Perform Static Analysis of User Workloads and Container Images (e.g. Kubesec, KubeLinter) CKS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following best describes a key advantage of static analysis over dynamic analysis for container security?

   • AIt provides real-time alerts when an attacker exploits a vulnerability in a running pod
   • BIt can detect vulnerabilities in the base image without needing to run the container
   • CIt eliminates the need for any other security controls in the cluster
   • DIt can identify zero-day exploits that are actively being used in the wild
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A platform team wants to enforce that no Kubernetes workload manifest can be applied to the cluster if it contains a container running as root. They already use KubeLinter in CI. Which approach best enforces this policy at the cluster level as a defense-in-depth measure?

   • AUse a ValidatingWebhookConfiguration that runs KubeLinter on every Pod creation.
   • BDeploy an OPA/Gatekeeper policy that requires `runAsNonRoot: true` for all Pods.
   • CAdd a KubeLinter check in CI that fails the pipeline on `runAsNonRoot: false`.
   • DSet `securityContext.runAsNonRoot: true` on the namespace object.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   After running Kubesec on a deployment manifest, it reports a high risk score due to the container running as root. What is the most appropriate remediation action?

   • ASet `runAsNonRoot: true` and specify a non-root user in the security context
   • BAdd a network policy to restrict incoming traffic
   • CRemove the security context from the manifest
   • DIncrease the number of replicas to distribute the risk
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is a default check that KubeLinter performs on Kubernetes resources?

   • AEnsuring that every deployment has at least three replicas
   • BVerifying that containers do not run as root
   • CValidating that the YAML syntax is correct
   • DChecking that all images are pulled from a private registry
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A DevOps engineer is reviewing a Kubernetes Deployment manifest for a new internal dashboard. The manifest sets `securityContext.runAsUser: 0` and does not define `allowPrivilegeEscalation`. The engineer runs Kubesec on the manifest and receives a risk score of 1. Which remediation should the engineer apply to most directly address the Kubesec findings?

   • AAdd `readinessProbe` and `livenessProbe` to the container spec.
   • BSet `automountServiceAccountToken: false` on the Pod spec.
   • CSet `securityContext.runAsNonRoot: true` and `runAsUser` to a non-zero UID.
   • DAdd a `NetworkPolicy` that restricts egress traffic from the Pod.
   Reveal Solution Discussion Select an answer first