Perform Static Analysis of User Workloads and Container Images (e.g. Kubesec, KubeLinter) CKS Practice Questions (Page 5)

Questions 21–22

1. 21foundation · easy

   KubeLinter flags a deployment because it does not specify resource limits. What is the primary security concern this check addresses?

   • AA container could consume excessive resources and cause a denial of service on the node
   • BThe container will be unable to restart after a crash
   • CThe container will not be able to access the internet
   • DThe container will run with elevated privileges
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security engineer is scanning a container image with Trivy and finds a critical vulnerability in a shared library. The image is based on `debian:buster`. The engineer wants to remediate the vulnerability with minimal effort and without changing the application code. Which action is the most appropriate?

   • ARebuild the image using a newer base image, such as `debian:bookworm`, and re-scan.
   • BApply a Kubernetes NetworkPolicy to block traffic to the vulnerable service.
   • CUse a multi-stage build to copy only the application binary into a scratch image.
   • DAdd a `.dockerignore` file to exclude the vulnerable library from the build context.
   Reveal Solution Discussion Select an answer first