Problems

Labs open a real Linux machine in your browser. Quizzes check the theory in a minute.

30 of 277 problems

Title	Topic	Acceptance	Difficulty	XP
SELinux Modes and RebootsWhile troubleshooting, an admin runs setenforce 0. /etc/selinux/config contains SELINUX=enforcing. The server is then rebooted. What is the SELinux mode after teasyLinux3 XP	Linux	New	easy	3
Dependabot Alerts and UpdatesA team wants GitHub to open pull requests every week that bump their npm dependencies to the latest versions, even when no vulnerability is involved. What shoulmediumGit5 XP	Git	New	medium	5
Running as Non-rootWhy is it recommended to add a USER instruction (a non-root user) to production Dockerfiles?mediumDocker5 XP	Docker	New	medium	5
.dockerignoreWhat does a .dockerignore file do?easyDocker3 XP	Docker	New	easy	3
Give a ServiceAccount Read-Only AccessCreate a ServiceAccount that can watch Pods and Deployments in one namespace and nothing more.mediumKubernetes20 XP	Kubernetes	New	medium	20
Build a Cluster-Wide Read-Only RoleGive an auditor read access to nodes, volumes and Pods across the cluster, without Secrets and without any write access.hardKubernetes40 XP	Kubernetes	New	hard	40
Lock Down Database TrafficWrite a NetworkPolicy so only the API tier can reach the database, without cutting off anything else.mediumKubernetes20 XP	Kubernetes	New	medium	20
Zero-Trust Networking with Default DenyBlock all traffic in and out of a namespace, then allow exactly the flows the app needs, DNS included.hardKubernetes40 XP	Kubernetes	New	hard	40
Choose the Least Permissive NetworkPolicyFour candidate policies are on disk. Apply the one that allows exactly the required traffic and nothing more.mediumKubernetes20 XP	Kubernetes	New	medium	20
Enforce the Restricted Pod Security StandardTurn on restricted Pod Security enforcement for a namespace and harden a multi-container Deployment so it still runs.hardKubernetes40 XP	Kubernetes	New	hard	40
Let One Namespace InA namespace denies all incoming traffic. Write one NetworkPolicy that lets only the monitoring namespace's scraper reach the API's metrics port.mediumKubernetes20 XP	Kubernetes	New	medium	20
Make a Container ImmutableAn attacker who gets into this container could rewrite its files and escalate. Make its root filesystem read-only, run it unprivileged, and keep the app working.mediumKubernetes20 XP	Kubernetes	New	medium	20
Pass the Security LinterThe deployment pipeline now runs kube-linter with a security profile, and your team's manifest fails it. Fix the manifest until the linter is clean, then deploy it.mediumKubernetes20 XP	Kubernetes	New	medium	20
Role vs ClusterRoleA ServiceAccount in namespace ci must list Pods only in namespace staging. Which combination is correct?mediumKubernetes5 XP	Kubernetes	New	medium	5
runAsNonRoot FailuresAfter you add runAsNonRoot: true to a Pod, its container stays in CreateContainerConfigError with "container has runAsNonRoot and image will run as root". What mediumKubernetes5 XP	Kubernetes	New	medium	5
NetworkPolicy DefaultsA namespace has no NetworkPolicies. You then add one policy that selects Pods app=db and allows ingress only from Pods app=api. Which statement is correct (withhardKubernetes8 XP	Kubernetes	New	hard	8
Pod Security Restricted LevelNamespace payments has the label pod-security.kubernetes.io/enforce: restricted. A Pod is rejected with: seccompProfile (pod or container "api" must set securitmediumKubernetes5 XP	Kubernetes	New	medium	5
Disabling Token AutomountA web frontend never calls the Kubernetes API. The security review requires that no ServiceAccount token is present anywhere in its container filesystem. What deasyKubernetes3 XP	Kubernetes	New	easy	3
Runtime Threat DetectionAn attacker exploits a web app and spawns /bin/sh from inside the running process; no one runs kubectl exec. Which control is designed to detect this as it happmediumKubernetes5 XP	Kubernetes	New	medium	5
The Shared Responsibility ModelUnder the cloud shared responsibility model, which task is the customer's responsibility when running an application on a virtual machine (for example EC2)?easyCloud3 XP	Cloud	New	easy	3
Least Privilege with IAMAn application on a virtual machine needs to read objects from one storage bucket. What is the recommended way to give it access?easyCloud3 XP	Cloud	New	easy	3
CloudTrail vs CloudWatch vs ConfigA bucket policy was removed last Tuesday and the security team asks: which IAM principal made the DeleteBucketPolicy call, from which IP address, and when? WhicmediumCloud5 XP	Cloud	New	medium	5
Security Groups Are StatefulA security group allows inbound TCP 443 from anywhere and has no outbound rules that match the client. Will responses to HTTPS requests reach the clients?mediumCloud5 XP	Cloud	New	medium	5
Encryption at Rest with KMSCompliance requires that EBS volumes and S3 objects are encrypted at rest, that the security team controls who can use the key, and that every use of the key ismediumCloud5 XP	Cloud	New	medium	5
Public BucketsA static website's images must be publicly readable, but the rest of the bucket must stay private. What is the safest approach?easyCloud3 XP	Cloud	New	easy	3
Shield vs WAF vs GuardDutyA web app behind an Application Load Balancer is receiving requests with SQL injection payloads in the query string. You want to block these requests before themediumCloud5 XP	Cloud	New	medium	5
What TLS Certificates ProveWhen your browser validates a server's TLS certificate, what is it mainly verifying?mediumNetworking5 XP	Networking	New	medium	5
Secrets in PipelinesWhere should a deployment token used by a CI workflow be stored?easyCI/CD3 XP	CI/CD	New	easy	3
Workspaces vs Separate ConfigurationsA team uses CLI workspaces dev and prod in the same backend and the same configuration. Security now requires that prod state and prod credentials be completelymediumTerraform5 XP	Terraform	New	medium	5
Sensitive Values and StateA database password is passed in through variable "dbpassword" { sensitive = true } and used as the password argument of an awsdbinstance. Which statement is trhardTerraform8 XP	Terraform	New	hard	8