Cluster Setup and Hardening

During a security audit, you discover that a container running as root inside a pod has been compromised. The pod uses the default service account. Which two measures should you implement to harden the cluster? (Select TWO)

A cluster uses Kubernetes v1.24 with Pod Security Admission enabled. The cluster administrator wants to enforce that all pods in the 'production' namespace run with the 'restricted' policy level, but some existing deployments use privileged containers. Which approach ensures that only new pods violating the policy are rejected, while existing pods continue to run?

A security engineer needs to ensure that all communication between nodes and the control plane is encrypted. Which component must be configured with a TLS certificate to achieve this?

After a security incident, you need to restrict which pods can communicate with each other in the 'finance' namespace. You want to allow only pods with label 'app: api' to connect to pods with label 'app: db' on TCP port 5432, and deny all other traffic. Which NetworkPolicy should you create?

A cluster has been configured with the NodeRestriction admission plugin. A developer tries to create a pod that uses a hostPath volume pointing to /var/log. The pod's nodeSelector is set to 'kubernetes.io/hostname: worker-1'. Which statement is true?

Which THREE of the following are valid methods to secure etcd in a Kubernetes cluster? (Select THREE)

Which TWO of the following are recommended practices for securing the Kubernetes API server? (Select TWO)

A security team wants to ensure that only approved container images can run in their production cluster. Which admission controller should be configured in the kube-apiserver to enforce this policy?

An administrator discovers that a container has been running with root privileges despite a PodSecurityPolicy that should prevent it. What is the most likely cause?

A DevOps engineer needs to restrict the outbound network traffic from pods running in namespace 'secure-ns'. Which NetworkPolicy configuration achieves this by default?

Which TWO of the following are valid methods to secure the etcd datastore in a Kubernetes cluster?

You are a security engineer for a financial services company running a Kubernetes cluster on-premises. The cluster uses kubeadm for bootstrapping and Calico for network policy. Recently, a compliance audit revealed that all nodes in the cluster have the kubelet port 10250 open to the public network, allowing unauthenticated access to the kubelet API. This poses a severe security risk. The cluster has 10 worker nodes and 3 control plane nodes. You need to remediate this without disrupting running workloads. The nodes are behind a corporate firewall, but the internal network is considered untrusted. You have access to the node's iptables and can modify configuration files. Which course of action best secures the kubelet port while maintaining cluster functionality?

A security engineer is configuring a Kubernetes cluster to meet CIS benchmark recommendations. The cluster uses kubeadm for bootstrapping. Which action should be taken to ensure the kube-apiserver is hardened against unauthorized access?

A Kubernetes cluster is experiencing issues where pods cannot pull images from a private container registry. The registry requires authentication via imagePullSecrets. The cluster has a pod running with the following spec snippet. What is the likely cause of the failure?

A DevOps team is tasked with upgrading a Kubernetes cluster from version 1.21 to 1.22. They want to minimize downtime and follow best practices. Which approach should they take?

Which TWO actions should be taken to secure etcd in a Kubernetes cluster?

Arrange the steps to create and enforce a Pod Security Policy (PSP) in a Kubernetes cluster.

Order the steps to perform a Kubernetes cluster upgrade from version 1.24 to 1.25.

Match each Kubernetes security component to its description.

Match each container security context setting to its effect.

Which flag must be set on the kube-apiserver to disable anonymous authentication?

A security auditor runs kube-bench and reports that the kubelet is not configured with --protect-kernel-defaults. What is the impact of this misconfiguration?

You need to enable encryption at rest for secrets in an existing cluster. Which resource should you create?

An administrator applies the following manifest to enable audit logging: apiVersion: audit.k8s.io/v1 kind: Policy metadata: name: audit-policy rules: - level: Metadata resources: - group: "" resources: ["secrets"] Which audit level is being used for requests to the Secrets API?

