CKS Practice Exam 1 — 20 Questions

Question 1

Arrange the steps to configure and use kube-bench to audit a Kubernetes cluster's security.

Accepted Answer

Install kube-bench, then run kube-bench against the cluster, then review audit results, then apply remediation, then re-run kube-bench to verify.. kube-bench audits CIS benchmarks. After installation, run it, analyze results, remediate, and re-audit.

Answer

Run kube-bench against the cluster, then review audit results, then install kube-bench, then apply remediation, then re-run kube-bench to verify.

Answer

Install kube-bench, then review audit results, then run kube-bench against the cluster, then apply remediation, then re-run kube-bench to verify.

Answer

Install kube-bench, then run kube-bench against the cluster, then apply remediation, then review audit results, then re-run kube-bench to verify.

Question 2

Arrange the steps to create and enforce a Pod Security Policy (PSP) in a Kubernetes cluster.

Accepted Answer

Enable the PodSecurityPolicy admission controller, create a PodSecurityPolicy resource, grant RBAC access to the policy, and verify enforcement by testing a pod.. PSPs require enabling the admission controller, creating the policy, granting access via RBAC, and binding to subjects. Testing confirms enforcement.

Answer

Create a PodSecurityPolicy resource, enable the PodSecurityPolicy admission controller, grant RBAC access, and verify enforcement.

Answer

Grant RBAC access to the PodSecurityPolicy, enable the admission controller, create the policy, and verify enforcement.

Answer

Enable the PodSecurityPolicy admission controller, create a PodSecurityPolicy resource, verify enforcement, and grant RBAC access.

Question 3

Which of the following is the correct kubectl command to view the OPA Gatekeeper ConstraintTemplates in the cluster?

Accepted Answer

kubectl get constrainttemplates. OPA Gatekeeper registers its constraints as custom resources in Kubernetes, and the standard `kubectl get constrainttemplates` command retrieves all ConstraintTemplate resources from the cluster. This works because Gatekeeper uses the Kubernetes API aggregation layer, making ConstraintTemplates a top-level resource type that kubectl can query directly.

Answer

kubectl get gatekeeper-constrainttemplates

Answer

kubectl describe opa constrainttemplate

Answer

kubectl get crd -o name | grep constraint

Question 4

An administrator wants to prevent a container from accessing the host's network. Which pod security context field should be set to false?

Accepted Answer

hostNetwork. The `hostNetwork` field in the Pod Security Context, when set to `true`, allows the container to use the host's network namespace directly, bypassing the pod's own network stack. Setting it to `false` (the default) ensures the container uses an isolated network namespace, preventing direct access to host network interfaces, iptables rules, and network services. This is the correct field to disable to meet the requirement of preventing container access to the host's network.

Answer

hostIPC

Answer

privileged

Answer

hostPID

Question 5

You are creating a ServiceAccount that should not automatically mount its token to pods. Which field should be set in the ServiceAccount manifest?

Accepted Answer

automountServiceAccountToken: false. The `automountServiceAccountToken` field in a ServiceAccount manifest, when set to `false`, prevents pods using that ServiceAccount from automatically mounting the service account token as a volume. This is a security hardening measure to reduce the attack surface in case a pod is compromised, as the token could be used to authenticate to the Kubernetes API server.

Answer

disableAutomount: true

Answer

tokenMountDisabled: true

Answer

mountToken: false

Question 6

Which THREE of the following are required to implement a secure software supply chain using Kubernetes native features?

Accepted Answer

Use vulnerability scanning tools like Trivy or Grype in the CI/CD pipeline.. Vulnerability scanning tools like Trivy or Grype are essential for identifying known CVEs in container images before deployment. Integrating these tools into the CI/CD pipeline ensures that only images with an acceptable vulnerability posture are built and pushed to the registry, forming a foundational security gate in the software supply chain.

Answer

Disable admission controllers to reduce latency in pod creation.

Answer

Run all containers as root inside the pod to avoid permission issues.

Question 7

Which TWO of the following are valid methods to secure the etcd datastore in a Kubernetes cluster?

Accepted Answer

Enable TLS encryption for client-to-server communication.. Enabling TLS encryption for client-to-server communication ensures that all data transmitted between etcd clients (such as the Kubernetes API server) and the etcd server is encrypted, preventing eavesdropping and man-in-the-middle attacks. This is a fundamental security measure for protecting sensitive cluster state and secrets stored in etcd.

