Mock paper A — the six domains in order

Two hours. 17 tasks, 6 points each, 102 total. 68 to pass.

Every task names the host you must work on. base has no kubectl. Do not reboot
base, do not delete a control-plane manifest, and verify each answer before you
move on. Where a task names a value, use exactly that value.

Task 1 — Default deny, one allowed flow (6 points)

On controlplane. Namespace prod runs frontend (tier=frontend) and
backend (tier=backend, port 3000).

• Deny all ingress and egress in prod.
• Allow only frontend → backend on TCP 3000.
• DNS must keep working for every Pod in prod.

Task 2 — No metadata access (6 points)

On controlplane. No Pod in prod may reach 169.254.169.254. Everything else
must keep working.

Task 3 — CIS controls (6 points)

On controlplane, as root. kube-bench reports failures on the API server.

• Disable anonymous authentication.
• Disable profiling.
• The API server must still be healthy afterwards.

Task 4 — HTTPS Ingress (6 points)

On controlplane. Namespace shop has Service shop on port 80.

• Serve it as shop.example.com over HTTPS with a certificate you generate.
• The Ingress must reference the certificate through a TLS-typed Secret.

Task 5 — Verify a binary (6 points)

On controlplane. /usr/local/bin/kubelet may have been tampered with.

• Verify it against the official v1.35.0 checksum.
• Write ok or tampered to /root/kubelet-check.txt.

Task 6 — Least-privilege RBAC (6 points)

On controlplane. User jane must be able to get, list and watch Pods in
namespace prod, and read their logs. Nothing else, nowhere else.

Task 7 — Service account hygiene (6 points)

On controlplane. Deployment client in prod uses ServiceAccount api. The
token must not be mounted into its Pods, and the Deployment must stay available.

Task 8 — API server admission (6 points)

On controlplane, as root. The NodeRestriction admission plugin must be active
and the authorization mode must be Node,RBAC.

Task 9 — AppArmor (6 points)

On worker, as root, and on controlplane. Create the profile deny-write
that denies writes below /tmp, load it, and apply it to Pod guarded in
namespace prod. The Pod must be Running.

Task 10 — seccomp (6 points)

On worker, as root, and on controlplane. Create a seccomp profile that denies
mkdir and apply it to container tester in Pod tester-pod (prod). Prove the
container still starts.

Task 11 — Hardened Deployment (6 points)

On controlplane. Deployment web in prod runs as root with no restrictions.

• Non-root, UID 101, no privilege escalation, all capabilities dropped, seccomp RuntimeDefault, read-only root filesystem.
• It must stay Running.

Task 12 — Restricted Pod Security (6 points)

On controlplane. Namespace locked must enforce the restricted standard.
Deployment bad in that namespace must run under it.

Task 13 — Encrypted Secrets (6 points)

On controlplane, as root. Secrets must be encrypted at rest with aescbc, and
the existing ones must be encrypted too. Prove it through etcd.

Task 14 — Image scanning (6 points)

On controlplane. Find the workload in prod whose image has CRITICAL
vulnerabilities and remove it so its Pods do not come back.

Task 15 — Audit logging (6 points)

On controlplane, as root.

• Log Metadata for everything.
• Log RequestResponse for Secrets and ConfigMaps in namespace config-data.
• Write to /var/log/kubernetes/audit.log with a 30-day maximum age.

Task 16 — Falco (6 points)

On worker, as root. Override the rule Write below etc so its output includes
the container id, and make Falco write alerts to /var/log/falco/events.log.
Do not modify falco_rules.yaml.

Task 17 — Runtime forensics (6 points)

On worker, as root. Pod suspect in prod is consuming CPU. Identify the
binary it is running and write its path to /root/suspect.txt.