CKS Practice Test 16 — 15 Questions

Question 1

A DevOps engineer wants to ensure that all microservice containers run with a read-only root filesystem to prevent unauthorized writes. What is the simplest way to enforce this at the Pod level?

Accepted Answer

Set `securityContext.readOnlyRootFilesystem: true` in the Pod spec. Setting `securityContext.readOnlyRootFilesystem: true` in the Pod spec directly enforces that the container's root filesystem is read-only, preventing any unauthorized writes to the root filesystem. This is the simplest and most direct way to achieve the requirement at the Pod level, as it applies to all containers in the Pod unless overridden at the container level.

Answer

Set `securityContext.runAsNonRoot: true` in the Pod spec

Answer

Mount an emptyDir volume to the container's writable directories

Answer

Set `securityContext.privileged: false` in the Pod spec

Question 2

An administrator runs 'kubectl describe pod secure-pod' and sees that the pod is in a Pending state with the event 'Error: ImagePullBackOff' and the message 'unauthorized: authentication required'. The image is stored in a private registry. What is the most likely cause?

Accepted Answer

Missing imagePullSecret in the pod spec or in the namespace's default service account. The error 'unauthorized: authentication required' indicates that the kubelet cannot authenticate to the private registry. Kubernetes requires an imagePullSecret, which contains registry credentials (typically a Docker config JSON), to be attached either directly to the pod spec or to the namespace's default service account. Without this secret, the kubelet cannot pull the image, resulting in the ImagePullBackOff state.

Answer

The registry requires TLS 1.3 but the kubelet uses TLS 1.2

Answer

The image tag is misspelled

Answer

The registry hostname is not resolvable

Question 3

Which THREE of the following are required to configure encryption of secrets at rest in Kubernetes?

Accepted Answer

Specifying an encryption provider such as `aescbc` in the EncryptionConfiguration. The `aescbc` encryption provider is one of the supported providers in Kubernetes for encrypting secrets at rest. Specifying it in the `EncryptionConfiguration` tells the kube-apiserver which encryption algorithm to use when writing data to etcd. Without a provider like `aescbc`, secrets are stored in plaintext in etcd.

Answer

Running `kubectl get secrets --all-namespaces -o yaml | kubectl apply -f -` to rewrite existing secrets

Answer

Modifying the etcd configuration to enable encryption at rest

Question 4

Which of the following is a best practice for securing container images?

Accepted Answer

Use minimal base images like distroless or Alpine. Using minimal base images like distroless or Alpine significantly reduces the attack surface by eliminating unnecessary packages, libraries, and utilities that could contain vulnerabilities. Distroless images contain only the application and its runtime dependencies, while Alpine uses musl libc and BusyBox to keep the image size small and minimize the number of Common Vulnerabilities and Exposures (CVEs) that need to be patched.

Answer

Hardcode passwords in Dockerfile as environment variables for convenience

Answer

Use the latest tag for base images to get the newest features

Answer

Run containers as root to simplify permission management

Question 5

You want to allow only images from a specific registry (e.g., myregistry.io) to be deployed in your cluster. Which tool or approach is best suited for this requirement?

Accepted Answer

Use OPA/Gatekeeper to create a constraint that checks the image registry. OPA/Gatekeeper allows you to define a ConstraintTemplate and a Constraint that validates the image registry in pod specs via a Rego rule. This approach enforces admission control at the API server level, rejecting any pod that references an image from an unauthorized registry before it is persisted in etcd.

Answer

Set up a NetworkPolicy to block traffic from other registries

Answer

Configure an ImagePolicyWebhook

Answer

Modify the kubelet configuration to only pull from a specific registry

Question 6

Which THREE of the following are recommended practices for minimizing microservice vulnerabilities related to container security?

Accepted Answer

Set securityContext.runAsNonRoot: true. Setting `securityContext.runAsNonRoot: true` forces the container to run with a user ID (UID) other than 0 (root). This is a critical defense-in-depth measure because if an attacker exploits a vulnerability in the application or runtime, they will not gain root privileges on the host, limiting the blast radius. It enforces the principle of least privilege at the container level, and Kubernetes will reject the pod if the container image attempts to run as root.

