CKS Practice Test 21 — 15 Questions

Question 1

Which of the following is the correct way to disable swap on a Kubernetes node to improve security?

Accepted Answer

Run 'swapoff -a' and remove swap entry from /etc/fstab. Disabling swap is a prerequisite for Kubernetes nodes to ensure kubelet works correctly with memory management and resource isolation. Running 'swapoff -a' disables all active swap devices immediately, and removing the swap entry from /etc/fstab prevents swap from being re-enabled after a reboot. This is the standard and complete method recommended by Kubernetes documentation for system hardening.

Answer

Set kernel parameter 'vm.swappiness=0'

Answer

Run 'systemctl stop swap'

Answer

Run 'kubelet --disable-swap'

Question 2

Which ONE of the following is a valid Rego policy construct used in OPA Gatekeeper ConstraintTemplates to enforce security policies?

Accepted Answer

violation[{"msg": msg}] { condition }. In OPA Gatekeeper ConstraintTemplates, the only Rego construct that directly triggers a constraint violation is `violation[{"msg": msg}] { condition }`. When the condition evaluates to true, Gatekeeper generates a violation message. The `allow` and `deny` rules are not standard constructs for enforcing constraints in Gatekeeper; they are general Rego rules used in other OPA contexts but not within ConstraintTemplates to report violations. Options D (`audit`) and E (`warn`) are also not valid Rego constructs for Gatekeeper constraints.

Answer

allow { condition }

Answer

deny[{"msg": msg}] { condition }

Answer

audit { condition }

Answer

warn[{"msg": msg}] { condition }

Question 3

A pod uses a Secret mounted as a volume. The Secret is updated. How can the pod consume the updated values without restarting?

Accepted Answer

The mounted volume is automatically updated over time. When a Secret is mounted as a volume in Kubernetes, the kubelet periodically syncs the secret data from the API server and updates the files in the volume. This means the pod can consume the updated values without needing a restart, as the files are refreshed automatically (with a default sync period of around 60 seconds). Option C correctly identifies this behavior.

Answer

Use a sidecar container that watches for changes and reloads the application

Answer

Update the pod spec to reference a new Secret version

Answer

Delete and recreate the pod

Question 4

You need to sign a container image using cosign with a key stored in an environment variable. Which command should you use?

Accepted Answer

cosign sign --key env://COSIGN_PRIVATE_KEY myimage:latest. `cosign sign --key env://COSIGN_PRIVATE_KEY` instructs Cosign to read the private key from the environment variable named `COSIGN_PRIVATE_KEY` using the `env://` URI scheme. This is the standard way to reference a key stored in an environment variable, avoiding exposure on the command line or in files.

Answer

cosign sign myimage:latest --key cosign.pub

Answer

cosign sign --key $COSIGN_PRIVATE_KEY myimage:latest

Answer

cosign sign --key file://cosign.key myimage:latest

Question 5

You need to drop all Linux capabilities from a container. Which YAML snippet is correct?

Accepted Answer

securityContext: { capabilities: { drop: ["ALL"] } }. In Kubernetes, to drop Linux capabilities from a container, you must use the `capabilities.drop` field inside `securityContext`. Option D correctly nests `capabilities` under `securityContext`. Option B is incorrect because it places `capabilities` directly under the container spec without the `securityContext` wrapper, which is not valid in most Kubernetes API versions. Options A and C use invalid keywords (`remove` and `none`). Therefore, only Option D is correct.

Answer

capabilities: { remove: ["ALL"] }

Answer

capabilities: { drop: ["ALL"] }

Answer

capabilities: { none: true }

Question 6

You are creating a ServiceAccount that should not automatically mount its token to pods. Which field should be set in the ServiceAccount manifest?

Accepted Answer

automountServiceAccountToken: false. The `automountServiceAccountToken` field in a ServiceAccount manifest, when set to `false`, prevents pods using that ServiceAccount from automatically mounting the service account token as a volume. This is a security hardening measure to reduce the attack surface in case a pod is compromised, as the token could be used to authenticate to the Kubernetes API server.

Answer

disableAutomount: true

Answer

tokenMountDisabled: true

Answer

mountToken: false

Question 7

A security admin wants to ensure that only images signed with a specific key can run in the cluster. Which admission controller should be enabled?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller allows a cluster to enforce that only container images signed with a specific key can run. It intercepts pod creation requests and queries an external webhook to verify the image signature before admitting the pod. This directly meets the requirement of restricting execution to signed images.

Answer

PodSecurityPolicy

Answer

MutatingAdmissionWebhook

Answer

ValidatingAdmissionWebhook

Question 8

A pod is failing with status 'CrashLoopBackOff'. The pod manifest includes a liveness probe that runs every 10 seconds. You suspect the probe is causing the crash. Which command would you use to verify the liveness probe configuration?

Accepted Answer

kubectl describe pod . `kubectl describe pod ` displays the pod's full configuration, including the liveness probe's exact parameters (e.g., initialDelaySeconds, periodSeconds, failureThreshold, and the probe action like HTTP GET, TCP socket, or exec command). This allows you to verify if the probe is misconfigured (e.g., too aggressive or pointing to a non-existent endpoint) and causing the CrashLoopBackOff.

Answer

kubectl logs <pod>

Answer

kubectl exec <pod> -- cat /etc/kubernetes/manifests/pod.yaml

Answer

kubectl get pod <pod> -o yaml

Question 9

An admin runs 'kubectl run test-pod --image=busybox --command -- sleep 3600' and then executes 'kubectl exec test-pod -- cat /var/run/secrets/kubernetes.io/serviceaccount/token'. The admin wants to prevent such access to the service account token. What is the correct action?