Which admission plugin should be enabled to prevent kubelets from modifying Node objects they should not have access to?

What is the purpose of the --audit-policy-file flag on the kube-apiserver?

A cluster administrator wants to ensure that a specific service account (my-sa) cannot have its token mounted automatically in pods. Which annotation should be set on the service account?

You run 'kubectl auth can-i --list --as=system:serviceaccount:kube-system:my-sa' and see that my-sa has cluster-admin access. What is the BEST way to reduce privileges?

Which of the following is a recommended setting from the CIS Kubernetes Benchmark for the kubelet?

An administrator wants to secure etcd communication. Which of the following is required?

After running kube-bench, you see a failing check: '1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive'. What is the remediation?

Which etcd encryption provider is considered strongest for encrypting secrets at rest?

Which TWO admission plugins should be enabled to improve cluster security according to CIS benchmarks? (Choose two.)

Which THREE of the following are recommended actions to secure the Kubernetes Dashboard? (Choose three.)

Which TWO of the following are valid methods to restrict etcd access? (Choose two.)

Which kubectl command can be used to check the CIS benchmark compliance of a Kubernetes cluster?

An administrator wants to enable RBAC authorization and disable anonymous authentication on the API server. Which set of flags should be added to the kube-apiserver configuration?

During a security audit, you run kube-bench and find that the API server audit logging is not enabled. Which set of flags should be added to the kube-apiserver to enable audit logging with a policy file located at /etc/kubernetes/audit-policy.yaml?

You need to enable encryption at rest for secrets in the cluster. Which resource should you create to configure encryption providers?

An administrator runs 'kubectl describe nodes' and notices that the node status shows 'Ready,SchedulingDisabled'. What is the most likely cause?

Which kubelet flag should be set to ensure the kubelet does not allow anonymous requests?

You are creating a ServiceAccount that should not automatically mount its token to pods. Which field should be set in the ServiceAccount manifest?

An administrator wants to restrict which nodes a pod can be scheduled on using the NodeRestriction admission plugin. Which flag must be set on the kube-apiserver to enable this plugin?

What is the purpose of the Kubernetes Dashboard?

Which admission plugin is recommended by the CIS Kubernetes Benchmark to restrict the kubelet's ability to modify nodes?

You need to encrypt etcd data at rest using AES-CBC. Which encryption provider should you specify in the EncryptionConfiguration?

You are auditing RBAC and find a ClusterRoleBinding that grants cluster-admin to a service account. Which command should you run to list all ClusterRoleBindings in the cluster?

Which etcd security measure should be implemented to ensure only authorized clients can access the etcd cluster?

An administrator runs 'kubectl get pods' and sees that a pod is in 'Pending' state. What is the most likely reason for this state?

You want to ensure that a pod only runs on nodes that have a specific label, 'disktype=ssd'. Which field should be specified in the pod spec?

Which TWO of the following are recommended practices for securing the Kubernetes Dashboard? (Select TWO)

Which TWO kubelet flags are recommended by the CIS Kubernetes Benchmark to enhance security? (Select TWO)

Which THREE of the following are valid ways to secure etcd in a Kubernetes cluster? (Select THREE)

Which TWO of the following are recommended settings for the Kubernetes API server according to the CIS Kubernetes Benchmark? (Select TWO)

Which THREE of the following are best practices for RBAC hardening in Kubernetes? (Select THREE)

Which flag disables anonymous authentication on the API server?

An administrator runs 'kube-bench run --targets=master' and sees a failing check for 'Ensure that the --audit-log-path argument is set'. What is the correct remediation?

A security audit reveals that etcd does not encrypt data at rest. Which resource must be created to enable encryption?

A ClusterRoleBinding named 'admin-binding' binds the cluster-admin ClusterRole to a service account 'sa-admin' in namespace 'ns1'. What is the security concern?

Which kubectl command creates a Role named 'pod-reader' that allows only 'get', 'list', and 'watch' on pods in namespace 'ns1'?

