CKS Practice Test 10 — 10 Questions

Question 1

Which admission plugin is recommended by the CIS Kubernetes Benchmark to restrict the kubelet's ability to modify nodes?

Accepted Answer

NodeRestriction. The NodeRestriction admission plugin is recommended by the CIS Kubernetes Benchmark to restrict the kubelet's ability to modify nodes. It limits the kubelet's permissions to only modify its own node and its own pods, preventing it from altering other nodes or performing unauthorized operations. This plugin enforces a security boundary by rejecting requests that attempt to modify node labels, taints, or status outside the kubelet's assigned scope.

Answer

PodNodeSelector

Answer

SecurityContextDeny

Answer

AlwaysPullImages

Question 2

Which annotation is used to apply an AppArmor profile to a pod?

Accepted Answer

container.apparmor.security.beta.kubernetes.io/. The AppArmor profile for a container in a pod is specified using the annotation `container.apparmor.security.beta.kubernetes.io/`, where `` is the name of the container. This annotation, which was introduced in Kubernetes v1.4 as a beta feature, tells the kubelet to apply the referenced AppArmor profile (e.g., `localhost/k8s-apparmor-example`) to the specified container during runtime.

Answer

apparmor.security.kubernetes.io/profile

Answer

security.kubernetes.io/apparmor

Answer

seccomp.security.alpha.kubernetes.io/pod

Question 3

You need to encrypt Kubernetes secrets at rest using aescbc. Which YAML snippet defines the EncryptionConfiguration correctly?

Accepted Answer

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
  - secrets
  providers:
  - aescbc:
      keys:
      - name: key1
        secret: MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=
  - identity: {} [CORRECT]. It defines an EncryptionConfiguration with the correct apiVersion (apiserver.config.k8s.io/v1), kind (EncryptionConfiguration), and a valid provider list. It uses the aescbc provider with a base64-encoded 32-byte key (MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=) for encrypting secrets, and includes the identity provider as a fallback to allow reading existing unencrypted data. This configuration ensures that secrets are encrypted at rest using AES-CBC with a properly encoded 32-byte key.

Answer

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
  - secrets
  providers:
  - aescbc:
      keys:
      - name: key1
        secret: my-plain-text-key

Answer

apiVersion: v1
kind: EncryptionConfig
resources:
- resources:
  - secrets
  providers:
  - aescbc:
      keys:
      - name: key1
        secret: c2VjcmV0LWtleS0zMi1ieXRlcw==

Answer

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
  - secrets
  providers:
  - secretbox:
      keys:
      - name: key1
        secret: c2VjcmV0LWtleS0zMi1ieXRlcw==

Question 4

A DevOps engineer is setting up a CI/CD pipeline to scan container images for vulnerabilities. They want to fail the pipeline if any critical vulnerabilities are found. Which command should they use to scan the image and produce a JSON output that can be parsed?

Accepted Answer

trivy image --severity CRITICAL --format json myimage:tag. `trivy image` scans a container image. Use `--severity CRITICAL` to filter only critical vulnerabilities and `--format json` to produce machine-parseable JSON output. This lets the pipeline parse the JSON and fail on critical vulnerabilities. Note: `--output` specifies an output file path, not the report format.

Answer

trivy fs --severity CRITICAL --output json .

Answer

trivy image --format table myimage:tag

Answer

trivy image --severity HIGH myimage:tag

Question 5

To verify a signed container image, which command should be used?

Accepted Answer

cosign verify myimage:latest. The `cosign verify` command is the correct tool for verifying the cryptographic signature of a signed container image stored in an OCI-compliant registry. Cosign, part of the Sigstore project, uses public-key or keyless signing to ensure image integrity and authenticity. The command checks the signature against the image manifest and the provided public key or Fulcio certificate, confirming that the image has not been tampered with since signing.

Answer

trivy verify myimage:latest

Answer

kubectl verify myimage:latest

Answer

cosign validate myimage:latest

Question 6

Which of the following is a best practice for Dockerfiles to improve supply chain security?

Accepted Answer

Use a distroless base image. Distroless base images contain only the application and its runtime dependencies, significantly reducing the attack surface by eliminating package managers, shells, and other utilities that could be exploited. This aligns with the principle of minimalism in supply chain security, as fewer components mean fewer potential vulnerabilities and a smaller blast radius in case of compromise.

Answer

Use the latest tag for base images to get the newest features

Answer

Run the container as root by default

Answer

Hardcode secrets directly in the Dockerfile

Question 7

A developer wants to ensure that all containers in a pod run with a read-only root filesystem except for a specific volume mounted for writing logs. Which container-level security context field should be set to true?

Accepted Answer

readOnlyRootFilesystem. Setting `readOnlyRootFilesystem: true` in the container-level security context forces the container's root filesystem to be read-only, preventing any writes to the root filesystem. This is exactly what the developer needs to enforce immutability for the root filesystem while allowing writes only to a specific volume (e.g., for logs) mounted with write access. The field is a boolean in the `securityContext` of a container specification in Kubernetes.

Answer

allowPrivilegeEscalation

Answer

privileged

Answer

runAsNonRoot

Question 8

An administrator wants to perform static analysis on Kubernetes manifest files to find security misconfigurations. Which tool is specifically designed for this?

Accepted Answer

Kubesec. Kubesec (option C) is specifically designed for static analysis of Kubernetes manifest files to identify security misconfigurations. It evaluates YAML or JSON manifests against a set of built-in security best practices, such as ensuring containers run as non-root, avoiding privileged escalation, and setting read-only root filesystems. While Trivy can also scan Kubernetes manifests for misconfigurations as part of its broader vulnerability and IaC scanning capabilities, Kubesec is purpose-built for Kubernetes manifest security analysis and is the most specific tool among the choices.

Answer

Trivy

Answer

Cosign

Answer

Syft

Question 9

A container needs to run with the NET_ADMIN capability to modify network settings. The cluster enforces the baseline Pod Security Standard. Which securityContext configurations are valid? (Select all that apply.)

Accepted Answer

capabilities:
  add: ["NET_ADMIN"]. Under the baseline Pod Security Standard (PSS), both options A and C are valid because the baseline profile permits adding specific capabilities like NET_ADMIN. Option A directly adds NET_ADMIN to the container's capabilities. Option C drops all capabilities first and then adds NET_ADMIN, which is also compliant because dropping all is allowed under baseline, and then adding NET_ADMIN is permitted. Option B uses an invalid field name (linuxCapabilities should be capabilities). Option D drops NET_ADMIN, which would remove the required capability.

Answer

linuxCapabilities:
  add: ["NET_ADMIN"]

Answer

capabilities:
  drop: ["NET_ADMIN"]

Question 10

Which flag is used to restrict the kubelet's ability to modify node status and pods?

Accepted Answer

--authorization-mode=Webhook. None of the listed kubelet flags restricts the kubelet's ability to modify node status and pods. The restriction is implemented by the NodeRestriction admission controller on the Kubernetes API server, not by a kubelet flag. The kubelet flag --authorization-mode=Webhook only enables external webhook authorization for requests to the kubelet's own API; it does not enforce NodeRestriction-like limits on node or pod modifications.

Answer

--read-only-port=0

Answer

--protect-kernel-defaults=true

Answer

--authentication-token-webhook=true