Answer

Use HTTP instead of HTTPS for better performance.

Answer

Disable client authentication to simplify configuration.

Answer

Expose the etcd port (2379) on a public IP for easier monitoring.

Question 8

An admin has created an EncryptionConfiguration to encrypt secrets at rest in etcd. After applying the configuration and restarting the kube-apiserver, existing secrets are still stored in plaintext. What is the most likely reason?

Accepted Answer

Existing secrets are not automatically encrypted; they need to be rewritten by reading and writing them back. Kubernetes does not automatically encrypt existing secrets stored in etcd when an EncryptionConfiguration is applied. The encryption configuration only affects data written after the kube-apiserver is restarted; previously stored secrets remain in plaintext until they are read and rewritten (e.g., by running `kubectl get secret <name> -o yaml | kubectl replace -f -`). This behavior is by design, as the API server encrypts data on write, not retroactively.

Answer

The encryption provider is set to 'identity' which does not encrypt

Answer

The kube-apiserver was not restarted after applying the configuration

Answer

The EncryptionConfiguration has a syntax error that caused it to be ignored

Question 9

Which TWO of the following are recommendations from the CIS Kubernetes Benchmark?

Accepted Answer

Enable audit logging. The CIS Kubernetes Benchmark recommends enabling audit logging to record all API server requests, which is essential for security monitoring and forensic analysis. It also recommends disabling anonymous authentication to ensure that all requests are authenticated, preventing unauthenticated access to the cluster.

Answer

Use TokenReview API for authentication

Answer

Set --protect-kernel-defaults=false on kubelet

Answer

Enable the insecure port for kubelet

Question 10

Which THREE of the following are valid flags for enabling admission plugins on the API server?

Accepted Answer

--enable-admission-plugins=AlwaysPullImages. `--enable-admission-plugins=AlwaysPullImages` is the valid flag to enable the AlwaysPullImages admission plugin on the kube-apiserver. This flag accepts a comma-separated list of plugin names, and AlwaysPullImages is a built-in admission controller that forces every new Pod to pull images again, even if they already exist on the node, enhancing security by ensuring only authorized images are used.

Answer

--plugin-dir=/admission

Answer

--admission-control=NodeRestriction

Question 11

You are using `crictl` to debug a container that is not responding. Which command should you use to get the list of running containers?

Accepted Answer

crictl ps. `crictl ps` is the correct command because it lists running containers managed by the CRI-compatible runtime (e.g., containerd, CRI-O). This is analogous to `docker ps` but for the Kubernetes container runtime interface, allowing you to see container IDs, names, and statuses for debugging.

Answer

crictl pods

Answer

crictl images

Answer

crictl stats

Question 12

You are securing etcd. Which of the following is required to enable TLS client authentication for etcd?

Accepted Answer

Set --client-cert-auth to true and provide --trusted-ca-file. Etcd requires `--client-cert-auth=true` to enforce TLS client certificate authentication for incoming client requests, and `--trusted-ca-file` must be provided to specify the CA certificate used to validate client certificates. Without both, client certificate authentication is not enabled.

Answer

Set --auto-tls to true

Answer

Set --peer-client-cert-auth to true

Answer

Use --cert-file and --key-file only

Question 13

A security team wants to ensure that all API requests to the cluster are authenticated and uses RBAC for authorization. Which two flags must be set on the kube-apiserver?

Accepted Answer

--anonymous-auth=false --authorization-mode=RBAC. Setting --anonymous-auth=false disables unauthenticated requests, ensuring all API calls require authentication, and --authorization-mode=RBAC enforces Role-Based Access Control for authorization. This combination aligns with the security team's requirement for authenticated and RBAC-authorized API requests, as RBAC is the standard Kubernetes authorization mode for fine-grained access control.

Answer

--anonymous-auth=false --authorization-mode=Webhook

Answer

--enable-admission-plugins=NodeRestriction --authorization-mode=AlwaysAllow

Answer

--anonymous-auth=true --authorization-mode=ABAC

Question 14

You are responding to a security incident where a pod named `compromised-pod` in namespace `default` is suspected of being used for cryptocurrency mining. You need to immediately isolate the pod from the network while preserving evidence. Which command sequence should you use?