Which admission plugin is recommended by the CIS Benchmark to restrict what nodes can modify?

An administrator wants to prevent the kubelet from serving anonymous requests. Which flag should be set on the kubelet?

A pod in namespace 'ns1' has automountServiceAccountToken: false. However, the container still has a mounted service account token at /var/run/secrets/kubernetes.io/serviceaccount. What is the most likely cause?

Which flag must be set on the API server to enable audit logging?

What is the purpose of the CIS Kubernetes Benchmark?

An administrator runs 'kubectl auth can-i --list --as=system:serviceaccount:ns1:my-sa' and sees that the service account has 'create pods' permission via a RoleBinding. Which command can be used to delete that RoleBinding?

A security scanner reports that the Kubernetes dashboard is publicly accessible. Which recommended action should be taken?

Which flag is used to restrict the kubelet's ability to modify node status and pods?

What is the recommended way to provide TLS certificates to the API server?

Which command can be used to check if the API server has anonymous authentication enabled?

Which TWO actions are recommended by the CIS Kubernetes Benchmark for securing etcd?

Which THREE flags should be set on the kubelet to comply with the CIS Benchmark for worker node security?

Which TWO resources can be used to implement RBAC in Kubernetes?

Which TWO checks are performed by kube-bench for the master node?

Which THREE are valid ways to restrict access to the Kubernetes API server?

Which flag should be set on the kube-apiserver to disable anonymous authentication?

An administrator runs kube-bench and receives a failing result for CIS control 1.1.1. What does this control typically check?

A security policy requires that all communication to etcd be encrypted. Which two components must be configured with TLS certificates to achieve this? (Select two)

Which TWO of the following are recommended practices for securing the Kubernetes dashboard?

Which kube-apiserver flag enables encryption at rest for secrets?

A security audit reveals that a ServiceAccount named 'monitor' has a ClusterRoleBinding to the cluster-admin role. What is the best remediation?

Which kubelet flag prevents the kubelet from serving anonymous requests?

Which THREE of the following are valid encryption providers that can be used in EncryptionConfiguration for encryption at rest?

Which kube-apiserver flag enables audit logging?

A cluster administrator wants to ensure that pods cannot modify node objects. Which admission plugin should be enabled?

You need to run kube-bench on a control plane node. Which command should you use?

A security policy requires that all ServiceAccounts in a namespace do not automatically mount their tokens. How can this be achieved at the namespace level?

Which TWO admission plugins are recommended to be enabled for security hardening?

What is the default authorization mode for a new Kubernetes cluster?

You run 'kubectl auth can-i --list --as=admin' and see that the admin user has full cluster-admin access. Which command would create a ClusterRoleBinding for a user named 'viewer' with read-only access to all resources?

Which kubectl command will disable anonymous authentication on a kube-apiserver?

You have a requirement to encrypt secrets at rest in etcd. Which resource and apiVersion should be used?

A security auditor runs kube-bench on your cluster and reports that the apiserver is using default service account tokens. Which admission plugin should be enabled to address this?

You need to create a ClusterRole that allows listing secrets, but only in namespaces that have a specific label 'security-level=high'. Which approach should you use?

You run 'kube-bench' and see a failure: '1.2.7 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate'. What is the impact of this misconfiguration?

Which flag on the kubelet disables anonymous access?

You are asked to ensure that a specific Kubernetes dashboard (e.g., kubernetes-dashboard) is not publicly accessible. The dashboard is deployed in the 'kube-system' namespace. Which NetworkPolicy should you apply?

You need to audit all API requests to the cluster. Which set of apiserver flags should be configured?

Which RBAC resource should be used to grant cluster-wide permissions to a user?

A service account 'monitor' needs to list pods in all namespaces. Which minimal RBAC configuration should you use?