Answer

Set high CPU requests to ensure performance

Answer

Expose secrets as environment variables for convenience

Question 7

Order the steps to configure and use Falco for runtime security in a Kubernetes cluster.

Accepted Answer

Install Falco, then configure rules, then deploy as DaemonSet, then monitor alerts, then tune rules. Falco installation, configuration, deployment as DaemonSet, monitoring alerts, and tuning are the key steps.

Answer

Install Falco, then deploy as DaemonSet, then configure rules, then monitor alerts, then tune rules

Answer

Install Falco, then configure rules, then monitor alerts, then deploy as DaemonSet, then tune rules

Answer

Install Falco, then tune rules, then configure rules, then deploy as DaemonSet, then monitor alerts

Question 8

Order the steps to rotate a Kubernetes API server certificate.

Accepted Answer

1. Generate a new certificate and key pair for the API server. 2. Replace the existing certificate files on the control plane node. 3. Restart the kube-apiserver process or container. 4. Verify the new certificate is serving correctly using curl or openssl.. Certificate rotation involves generating new certs, replacing files, restarting the service, and verifying. Kubeconfig updates may be needed if CA changes.

Answer

1. Restart the kube-apiserver process. 2. Generate a new certificate. 3. Replace the old certificates. 4. Verify.

Answer

1. Replace the existing certificate files. 2. Generate a new certificate. 3. Restart the API server. 4. Verify.

Answer

1. Generate new certificate. 2. Replace old files. 3. Verify using curl. 4. Restart API server.

Question 9

You are a security engineer at a fintech startup. The company runs a Kubernetes cluster in production with hundreds of microservices. Recently, a container image from a public registry was compromised, and the attacker injected a backdoor that exfiltrated customer data. The CISO mandates that all images must come from an internal registry that only stores approved, scanned, and signed images. Currently, developers build images locally and push them to Docker Hub, then reference those images in Kubernetes manifests. You have deployed Harbor as a private registry with vulnerability scanning and Cosign for signing. However, you notice that some pods are still running images directly from Docker Hub. You need to enforce that only images from your internal Harbor registry can be used in the cluster. You cannot change the Kubernetes manifests immediately because of a large backlog. You have access to the cluster's kubelet configuration and can modify cluster-level components. Which single action will most effectively block any pod that tries to use an image not hosted on your internal registry?

Accepted Answer

Configure the containerd configuration on each node to use Harbor as a mirror for all registries and set endpoint to Harbor only, disabling direct pull from public registries.. Configuring containerd to use Harbor as a mirror for all registries and setting the endpoint to Harbor only effectively blocks pulls from any external registry at the container runtime level. This approach works even if Kubernetes manifests reference Docker Hub images, as the kubelet will redirect all image pull requests to the internal Harbor registry, preventing direct pulls from public registries. It enforces the policy without requiring immediate changes to existing manifests, which aligns with the constraint of not modifying them due to a large backlog. Option D (admission webhook) would require either modification of existing manifests or the webhook to deny pods that do not use the internal registry, but since manifests cannot be changed immediately, this would not affect already running pods unless they are recreated, making it less effective than runtime configuration. Option B (NetworkPolicy) only blocks network traffic but does not prevent the kubelet from pulling images from Docker Hub if the registry is reachable via a different path, and cached images can still be used.

Answer

Enforce a PodSecurityStandard that restricts containers from running with root privileges.

Answer

Apply a Kubernetes NetworkPolicy that blocks egress traffic from nodes to Docker Hub.

Answer

Deploy an admission webhook (e.g., OPA/Gatekeeper) that denies pods whose image registry is not the internal Harbor.

Question 10

A security auditor runs kube-bench on your cluster and reports that the apiserver is using default service account tokens. Which admission plugin should be enabled to address this?

Accepted Answer

PodSecurity. (PodSecurity) because the PodSecurity admission plugin (replacing the deprecated PodSecurityPolicy) enforces a restricted security context on pods, preventing them from automatically mounting the default service account token. By default, Kubernetes mounts a service account token into every pod, which can be exploited if an attacker gains access to a pod. Enabling PodSecurity with a policy that restricts automounting of service account tokens addresses the kube-bench finding.

