Cybersecurity Container and Kubernetes Security Engineer Interview Questions & Preparation Guide

What they evaluate

Software supply chain security in containers

Strong answer framework

Start with minimal trusted base images (distroless, Chainguard, or Wolfi). Build with multi-stage Dockerfiles that drop build-time artifacts. Scan images at build time and on push using Trivy, Grype, or vendor scanners; fail builds on critical CVEs without remediation paths. Sign images with Cosign and verify signatures at admission time using Sigstore policies. Generate SBOMs (SPDX or CycloneDX) and store them as signed attestations. Reference SLSA framework levels to mature the pipeline.

Common mistake

Scanning at runtime only, which catches issues after deployment instead of blocking them at build.

What they evaluate

Kubernetes baseline hardening fluency

Strong answer framework

Disable anonymous and insecure access on the API server. Enable RBAC and remove cluster-admin from non-admin service accounts. Apply Pod Security Standards (Restricted profile) via the namespace label or a Kyverno or OPA Gatekeeper policy. Enforce NetworkPolicies that default-deny ingress and egress, then allow only required flows. Encrypt etcd at rest. Enable audit logging at the API server with appropriate verbosity. Restrict kubelet authentication. Apply CIS Kubernetes Benchmark with kube-bench. Set image pull policies and registry allowlists.

Common mistake

Naming a single control like RBAC and missing the layered defense across admission, network, and audit.

What they evaluate

Awareness of evolution in Kubernetes admission

Strong answer framework

PodSecurityPolicies were removed in Kubernetes 1.25. Pod Security Standards (PSS) are the official replacement, applied via the built-in Pod Security Admission controller using namespace labels (enforce, audit, warn modes) at three profiles: Privileged, Baseline, Restricted. For organizations needing more granular policy, third-party admission controllers like Kyverno or OPA Gatekeeper provide flexible rule authoring beyond what PSS expresses.

Common mistake

Recommending PodSecurityPolicies in 2025 deployments without knowing they are removed.

What they evaluate

Runtime detection thinking

Strong answer framework

Deploy a runtime security tool like Falco, Tracee, or vendor equivalents that uses eBPF to observe syscalls. Build detections for known escape primitives: unexpected mount syscalls, write attempts to /proc or /sys, capabilities being added at runtime, host network or PID namespace usage, and shells spawned from privileged contexts. Correlate with Kubernetes audit logs for suspicious exec into pods or service account misuse. Reference MITRE ATT&CK for Containers matrix to map detections.

Common mistake

Relying on image scanning to catch what is fundamentally a runtime problem.

What they evaluate

Negotiation and risk-based exception handling

Strong answer framework

Ask why. Sometimes the answer is a missing capability that can be granted explicitly (NET_BIND_SERVICE for binding port 80 instead of full root). Often the image just lacks a non-root user definition that can be fixed in the Dockerfile. If root is genuinely needed, scope it: use a dedicated namespace with stricter NetworkPolicy, ensure the host kernel is hardened, document the exception with an expiration date, and review at renewal. Default to non-root via Pod Security Standards Restricted profile.

Common mistake

Either blanket-blocking root with no path forward or granting root without documenting risk acceptance.

What they evaluate

Cluster network security fundamentals

Strong answer framework

NetworkPolicies are namespace-scoped objects that select pods and define allowed ingress and egress. They require a CNI that supports them (Calico, Cilium, etc.). Default behavior is allow-all unless a policy selects a pod. Pitfalls: forgetting to apply both ingress and egress, missing default-deny baselines per namespace, mixing pod selectors with namespace selectors incorrectly, and not handling DNS egress to kube-dns. Cilium adds layer 7 policies (HTTP method, path, gRPC) beyond standard NetworkPolicy.

Common mistake

Applying ingress policies without egress, leaving lateral movement and data exfiltration paths open.

What they evaluate

Secrets management options

Strong answer framework

Kubernetes Secrets are base64-encoded, not encrypted by default. Enable etcd encryption at rest with a KMS provider (AWS KMS, Azure Key Vault, GCP KMS, or Vault). Avoid mounting secrets as environment variables when possible (env can leak via logs and process listings); prefer file mounts. Use external secrets operators (External Secrets Operator, HashiCorp Vault Agent Injector) to fetch from a managed secret store. Restrict RBAC on Secret objects. Rotate regularly and audit access.

Common mistake

Treating Kubernetes Secrets as encrypted by default.