You are auditing RBAC and find a ClusterRoleBinding named 'admin-binding' that binds the 'cluster-admin' ClusterRole to the service account 'default' in namespace 'kube-system'. What is the risk?

You want to ensure that kubelets only serve pods that have been scheduled by the API server. Which admission plugin should be enabled?

Which TWO of the following are recommendations from the CIS Kubernetes Benchmark?

Which THREE of the following are valid methods to secure etcd?

Which TWO of the following are best practices for hardening Kubernetes Dashboard?

An administrator runs `kube-bench` on a Kubernetes node and receives a warning that the kubelet is configured with `--anonymous-auth=true`. Which kubectl command should be used to fix this on the kubelet?

You are tasked with enabling audit logging for the Kubernetes API server. Which API server flag must be used to specify the audit log file path?

A security scan reports that the etcd cluster does not encrypt data at rest. The cluster uses aescbc encryption. Which resource type should be created to configure encryption at rest?

Which admission plugin should be enabled on the kubelet to ensure it only registers nodes and sets labels as allowed by the Node REST API?

An administrator wants to ensure that a service account used by a deployment cannot automatically mount its token. Which field should be set to `false` in the Pod spec?

You need to create an RBAC role that allows reading secrets only in namespace 'production'. Which ClusterRole and RoleBinding combination is correct?

Which of the following flags should be set to `false` to disable anonymous authentication to the Kubernetes API server?

A pod runs with a service account that has a ClusterRoleBinding granting cluster-admin. What is the best practice to reduce the risk of privilege escalation?

You are securing etcd. Which of the following is required to enable TLS client authentication for etcd?

The Kubernetes Dashboard is deployed in the cluster. To secure it, which of the following is a recommended practice?

Which flag enables the NodeRestriction admission plugin on the API server?

An administrator runs `kube-bench` and sees that the check 'Ensure that the --protect-kernel-defaults flag is set to true' has failed. Which component does this check apply to?

Which two of the following are recommended by the CIS Kubernetes Benchmark? (Choose two.)

Which three of the following are valid methods to restrict access to etcd? (Choose three.)

Which two of the following are correct ways to enforce least privilege for service accounts? (Choose two.)

Which kubectl command checks the CIS Benchmark compliance of a cluster node using the kube-bench tool?

An administrator wants to disable anonymous authentication to the Kubernetes API server. Which flag should be added to the kube-apiserver configuration?

Which admission plugin should be enabled to ensure that kubelet only serves pods bound to its node and prevents unauthorized node access?

You have enabled etcd encryption at rest using an EncryptionConfiguration with aescbc provider. After applying the configuration, you create a new Secret. Which of the following is true regarding the encrypted Secret?

What is the purpose of the --audit-log-path flag on the kube-apiserver?

An administrator runs 'kubectl get clusterrolebindings' and notices a ClusterRoleBinding named 'admin-binding' that binds the 'cluster-admin' ClusterRole to a service account in the 'default' namespace. What security concern does this raise?

Which flag must be set on the kubelet to prevent it from using the default namespace for pods and to enforce that pods only use namespaces that match the node's assigned namespace?

A security auditor recommends enabling audit logging for the Kubernetes API server with a policy that logs all requests at the Metadata level. Which configuration ensures this requirement?

Which of the following is a valid method to disable automatic mounting of service account tokens for a pod?

An administrator wants to secure etcd communication. Which of the following is required to enable TLS for client-to-etcd communication?

A ClusterRole named 'secret-reader' is defined with rules to get, list, and watch secrets. A RoleBinding in namespace 'app' binds this ClusterRole to a service account. Which of the following best describes the permissions of the service account?

Which of the following is a recommended practice when securing the Kubernetes Dashboard?

Which TWO of the following are CIS Benchmark recommendations for securing the Kubernetes API server? (Select TWO)

Which THREE of the following are valid methods to restrict access to etcd in a Kubernetes cluster? (Select THREE)

Which TWO of the following are recommended actions to harden service account security in a Kubernetes cluster? (Select TWO)

Which flag should you set on the kube-apiserver to disable anonymous authentication?

