Minimize Host OS Footprint (reduce Attack Surface) CKS Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security administrator is hardening a Kubernetes node and wants to ensure that the system is up-to-date with security patches. Which action is most aligned with the principle of minimizing the host OS attack surface?

   • AOnly apply patches during scheduled maintenance windows.
   • BDisable all automatic updates to prevent unexpected changes.
   • CUse a custom script to manually apply patches when needed.
   • DEnable automatic security updates for the OS.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company wants to ensure that its Kubernetes worker nodes are always provisioned from a hardened, approved image and that any runtime modifications are lost on reboot. Which approach best implements immutable infrastructure for the nodes?

   • AEnable automatic security updates on the nodes.
   • BProvision nodes from a golden image and store all state on external volumes.
   • CUse a configuration management tool to apply hardening settings at boot.
   • DUse a custom script that resets the node to a known state every hour.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A platform team wants to ensure that any unauthorized change to a Kubernetes node's OS is detected and alerted. They plan to use an immutable infrastructure approach. Which additional tool is essential to meet this requirement?

   • AA configuration management tool like Ansible.
   • BA file integrity monitoring tool like AIDE.
   • CA log aggregation tool like ELK.
   • DA container runtime like containerd.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a recommended way to reduce the host OS attack surface by disabling unnecessary kernel modules?

   • ASet the module's file permissions to 000 to prevent it from being read.
   • BUse the 'rmmod' command to remove the module permanently from the kernel.
   • CDelete the module's source code from the kernel source tree.
   • DAdd a blacklist entry for the module in /etc/modprobe.d/ to prevent it from loading.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a host OS hardening measure that should be applied to Kubernetes nodes?

   • AEnabling all kernel modules to ensure maximum hardware compatibility.
   • BSetting all file permissions to 777 to avoid permission errors.
   • CUsing the same password for all nodes to simplify administration.
   • DDisabling unused services and applying security patches regularly.
   Reveal Solution Discussion Select an answer first