What they evaluate

Identity-based incident response in Kubernetes

Strong answer framework

Map the token's RBAC permissions: cluster-admin is catastrophic; namespaced read-only is contained. Identify what API actions it could take and what secrets or resources it could access. Containment: rotate the token (delete the Secret to trigger rebind), evict the affected pods, restrict the binding scope. Investigate audit logs for what was actually accessed. Move to short-lived projected service account tokens (TokenRequest API) and bound service account token volume projection going forward.

Common mistake

Treating service account compromise as a generic credential incident without using Kubernetes audit logs to scope abuse.

What they evaluate

Adaptation to managed cloud-native runtimes

Strong answer framework

Many host-level controls become provider responsibilities; focus shifts to image, identity, and network controls. Continue image scanning and signing. Use IAM roles or workload identity rather than long-lived credentials. Apply provider-native network controls (VPC, ingress filtering). Audit with provider logs (CloudTrail, Cloud Audit Logs, Azure Activity). Lose runtime visibility you would get from Falco; compensate with provider runtime protection or sidecar-based detection where supported. Reference the NIST SP 800-204 series for application container security.

Common mistake

Trying to apply node-level controls in serverless contexts where the platform abstracts away the host.

What they evaluate

Identity and access at scale

Strong answer framework

Start from least privilege per role rather than copying cluster-admin patterns. Use Roles per namespace where possible, ClusterRoles only when truly cluster-wide. Bind service accounts to the smallest scope. Use aggregated ClusterRoles to compose without duplication. Audit RBAC quarterly using kubectl-who-can or rakkess. Treat RBAC as code in version control with peer review. Use Open Policy Agent or Kyverno to enforce binding constraints at admission.

Common mistake

Granting cluster-admin liberally for convenience, which makes blast radius unbounded.

What they evaluate

Vulnerability management workflow for containers

Strong answer framework

Scan at build, on push, and continuously in registry. Prioritize by exploitability and exposure: KEV catalog, EPSS score, runtime usage. Patch by rebuilding from updated base images rather than in-place patching. Use base image standardization (distroless, Chainguard) to shrink attack surface and reduce CVE volume. Track mean time to remediate as a SLO. Use admission policies to block deployment of images older than a threshold or with critical unpatched CVEs.

Common mistake

Treating every CVE as equally urgent and exhausting engineering hours on low-risk findings.

What they evaluate

DevSecOps integration

Strong answer framework

GitOps centralizes desired state in version control, which is auditable and recoverable. The Git repository becomes a high-value target; protect with signed commits, branch protections, and required reviews. The reconciler (Argo CD, Flux) runs with cluster privileges; restrict its scope and protect its identity. Validate manifests at PR time with conftest, OPA, or Kyverno CLI. Reference SLSA for provenance. Avoid stuffing secrets in Git; use sealed-secrets or external secret references.

Common mistake

Believing GitOps is automatically more secure without protecting the Git repository and reconciler identity.

What they evaluate

Practical incident response in Kubernetes

Strong answer framework

Confirm the signal: high CPU, anomalous outbound to mining pools, unfamiliar process names, image from unexpected registry. Use kubectl to identify the pod, namespace, and service account. Pull container logs and audit logs. Snapshot the pod for forensics if possible (kubectl debug or ephemeral container). Contain by network-isolating the pod, then evict. Investigate the deployment path: did it come from a compromised credential, a misconfigured admission policy, or a supply chain compromise of a legitimate image? Remediate at the entry point.

Common mistake

Killing the pod immediately without preserving evidence or understanding how it got there.

What they evaluate

Tooling depth in policy enforcement

Strong answer framework

Pod Security Admission is built-in, simple, three predefined profiles, no custom rules. Kyverno uses YAML-based policies; native to Kubernetes resources; lower learning curve; supports mutate, validate, generate, verifyImages. OPA Gatekeeper uses Rego; powerful and general-purpose but steeper learning curve; better for cross-cluster portability and complex logic. Real environments often use PSA as a baseline and Kyverno or Gatekeeper for custom policy.

Common mistake

Picking a tool dogmatically without considering team capability and policy complexity.

What they evaluate

Professional learning habits

Strong answer framework

Track CNCF security TAG outputs, the Kubernetes security advisories list, and the CIS Benchmarks updates. Follow tools like Falco, Cilium, and Kyverno for new detections and policies. Read research from Aqua Security, Sysdig, Wiz, Snyk on cloud-native threats. Attend KubeCon, CloudNativeSecurityCon, and Black Hat Cloud Native track. Maintain a kind or k3d lab to test new threats and detections.

Common mistake

Naming generic news sources without specific community or research outputs.