Answer

DefaultStorageClass

Answer

NodeRestriction

Answer

ServiceAccount

Question 11

What is the purpose of the Kubernetes Dashboard?

Accepted Answer

To provide a web-based user interface for deploying and managing applications. The Kubernetes Dashboard is a web-based user interface that allows users to deploy containerized applications to a Kubernetes cluster, troubleshoot them, and manage the cluster resources. It provides a graphical alternative to the kubectl command-line tool, enabling operations such as viewing workloads, scaling deployments, and editing resources through a browser.

Answer

To provide a command-line interface for cluster management

Answer

To monitor cluster performance metrics

Answer

To enforce security policies on the cluster

Question 12

A pod spec includes 'hostPID: true' and 'hostNetwork: true'. What security concern does this raise?

Accepted Answer

The container can see all host processes and access the host network namespace, increasing the risk of privilege escalation. Setting `hostPID: true` allows the container to see all processes running on the host, which can leak sensitive information and enable process injection. Setting `hostNetwork: true` gives the container direct access to the host's network namespace, bypassing network policies and potentially allowing the container to bind to privileged ports or sniff traffic. Together, these settings significantly increase the attack surface and risk of privilege escalation or host compromise.

Answer

The container can use the host's GPU and other devices

Answer

The container can read and write to the host filesystem

Answer

The container cannot use a securityContext

Question 13

You are tasked with enabling audit logging for the Kubernetes API server. You have created an audit policy file at /etc/kubernetes/audit-policy.yaml. Which flag must be added to the API server manifest to enable audit logging?

Accepted Answer

--audit-log-path=/var/log/kubernetes/audit.log. The `--audit-log-path` flag is required to enable audit logging in the Kubernetes API server. Without specifying a log path, the API server will not write audit events to a file, even if an audit policy is defined. The `--audit-policy-file` flag (Option A) defines the rules for what to audit, but audit logging itself is only activated when a log destination is provided via `--audit-log-path`.

Answer

--audit-policy-file=/etc/kubernetes/audit-policy.yaml

Answer

--audit-log-level=2

Answer

--enable-audit-log

Question 14

You need to create a NetworkPolicy that denies all ingress traffic to pods with label 'app: web' in the 'frontend' namespace, except for traffic from pods with label 'app: ingress' in the 'ingress' namespace. Which NetworkPolicy spec correctly achieves this?

Accepted Answer

ingress:
- from:
  - namespaceSelector:
      matchLabels:
        kubernetes.io/metadata.name: ingress
    podSelector:
      matchLabels:
        app: ingress. It uses a single `from` entry with both a `namespaceSelector` (matching the `ingress` namespace by its `kubernetes.io/metadata.name` label) and a `podSelector` (matching pods with `app: ingress`). This combination restricts ingress traffic to only pods that are both in the `ingress` namespace AND have the label `app: ingress`, while implicitly denying all other ingress traffic to pods labeled `app: web` in the `frontend` namespace.

Answer

ingress:
- from:
  - namespaceSelector:
      matchLabels:
        name: ingress
    podSelector:
      matchLabels:
        app: ingress

Answer

ingress:
- from:
  - namespaceSelector:
      matchLabels:
        app: ingress
    podSelector: {}

Answer

ingress:
- from:
  - podSelector:
      matchLabels:
        app: ingress
  - namespaceSelector:
      matchLabels:
        kubernetes.io/metadata.name: ingress

Question 15

Which admission plugin should be enabled on the API server to enforce that kubelet cannot modify nodes other than its own?

Accepted Answer

NodeRestriction. The NodeRestriction admission plugin ensures that a kubelet can only modify its own Node object and Pods bound to it. This prevents a compromised or misconfigured kubelet from tampering with other nodes, enforcing the principle of least privilege. Without this plugin, a kubelet could potentially update labels, taints, or status on any node, leading to cluster instability or privilege escalation.

Answer

NodeSelector

Answer

PodSecurity

Answer

AlwaysPullImages