enabled on the host operating system that could be attacked.

The number of container images stored on the host that are available for immediate use by Kubernetes.

What is a key characteristic of immutable infrastructure for Kubernetes hosts?

Hosts are provisioned with a minimal OS and then have packages added as needed.

Hosts are allowed to have configuration drift as long as it is documented.

Hosts are provisioned from a hardened image and are never modified after deployment.

Hosts are manually patched and updated in place to keep them current.

Certified Kubernetes Security Specialist (CKS)

Domain 3Objective 1

Minimize Host OS Footprint (reduce Attack Surface) CKS Practice Questions (Page 3)

Part of the Cluster Hardening domain, which accounts for 15% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

6concepts

15%of the exam

Questions 11–15

11application · medium
A security administrator needs to detect unauthorized changes to the host OS of Kubernetes nodes. The nodes are running Ubuntu 22.04. Which tool is best suited for this purpose?
Select an answer first
12foundation · easy
How does immutable infrastructure improve the security of Kubernetes hosts?
Select an answer first
13application · medium
A Kubernetes node has several kernel modules loaded that are not required for the cluster's operation. Which action best reduces the attack surface without breaking functionality?
Select an answer first
14foundation · easy
What does the term 'host OS footprint' refer to in the context of Kubernetes cluster hardening?
Select an answer first
15foundation · easy
What is a key characteristic of immutable infrastructure for Kubernetes hosts?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.