Perform Static Analysis of User Workloads and Container Images (e.g. Kubesec, KubeLinter) CKS Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a typical security recommendation that Kubesec might provide for a Kubernetes Pod?

   • AUse a more recent version of the Kubernetes API
   • BSet `runAsNonRoot: true` in the security context
   • CEnable horizontal pod autoscaling to handle load spikes
   • DIncrease the number of replicas to improve availability
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A team uses KubeLinter in CI to lint all Kubernetes YAML files. They want to add a custom check that ensures every container has a `resources.limits.memory` set. Which KubeLinter feature should they use?

   • AUse a `ValidatingWebhookConfiguration` to enforce this at admission time.
   • BAdd a `resources` field to the KubeLinter command line flags.
   • CCreate a custom check using the KubeLinter configuration file with a template.
   • DUse `kubectl apply --dry-run=server` to validate the manifest.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A developer runs Kubesec on a Pod manifest and receives a score of 4. The manifest includes a container with `securityContext.capabilities.add: ['NET_ADMIN']` and `securityContext.privileged: false`. The developer wants to improve the score without breaking the application's need to manage network interfaces. Which change is most appropriate?

   • AAdd `hostNetwork: true` to allow network management without capabilities.
   • BRemove the `NET_ADMIN` capability and run the container as non-root.
   • CSet `privileged: true` to gain all capabilities, which Kubesec scores higher.
   • DKeep `NET_ADMIN` but add `readOnlyRootFilesystem: true` and `runAsNonRoot: true`.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What type of information can static analysis of a container image reveal?

   • AKnown vulnerabilities in the installed packages
   • BThe current network traffic of the running container
   • CThe exact runtime behavior of the application under load
   • DThe number of active users accessing the application
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A KubeLinter report flags a Deployment for `runAsNonRoot: false`. The application container is a legacy binary that cannot run as a non-root user. The team decides to accept the risk. Which action is the most appropriate to document and manage this exception?

   • AAdd a comment in the YAML file explaining the exception.
   • BDisable the `runAsNonRoot` check globally.
   • CAdd a KubeLinter exception for the specific Deployment in the configuration file.
   • DSet `runAsNonRoot: true` anyway and hope the container starts.
   Reveal Solution Discussion Select an answer first