Accepted Answer

Set automountServiceAccountToken: false in the pod spec. Setting `automountServiceAccountToken: false` in the pod spec prevents the automatic mounting of the service account token into the container's filesystem. By default, Kubernetes mounts a token at `/var/run/secrets/kubernetes.io/serviceaccount/token`, which can be read via `kubectl exec` as shown. Disabling this mount blocks direct access to the token from within the pod, mitigating the risk of token theft or misuse.

Answer

Remove the service account from the pod

Answer

Set securityContext.runAsNonRoot: true

Answer

Use a NetworkPolicy to block access to the API server

Question 10

You need to encrypt secrets at rest in a Kubernetes cluster. What must be configured?

Accepted Answer

Create an EncryptionConfiguration object in the cluster and pass it to kube-apiserver via --encryption-provider-config. Kubernetes encrypts secrets at rest by defining an EncryptionConfiguration object that specifies which encryption providers (e.g., AES-CBC, secretbox, or KMS) to use, and then passing the configuration file to the kube-apiserver via the `--encryption-provider-config` flag. This ensures that when the API server writes secrets to etcd, they are encrypted before storage, and decrypted on read, meeting the requirement for encrypting secrets at rest.

Answer

Set the environment variable ENCRYPT_SECRETS=true on the kube-controller-manager

Answer

Use a MutatingWebhookConfiguration to encrypt secrets before storage

Answer

Enable the 'SecretEncryption' feature gate on all control plane components

Question 11

A security team suspects a compromised pod is making unexpected outbound connections to an external IP. Which of the following is the BEST first step to investigate the network traffic from that pod?

Accepted Answer

Run 'kubectl exec <pod> -- tcpdump -i eth0' to capture packets. The best first step to investigate unexpected outbound connections from a pod is to capture live network traffic from within the pod using tcpdump. This provides immediate visibility into the actual packets being sent, including destination IPs, ports, and payloads, which is essential for confirming the compromise and identifying the external endpoint. Other options are either reactive (blocking) or less direct.

Answer

Deploy Falco with a rule to detect outbound connections

Answer

Create a NetworkPolicy to deny all egress traffic

Answer

Check the pod's logs using 'kubectl logs <pod>'

Question 12

A development team uses a custom container image for their application, built from a base image that includes multiple CVEs. The security team requires that no container runs with known critical vulnerabilities. Which approach best ensures that only images with no critical vulnerabilities are deployed in production?

Accepted Answer

Integrate an image scanner (e.g., Trivy) into the CI/CD pipeline to block builds with critical vulnerabilities.. Integrating an image scanner like Trivy into the CI/CD pipeline ensures that any image with critical vulnerabilities is blocked before it is even built or pushed to a registry. This shift-left approach prevents vulnerable images from ever reaching the production environment, aligning with the security team's requirement to deploy only images with no critical vulnerabilities.

Answer

Configure a Kubernetes admission controller (e.g., Kyverno) to reject pods using images with critical vulnerabilities.

Answer

Scan the base image before building the application image.

Answer

Manually review vulnerability reports after the image is deployed.

Question 13

A company uses kube-bench to scan their cluster. The report shows a warning: 'Ensure that the --authorization-mode argument is set to Node,RBAC'. What is the best way to fix this?

Accepted Answer

Edit the kube-apiserver manifest to add --authorization-mode=Node,RBAC. Kube-bench checks that the API server's `--authorization-mode` includes both `Node` and `RBAC` in that order. The `Node` authorizer must come first to handle node-specific requests efficiently, followed by `RBAC` for user and service account authorization. Editing the kube-apiserver manifest (typically `/etc/kubernetes/manifests/kube-apiserver.yaml`) to add `--authorization-mode=Node,RBAC` ensures the static pod is automatically restarted by the kubelet with the correct configuration.

Answer

Add --authorization-mode=AlwaysDeny to the API server

Answer

Restart the API server with --authorization-webhook-config-file

Answer

Set --authorization-mode=RBAC only

Question 14

A security team wants to automatically reject any Pod that uses an image tagged with 'latest'. Which tool can be used to define this policy at the admission level?

Accepted Answer

OPA/Gatekeeper. OPA/Gatekeeper is the correct tool because it allows you to define and enforce custom admission control policies via ConstraintTemplates and Constraints. You can create a policy that rejects any Pod using an image tagged with 'latest' by inspecting the `spec.containers[].image` field at admission time, which is not possible with native Kubernetes resources.

Answer

ResourceQuota

Answer

NetworkPolicy

Answer

PodSecurityPolicy (PSP)

Question 15

Which THREE of the following are restrictions enforced by the 'baseline' Pod Security Standard? (Select three.)

Accepted Answer

Host network access (hostNetwork) is not allowed. The 'baseline' Pod Security Standard (PSS) enforces several restrictions to provide a reasonable level of security without breaking most workloads. The three correct restrictions are:

- A: Host network access (hostNetwork) is not allowed. The baseline profile prohibits sharing host namespaces, including hostNetwork, to isolate pods from the host network.
- B: Capabilities must be limited to a minimal set. While the baseline profile does not require dropping all capabilities (drop: ["ALL"]), it prohibits adding dangerous capabilities such as CAP_SYS_ADMIN, CAP_NET_RAW, or CAP_SYS_PTRACE. This prevents escalation of privileges through capability misuse.
- D: Privilege escalation must be disabled (AllowPrivilegeEscalation: false). This is a baseline requirement to prevent processes from gaining more privileges than their parent.

Option C (seccomp profile must be set to RuntimeDefault or Localhost) and Option E (containers must run as non‑root) are both requirements of the 'restricted' profile, not the baseline. Therefore, they are incorrect selections.

Answer

Seccomp profile must be set to RuntimeDefault or Localhost

Answer

Containers must run as non-root (runAsNonRoot: true)