Privilege Escalation KCSA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which security context setting allows a container to share the host's network namespace, potentially exposing host network services?

   • Acapabilities: drop: ["ALL"]
   • BrunAsUser: 1000
   • ChostPID: false
   • DhostNetwork: true
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is a common way attackers obtain service account tokens in a Kubernetes cluster?

   • ABy querying the Kubernetes API for all service account tokens.
   • BBy sniffing network traffic between the kubelet and the API server.
   • CBy compromising a pod and reading the token mounted at /var/run/secrets/kubernetes.io/serviceaccount/token.
   • DBy reading the kubeconfig file on the host node.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   How can a stolen service account token be used to escalate privileges in a Kubernetes cluster?

   • ABy using the token to bypass network policies and access other pods.
   • BBy authenticating to the Kubernetes API server as that service account and performing actions allowed by its RBAC permissions.
   • CBy decrypting the token to reveal the service account's password.
   • DBy using the token to directly access the host node's filesystem.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team is hardening a cluster. They want to prevent container breakout via kernel vulnerabilities. Which combination of settings is most effective?

   • AUse a minimal base image and ensure the container runs as root to avoid permission errors.
   • BEnable `hostNetwork: true` to allow the container to monitor network traffic for intrusion detection.
   • CSet `privileged: true` but add a read-only root filesystem.
   • DRun containers with a non-root user, drop all capabilities, set `allowPrivilegeEscalation: false`, and use a seccomp profile.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security analyst is investigating a potential container breakout. The container was running with `CAP_SYS_ADMIN` and `CAP_NET_ADMIN`. The analyst finds that the container has a mount namespace that is not fully isolated. Which of the following is the most likely indicator of a successful breakout?

   • AThe container can access the host's network interfaces.
   • BThe container has a new network namespace created by the attacker.
   • CThe container can read `/etc/shadow` on the host.
   • DThe container process has a parent process outside the container's PID namespace.
   Reveal Solution Discussion Select an answer first