Mock paper B — mixed and timed

Two hours. 17 tasks, 6 points each, 102 total. 68 to pass.

This paper is deliberately mixed: node-level and API-level work interleaved, the
way the real exam does it. Read the host line every time.

Task 1 — Egress allow-list (6 points)

On controlplane. In namespace prod, Pods may reach DNS and
10.0.0.0/8 only, except 10.0.5.0/24.

Task 2 — kubelet hardening (6 points)

On worker, as root. Anonymous authentication must be disabled, the read-only
port closed, and the kubelet restarted — without breaking the node.

Task 3 — TLS versions on the API server (6 points)

On controlplane, as root. The API server must accept TLS 1.2 minimum and must
not accept TLS 1.0.

Task 4 — Service account with no permissions (6 points)

On controlplane. ServiceAccount report in prod may only get and list
ConfigMaps in its own namespace, and its token must not be automounted.

Task 5 — Over-permissive ClusterRole (6 points)

On controlplane. ClusterRole wide grants * on secrets. Reduce it to
get on configmaps only, without breaking Pods in prod that use it.

Task 6 — Seccomp runtime default everywhere (6 points)

On controlplane. Deployment api in prod must use the RuntimeDefault
seccomp profile, and its Pods must be Running.

Task 7 — Immutable workload (6 points)

On controlplane. Deployment worker-app in prod must have a read-only root
filesystem and stay Running. It writes at startup to /var/cache/app and /tmp.

Task 8 — Namespace policy (6 points)

On controlplane. Namespace ml must warn and audit at restricted but enforce
only at baseline. A Pod with hostNetwork: true must be allowed in ml
but produce a warning.

Task 9 — Gatekeeper registry policy (6 points)

On controlplane. Only images from registry.example.com/ may run in prod.
Use Gatekeeper, with the policy rejecting anything else.

Task 10 — Secrets: no environment variables (6 points)

On controlplane. Deployment db-app in prod reads Secret db as environment
variables. Change it to mount the same values as files under /etc/db, read-only,
mode 0400.

Task 11 — Sandbox one workload (6 points)

On controlplane. RuntimeClass gvisor exists. Pod isolated in prod must use
it and be Running.

Task 12 — mTLS (6 points)

On controlplane. Traffic inside prod must use mTLS in STRICT mode. Istio is
installed and the sidecars are injected.

Task 13 — Image footprint (6 points)

On controlplane. Deployment heavy in prod uses node:22. Switch it to a
distroless-equivalent that keeps the app working, and pin it by digest.

Task 14 — SBOM query (6 points)

On controlplane. Generate an SBOM for registry.example.com/app:1.4.2 and
answer, in /root/sbom-answer.txt, whether the package openssl is present
(yes/no).

Task 15 — Audit: who deleted what (6 points)

On controlplane, as root. Audit logging is enabled at Metadata for everything.
Find every delete on secrets in the last audit log and write the usernames,
one per line, to /root/deleters.txt.

Task 16 — Detect the shell (6 points)

On worker, as root. Falco must alert when an interactive shell is spawned in a
container in namespace prod, with the Pod name in the output. Trigger it and
show the line.

Task 17 — Immutability triage (6 points)

On controlplane. Across all namespaces, list every Pod that is privileged, uses
the host network, or runs as root, and write their namespace/name to
/root/insecure-pods.txt, one per line.