CDP Container & Kubernetes Security Flashcards

A Kubernetes Pod Security Admission (PSA) policy set to 'restricted' enforces:

Answer: A strict security profile requiring non-root, read-only filesystems, and no privilege escalation

The 'restricted' PSA profile applies the hardest security settings, preventing common container escape techniques and privilege abuse.

What is the purpose of a Service Mesh (e.g., Istio, Linkerd) in a Kubernetes security context?

Answer: To provide mutual TLS (mTLS) encryption and fine-grained traffic policy between services

A service mesh transparently encrypts inter-service traffic with mTLS and enables zero-trust network policies at the application layer.

Which runtime security tool monitors container behavior at runtime to detect anomalous activity such as unexpected system calls?

Answer: Falco

Falco uses eBPF or kernel modules to watch system calls and generate alerts when container behavior deviates from defined security rules.

Encrypting etcd at rest in Kubernetes is important because etcd:

Answer: Stores all cluster state including Secrets, making it a high-value target

etcd holds the entire cluster state including Secret objects in plaintext by default, so encryption at rest protects against unauthorized disk-level access.

What is the primary security risk of using `hostNetwork: true` in a Kubernetes pod spec?

Answer: The pod shares the host network namespace, bypassing network segmentation

hostNetwork gives the pod direct access to the node's network interfaces, allowing it to sniff traffic and bypass NetworkPolicy restrictions.

In a DevSecOps pipeline, integrating container image scanning at which stage provides the earliest feedback?

Answer: During the CI build, immediately after the image is built

Scanning immediately after the image build in CI ensures vulnerable images are caught and blocked before they reach any deployment environment.