Chapter 10

1. Correct answer: (A) False. A container is a process, not a VM.
2. Correct answer: (B) If marked as privileged, yes. A privileged container can access a host's resources just like a privileged process can.
3. Correct answer: (C) Both. Attackers will string together multiple vulnerabilities to gain access to their target.
4. Correct answer: (B) By comparing the Pod's requested capabilities and the policies authorized via the union of the Pod's creator and its own ServiceAccount. Policies can't be explicitly set.
5. Correct answer: (A) An admission controller that inspects all Pods on creation and when they're updated. Policy enforcement is not handled by the PodSecurityPolicy API, only the definition of policies.
6. Correct answer: (B) False. It will take multiple years between determining a replacement, implementing it, and then the deprecation process.
7. Correct answer: (B) False. You wouldn't run a process as root on your server...