Perform Static Analysis of User Workloads and Container Images (e.g. Kubesec, KubeLinter) CKS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A team uses KubeLinter in a CI pipeline to lint all Kubernetes YAML files. Recently, a new Deployment was committed that uses `privileged: true` and mounts the host filesystem. The pipeline passed because the team had disabled the `privileged` check globally to reduce noise. Which KubeLinter configuration change would best address this gap while minimizing false positives?

   • ARun KubeLinter with `--verbose` to see all warnings, but keep the check disabled.
   • BEnable the `host-mounts` check instead, as it covers the same risk.
   • CRe-enable the `privileged` check and add a `deployment.yaml` exception for the specific Deployment that legitimately needs it.
   • DKeep the check disabled and rely on manual review during code review.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security engineer runs Kubesec on a Deployment manifest and receives a score of 2. The manifest includes `securityContext.capabilities.drop: ['ALL']` and `securityContext.runAsNonRoot: true`. The engineer wants to improve the score further. Which change is most likely to increase the Kubesec score?

   • AAdd `securityContext.readOnlyRootFilesystem: true`.
   • BAdd `hostPID: true` to allow the container to see host processes.
   • CSet `securityContext.privileged: true` to gain more capabilities.
   • DRemove the `capabilities.drop` line to simplify the manifest.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a common static analysis technique used to detect vulnerabilities in container images?

   • AMonitoring the container's CPU and memory usage over time
   • BComparing the image layers against a database of known vulnerabilities
   • CChecking the image's digital signature for authenticity
   • DRunning the container and observing its network connections
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team wants to scan container images for vulnerabilities before they are pushed to a production registry. They use a CI pipeline that builds images and pushes them to a private registry. Which approach provides the earliest feedback while ensuring the image is not exposed in the registry if it has critical vulnerabilities?

   • AScan the image at runtime in the cluster using a Kubernetes admission controller.
   • BScan the Dockerfile during the build stage, not the image.
   • CScan the image in CI before pushing, and only push if the scan passes.
   • DScan the image after pushing it to the registry and alert if critical vulnerabilities are found.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of performing static analysis on Kubernetes workload manifests and container images?

   • ATo identify security issues by examining the code and configuration without executing the workload
   • BTo enforce network policies that restrict traffic between microservices
   • CTo monitor runtime behavior and detect anomalies after the workload is deployed
   • DTo automatically remediate all security issues without requiring human intervention
   Reveal Solution Discussion Select an answer first