Accepted Answer

kubectl label pod compromised-pod isolated=true && kubectl apply -f networkpolicy.yaml. The correct approach is to label the pod and apply a deny-all NetworkPolicy that selects pods with that label. This immediately isolates the pod from all network traffic while preserving the pod for forensic analysis. The command sequence is: kubectl label pod compromised-pod isolated=true && kubectl apply -f networkpolicy.yaml where the networkpolicy.yaml defines an ingress/egress deny-all policy for pods with label isolated=true.

Answer

kubectl cordon <node-of-compromised-pod>

Answer

kubectl delete pod compromised-pod && kubectl describe pod compromised-pod

Answer

kubectl exec compromised-pod -- killall miner-process

Question 15

Which command loads an AppArmor profile from a file into the kernel?

Accepted Answer

apparmor_parser -r /path/to/profile. The `apparmor_parser` command loads AppArmor profiles into the kernel. The `-r` flag replaces an existing profile with the one from the specified file, ensuring the kernel enforces the updated rules. This is the standard method to load or reload AppArmor profiles from a profile file.

Answer

aa-enforce /path/to/profile

Answer

aa-status

Answer

modprobe apparmor

Question 16

You need to enable audit logging for the Kubernetes API server to capture all requests at the RequestResponse level. Which flag should you add to the kube-apiserver configuration?

Accepted Answer

--audit-policy-file=/etc/kubernetes/audit-policy.yaml. Audit-policy-file. This flag specifies the path to the audit policy file, which defines the rules for auditing. The other options are incorrect: --audit-log-path only sets the log file location, not the audit level; --audit-webhook-config-file is for sending audit events to a webhook; and --authorization-mode controls RBAC, not audit logging. To capture requests at RequestResponse level, the audit policy must specify that level, and the --audit-policy-file flag is required.

Answer

--audit-webhook-config-file=/etc/kubernetes/audit-webhook.yaml

Answer

--audit-log-path=/var/log/audit.log

Answer

--authorization-mode=RBAC

Question 17

An administrator runs `kubectl exec -it nginx-pod -- sh` and inside the container runs `curl http://example.com`. This succeeds. However, the administrator wants to detect such outbound connections using Falco. Which syscall should Falco monitor to detect this network connection?

Accepted Answer

connect. The `connect` syscall is invoked when a client initiates an outbound TCP connection, such as when `curl http://example.com` is run inside the container. Falco monitors syscalls at the kernel level, and detecting `connect` allows it to capture the destination IP and port of the outbound request. This is the correct syscall to monitor for outbound network connections.

Answer

open

Answer

execve

Answer

bind

Question 18

Which THREE of the following are recommended actions to secure the Kubernetes Dashboard? (Choose three.)

Accepted Answer

Use RBAC to create a dedicated service account with minimal permissions. The Kubernetes Dashboard should be accessed using a dedicated service account with minimal permissions via RBAC. This follows the principle of least privilege, ensuring the dashboard only has the permissions necessary for its function, reducing the attack surface. By default, the dashboard's service account has minimal permissions, but binding it to a role with excessive privileges (like cluster-admin) would be a security risk.

Answer

Expose the Dashboard via an Ingress with a public domain

Answer

Enable HTTPS for Dashboard communications

Question 19

An etcd cluster is configured with TLS. You need to enforce that only the API server can read and write to etcd. Which method should you use?

Accepted Answer

Configure etcd RBAC with a role that grants readwrite access only to the API server's client certificate CN. Etcd supports Role-Based Access Control (RBAC) that can restrict access based on the Common Name (CN) in the client certificate. By creating a role with readwrite access and binding it only to the API server's client certificate CN, you ensure that only the API server can read and write to etcd, while other clients are denied.

Answer

Set etcd's --peer-client-cert-auth flag to true

Answer

Set etcd's --client-cert-auth flag to false

Answer

Use a NetworkPolicy to restrict access to etcd port 2379

Question 20

A pod spec includes 'hostPID: true' and 'hostNetwork: true'. What security concern does this raise?

Accepted Answer

The container can see all host processes and access the host network namespace, increasing the risk of privilege escalation. Setting `hostPID: true` allows the container to see all processes running on the host, which can leak sensitive information and enable process injection. Setting `hostNetwork: true` gives the container direct access to the host's network namespace, bypassing network policies and potentially allowing the container to bind to privileged ports or sniff traffic. Together, these settings significantly increase the attack surface and risk of privilege escalation or host compromise.

Answer

The container can use the host's GPU and other devices

Answer

The container can read and write to the host filesystem

Answer

The container cannot use a securityContext