An administrator runs 'kube-bench master' and receives a warning that etcd has no client certificate authentication. What is the recommended remediation?

You are configuring kubelet security. Which flag prevents containers from modifying kernel parameters?

Which admission plugin should be enabled on the kube-apiserver to enforce that kubelets cannot modify nodes they are not assigned to?

An administrator creates an EncryptionConfiguration with aescbc and saves it to /etc/kubernetes/enc/enc.yaml. Which flag must be added to the kube-apiserver to enable encryption at rest?

To disable service account token automount for a pod, which field should be set to false in the pod spec?

You want to ensure that the Kubernetes Dashboard is accessed only by authenticated users with specific permissions. What is the BEST approach?

Which kubectl command can be used to view the audit log policy currently in use by the API server?

A security scan reports that the etcd data directory is not encrypted at rest. The cluster uses etcd v3.5. Which steps are required to enable encryption?

Which of the following is a recommended CIS benchmark setting for the kubelet?

A developer created a ClusterRoleBinding that grants cluster-admin to a service account. What is the security concern?

Which command would you run to check if anonymous authentication is enabled on the API server?

Which TWO of the following are recommended practices for etcd security?

Which THREE of the following are valid flags for enabling admission plugins on the API server?

Which TWO actions are part of the CIS Kubernetes Benchmark recommendations?

Which flag must be set on the kube-apiserver to disable anonymous authentication?

You run 'kube-bench' on a cluster node and get a failure for the test 'Ensure that the --anonymous-auth argument is set to false' (ID: 1.2.1). Which file do you need to modify to fix this issue?

An administrator wants to enable encryption at rest for secrets in a Kubernetes cluster. They create the following EncryptionConfiguration and place it at /etc/kubernetes/enc/enc.yaml. Which flag must be added to the kube-apiserver to use this configuration?

You need to ensure that the kubelet only serves authenticated and authorized requests. Which flag(s) should be set on the kubelet?

Which admission plugin should be enabled to prevent kubelets from modifying nodes or pods they do not own?

You are reviewing RBAC permissions and notice a ClusterRoleBinding that binds the cluster-admin role to a service account in the 'monitoring' namespace. What is the best practice recommendation?

An etcd cluster uses TLS for peer and client communication. You need to secure etcd further by enabling RBAC. Which flag do you set on the etcd process to enable authentication?

To enforce Pod Security Standards at the namespace level, which admission plugin must be enabled on the API server?

What is the purpose of the 'automountServiceAccountToken: false' setting in a Pod spec?

You deploy the Kubernetes Dashboard using the official YAML manifests. Which of the following is the MOST secure approach to expose the Dashboard?

You need to enable audit logging for the Kubernetes API server. Which three flags must be set?

You are configuring etcd encryption at rest. After placing the EncryptionConfiguration YAML file, you must modify which file to point the API server to it?

Which TWO of the following are recommended practices according to the CIS Kubernetes Benchmark? (Select 2)

Which THREE of the following are valid ways to restrict access to etcd? (Select 3)

Which TWO admission plugins should be enabled to improve cluster security according to the CIS Benchmark? (Select 2)

Which kubectl command runs kube-bench against a Kubernetes cluster?

An administrator runs kube-bench on a node and sees a warning about the kubelet anonymous authentication being enabled. Which kubelet flag should be set to disable anonymous access?

A security team wants to ensure that all API requests to the cluster are authenticated and uses RBAC for authorization. Which two flags must be set on the kube-apiserver?

A pod running in the cluster is in a CrashLoopBackOff state. You run 'kubectl describe pod <pod>' and see the following event: 'Warning BackOff Back-off restarting failed container'. Which command would you run to see the standard error output of the container?

An administrator wants to enable audit logging for the Kubernetes API server. Which of the following is required?

