What is a common container runtime vulnerability?

Incompatibility with Kubernetes versions

Container escape, where a process breaks out of the container isolation

Excessive logging causing disk exhaustion

Which of the following is a mitigation strategy for container runtime vulnerabilities?

Keeping the container runtime updated with security patches

Disabling security features like seccomp

Running containers with the --privileged flag

Using the same runtime version across all nodes without updates

A security team discovered a critical vulnerability in the container runtime that could allow a container to escape. They cannot immediately patch the runtime due to maintenance constraints. Which mitigation strategy provides the best interim protection?

Enable seccomp with a restrictive profile

Use a read-only root filesystem

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 2Objective 5

Container Runtime KCSA Practice Questions (Page 2)

Part of the Kubernetes Cluster Component Security domain, which accounts for 22% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

8concepts

22%of the exam

Questions 6–10

6foundation · easy
What is a common container runtime vulnerability?
Select an answer first
7application · medium
A company runs multi-tenant workloads and wants to isolate containers from the host kernel to reduce the impact of kernel exploits. Which container runtime provides the strongest isolation from the host kernel?
Select an answer first
8foundation · easy
Which of the following is a mitigation strategy for container runtime vulnerabilities?
Select an answer first
9expert · hard
A security team discovered a critical vulnerability in the container runtime that could allow a container to escape. They cannot immediately patch the runtime due to maintenance constraints. Which mitigation strategy provides the best interim protection?
Select an answer first
10application · medium
A container runtime is failing to start a container because the container image cannot be pulled. Which responsibility of the container runtime is failing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.

Container Runtime KCSA Practice Questions (Page 2)

Questions 6–10

What is a common container runtime vulnerability?

A company runs multi-tenant workloads and wants to isolate containers from the host kernel to reduce the impact of kernel exploits. Which container runtime provides the strongest isolation from the host kernel?

Which of the following is a mitigation strategy for container runtime vulnerabilities?

A security team discovered a critical vulnerability in the container runtime that could allow a container to escape. They cannot immediately patch the runtime due to maintenance constraints. Which mitigation strategy provides the best interim protection?

A container runtime is failing to start a container because the container image cannot be pulled. Which responsibility of the container runtime is failing?

Keep studying — Kubernetes Cluster Component Security