Minimize Host OS Footprint (reduce Attack Surface) CKS Practice Questions (Page 5)

Questions 21–24

1. 21foundation · easy

   Which of the following is an example of an unnecessary component that should be removed or disabled to reduce the host OS attack surface on a Kubernetes node?

   • AThe container runtime (e.g., containerd), which is required to run containers.
   • BThe SSH server, if administrative access is performed exclusively through a bastion host or out-of-band management.
   • CThe kernel itself, which is required for all system operations.
   • DThe kubelet service, which is required for node operation.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security team is implementing file integrity monitoring on Kubernetes nodes. They want to detect unauthorized changes to critical system files, but they also want to avoid false positives from legitimate updates. Which approach best achieves this balance?

   • AUse a tool that only monitors configuration files, not binaries.
   • BMonitor all files and alert on any change, regardless of source.
   • CUse a tool like AIDE with a baseline and regularly update the baseline after approved changes.
   • DDisable monitoring during maintenance windows.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the purpose of monitoring and auditing host OS changes on Kubernetes nodes?

   • ATo detect unauthorized modifications that could indicate a security breach.
   • BTo reduce the number of containers running on each host.
   • CTo automatically patch vulnerabilities without human intervention.
   • DTo ensure that all hosts have the same hostname.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A development team is containerizing a Python web application. The current Dockerfile uses `python:3.11-slim` as the base image. A security review recommends reducing the container image attack surface. Which approach best aligns with this recommendation?

   • AUse a multi-stage build with `python:3.11` as the builder and `python:3.11-slim` as the final stage.
   • BUse `python:3.11` (full) and rely on runtime security tools.
   • CSwitch to `python:3.11-alpine` and ensure all required dependencies are available.
   • DKeep `python:3.11-slim` but remove unused packages after installing dependencies.
   Reveal Solution Discussion Select an answer first