After setting up etcd encryption at rest using EncryptionConfiguration with aescbc, which resource stores the encryption key?

Which of the following is a CIS benchmark recommendation for securing the Kubernetes API server?

A security audit reveals that a service account in the 'default' namespace has been granted cluster-admin privileges via a ClusterRoleBinding. What is the best mitigation?

Which admission plugin should be enabled on the kube-apiserver to restrict kubelet permissions and prevent nodes from modifying their own Node objects?

Which flag on the kubelet helps ensure it runs securely by enforcing kernel defaults?

A pod is failing with status 'CrashLoopBackOff'. The pod manifest includes a liveness probe that runs every 10 seconds. You suspect the probe is causing the crash. Which command would you use to verify the liveness probe configuration?

Which of the following YAML snippets correctly configures a ServiceAccount with automountServiceAccountToken set to false?

Which TWO of the following are recommended CIS benchmark practices for securing etcd? (Choose two.)

Which TWO admission plugins are recommended by the CIS benchmark to be enabled on the kube-apiserver? (Choose two.)

Which THREE of the following are valid methods to restrict access to the Kubernetes Dashboard? (Choose three.)

Which kubectl flag disables anonymous authentication on the API server?

You run kube-bench on a node and it reports a failure for 'Ensure that the --anonymous-auth argument is set to false' for the kubelet service. Which file must you modify to fix this?

Which admission plugin enforces that kubelets cannot modify pods they do not own?

You are tasked with enabling audit logging for the Kubernetes API server. You have created an audit policy file at /etc/kubernetes/audit-policy.yaml. Which flag must be added to the API server manifest to enable audit logging?

An etcd cluster uses TLS for peer and client communication. Which command correctly tests connectivity to an etcd member with client certificate authentication?

A security audit reveals that a service account 'monitor' is bound to the cluster-admin ClusterRole, which violates least-privilege. What is the best remediation?

Which of the following is a recommended CIS Benchmark control for etcd?

You need to encrypt Kubernetes secrets at rest using aescbc. Which YAML snippet defines the EncryptionConfiguration correctly?

An administrator runs kubectl get clusterrolebindings and sees a binding named 'system:node'. This binding is part of the legacy node authorization. According to CIS benchmarks, what should be done with it?

You are configuring kubelet to protect kernel defaults. Which flag enables this?

A cluster's API server is configured with --authorization-mode=RBAC,Node. A kubelet attempts to create a ConfigMap. Which authorizer will evaluate the request?

Which admission plugin should be used to enforce Pod Security Standards at the namespace level?

Which TWO of the following are CIS Benchmark recommendations for securing the API server?

Which TWO actions would help secure the Kubernetes Dashboard?

Which THREE of the following are valid methods to disable automount of service account tokens for a pod?

Which flag disables anonymous authentication on the Kubernetes API server?

An administrator runs kube-bench on a cluster node and receives failures for CIS benchmark checks related to kubelet configuration. Which kubelet flag should be set to ensure that kernel defaults are not used when they might be insecure?

A security audit reveals that the etcd datastore is not encrypted at rest. Which resource should be created to enable encryption of secrets at rest?

You are tasked with securing a Kubernetes cluster. You want to ensure that the kubelet only serves APIs that are explicitly allowed and that it does not allow anonymous requests. Which kubelet configuration flags should you set?

Which admission plugin should be enabled on the API server to ensure that the kubelet cannot modify its own Node object beyond its assigned node?

An administrator wants to enable audit logging on the API server. Which three flags are required to set up basic audit logging?

A developer creates a pod with the following YAML: apiVersion: v1 kind: Pod metadata: name: mypod spec: serviceAccountName: default automountServiceAccountToken: true containers: - name: app image: nginx What is the security concern with this configuration?

You need to restrict access to etcd so that only the API server can communicate with it. Which method should you use?

