Kubernetes and Cloud Native Security Associate (KCSA) free question 7 / 10 · Domain 4: Kubernetes Threat Model
An operator wants every workload to run with a syscall filter, including workloads whose manifests name no seccomp profile, so that a compromised process has less of the kernel to attack. What does the Security Checklist say is possible?
- A default filter loaded by the AppArmor module, which carries seccomp rules too.
- From Kubernetes 1.27, RuntimeDefault can be enabled as the default for workloads.
- Seccomp on Windows and Linux nodes alike, once the cluster runs Kubernetes 1.27.
- Nothing at cluster level: each Pod must name a profile, as no default can be set.
Show the answer and explanation
Answer: B
Why this is correct
The checklist item reads: "For nodes that support it, Seccomp is enabled with appropriate syscalls profile for programs." It explains that seccomp, a feature of the Linux kernel since 2.6.12, "can be used to sandbox the privileges of a process, restricting the calls it is able to make from userspace into the kernel", and that it "can improve the security of your workloads by reducing the Linux kernel syscall attack surface available inside containers." The filter mode uses BPF to build an allow or deny list of syscalls, called profiles. "Since Kubernetes 1.27, you can enable the use of RuntimeDefault as the default seccomp profile for all workloads." The checklist also points to the Kubernetes Security Profiles Operator for managing seccomp in clusters. A default profile means that a forgotten field no longer leaves a workload without a filter.
Why the other options are wrong
"Nothing at cluster level: each Pod must name a profile, as no default can be set." … The checklist says the opposite: "Since Kubernetes 1.27, you can enable the use of RuntimeDefault as the default seccomp profile for all workloads."
"Seccomp on Windows and Linux nodes alike, once the cluster runs Kubernetes 1.27." … The checklist notes that "Seccomp is only available on Linux nodes." The 1.27 change is about a default profile, not about other operating systems.
"A default filter loaded by the AppArmor module, which carries seccomp rules too." … AppArmor is a separate Linux kernel security module that implements Mandatory Access Control through its own profiles. Seccomp is the kernel feature that restricts "the calls it is able to make from userspace into the kernel".
A default profile closes the gap of forgotten fields
Seccomp shrinks the syscall surface a compromised process can use. Enabling RuntimeDefault as the default covers workloads whose manifests do not set a profile, on Linux nodes.