Given the following AppArmor profile and Pod manifest: AppArmor Profile: `` profile nginx-deny flags=(attach_disconnected) { #include <abstractions/base> file, # Deny all file writes. deny /** w, } EO

Sign in or unlock CKS to reveal the answer and full explanation for question #14. The question stem and answer options stay visible for context.

Submitted by javi_es· May 4, 2026Runtime Security

Question

Given the following AppArmor profile and Pod manifest: AppArmor Profile:

profile nginx-deny flags=(attach_disconnected) {
 #include <abstractions/base>
 file,
 # Deny all file writes.
 deny /** w,
}
EOF'

Pod Manifest:

apiVersion: v1
kind: Pod
metadata:
 name: apparmor-pod
spec:
 containers:
 - name: apparmor-pod
 image: nginx

Edit the prepared manifest file to include the AppArmor profile. Finally, apply the manifests files and create the Pod specified on it. Verify: Try to make a file inside the directory which is restricted.

Unlock CKS to see the answer

You've previewed enough free CKS questions. Unlock CKS for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.

Unlock CKS - $49.99 / 30 days Sign in

Topics

#AppArmor#Kubernetes Security#Pod Security#Runtime Security Policies

Full CKS Practice