Which kubectl command can be used to determine if anonymous authentication is enabled on the API server?

An administrator wants to ensure that no service account in the 'development' namespace has cluster-admin privileges. Which command should be used to identify such bindings?

What is the purpose of the --authorization-mode=RBAC flag on the API server?

A cluster has been hardened by setting --anonymous-auth=false and enabling RBAC. However, kube-bench still reports a failure for the kubelet check 'Ensure that the --anonymous-auth argument is set to false'. What could be the reason?

Which TWO actions are recommended by the CIS Kubernetes Benchmark to secure the API server?

Which THREE options are valid methods to secure etcd in a Kubernetes cluster?

Which TWO practices help secure the Kubernetes Dashboard?

Which of the following flags should be set on the kube-apiserver to disable anonymous authentication?

An administrator wants to restrict a service account to only be able to create pods in the 'development' namespace. Which RBAC configuration should be used?

You run kube-bench on a node and it reports a failure for control plane component etcd. The check says 'Ensure that the --cert-file and --key-file arguments are set as appropriate'. You examine the etcd manifest file and find that the cert-file and key-file are configured with a self-signed certificate. What is the BEST action to remediate this finding?

A security audit reveals that several pods have the service account token mounted automatically. Which annotation should be added to the pod's service account to prevent automatic mounting?

Which of the following is the correct flag to enable audit logging on the kube-apiserver?

A cluster administrator wants to encrypt secrets at rest in etcd. Which resource must be created to configure encryption?

You are tasked with securing the kubelet. Which flag must be set on the kubelet to enable the NodeRestriction admission plugin?

Which of the following is a recommended practice for securing Kubernetes Dashboard?

An admin runs 'kubectl auth reconcile -f rbac.yaml' and gets an error that the user does not have permission to create ClusterRoleBindings. What is the most likely cause?

To protect kernel defaults on a node, which flag should be set on the kubelet?

A ClusterRoleBinding grants cluster-admin to a service account in the 'kube-system' namespace. What is the best way to audit this for least privilege?

Which of the following is a correct method to enable encryption at rest for secrets in etcd using the EncryptionConfiguration?

Which TWO of the following are recommended settings from the CIS Kubernetes Benchmark for the kube-apiserver? (Select 2)

Which TWO of the following are valid ways to restrict access to etcd? (Select 2)

Which THREE of the following are recommended practices for hardening RBAC in a Kubernetes cluster? (Select 3)

Which flag must be set on the kube-apiserver to disable anonymous authentication?

A security auditor runs kube-bench on a Kubernetes node and reports that the check '1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive' fails. What is the most appropriate remediation?

You need to enable audit logging for the Kubernetes API server. Which two flags must be set?

An etcd cluster is configured with TLS. You need to enforce that only the API server can read and write to etcd. Which method should you use?

You want to ensure that kubelet does not allow anonymous requests. Which flag must be set on the kubelet?

Which admission plugin should be enabled on the API server to enforce that kubelet cannot modify nodes other than its own?

You are auditing RBAC and find a ClusterRoleBinding named 'admin-binding' that binds the 'cluster-admin' ClusterRole to a service account in the 'default' namespace. What is the security concern?

A pod is in a CrashLoopBackOff state. You run 'kubectl logs pod-name' and see: 'Error: failed to start container: exec: "/app": stat /app: no such file or directory'. What is the most likely cause?

Which TWO of the following are recommended CIS Kubernetes Benchmark controls for securing the kube-apiserver?

Which TWO of the following are valid arguments for etcd encryption at rest?

Which THREE of the following are recommended practices for securing Kubernetes Dashboard?

Which TWO of the following flags are used to secure the kubelet?

Which THREE of the following are valid fields in an EncryptionConfiguration YAML to encrypt secrets at rest?

You are securing a cluster and want to ensure that service account tokens are not automatically mounted in pods that do not need them. Which THREE actions should you take?