CKS Practice Test 23 — 15 Questions

Question 1

Which of the following is a recommended practice for securing Kubernetes Dashboard?

Accepted Answer

Deploy Dashboard with minimal RBAC permissions and access it via kubectl proxy.. Deploying the Kubernetes Dashboard with minimal RBAC permissions and accessing it via `kubectl proxy` follows the principle of least privilege and avoids exposing the Dashboard to the network. `kubectl proxy` creates a local HTTP proxy to the Kubernetes API server, which authenticates the user's kubeconfig credentials, ensuring that only authorized users can reach the Dashboard and that the Dashboard itself has no direct network exposure.

Answer

Expose Dashboard using a NodePort service with a ClusterRole binding to cluster-admin.

Answer

Use a LoadBalancer service without authentication.

Answer

Disable HTTPS and expose Dashboard on port 80.

Question 2

Which kubectl command creates a Role named 'pod-reader' that allows only 'get', 'list', and 'watch' on pods in namespace 'ns1'?

Accepted Answer

kubectl create role pod-reader --verb=get,list,watch --resource=pods --namespace=ns1. The `kubectl create role` command creates a Role (namespaced resource) with the specified verbs and resources in the given namespace. The `--verb=get,list,watch` and `--resource=pods` flags define the exact permissions, and `--namespace=ns1` scopes the Role to that namespace, which matches the requirement.

Answer

kubectl create clusterrole pod-reader --verb=get,list,watch --resource=pods

Answer

kubectl create role pod-reader --verb=* --resource=pods --namespace=ns1

Answer

kubectl create rolebinding pod-reader --role=pod-reader --serviceaccount=ns1:default

Question 3

Which command loads an AppArmor profile from a file into the kernel?

Accepted Answer

apparmor_parser -r /path/to/profile. The `apparmor_parser` command loads AppArmor profiles into the kernel. The `-r` flag replaces an existing profile with the one from the specified file, ensuring the kernel enforces the updated rules. This is the standard method to load or reload AppArmor profiles from a profile file.

Answer

aa-enforce /path/to/profile

Answer

aa-status

Answer

modprobe apparmor

Question 4

A ClusterRoleBinding named 'admin-binding' binds the cluster-admin ClusterRole to a service account 'sa-admin' in namespace 'ns1'. What is the security concern?

Accepted Answer

The service account 'sa-admin' can access resources in all namespaces. A ClusterRoleBinding grants permissions cluster-wide, meaning the service account 'sa-admin' in namespace 'ns1' can access resources in all namespaces, not just its own. This violates the principle of least privilege by providing excessive access beyond the intended scope.

Answer

ClusterRoleBinding should be replaced by RoleBinding for cluster-scoped resources

Answer

The service account token is automatically mounted

Answer

ClusterRoleBinding should not be used for service accounts

Question 5

Which TWO of the following are valid modes for an AppArmor profile?

Accepted Answer

complain. AppArmor profiles operate in two primary modes: 'complain' (also known as 'learning' mode) and 'enforce' (also known as 'confined' mode). In complain mode, policy violations are logged but not blocked, allowing administrators to test and refine profiles. In enforce mode, violations are both logged and blocked, actively restricting the application's behavior according to the profile.

Answer

unconfined

Answer

permissive

Answer

audit

Question 6

An administrator wants to enable encryption at rest for secrets in a Kubernetes cluster. They create the following EncryptionConfiguration and place it at /etc/kubernetes/enc/enc.yaml. Which flag must be added to the kube-apiserver to use this configuration?

Accepted Answer

--encryption-provider-config=/etc/kubernetes/enc/enc.yaml. The kube-apiserver requires the `--encryption-provider-config` flag to specify the path to the EncryptionConfiguration YAML file. This flag tells the API server which encryption providers (e.g., `aescbc`, `secretbox`) to use for encrypting secrets at rest in etcd. Without this flag, the EncryptionConfiguration file is ignored and secrets remain unencrypted.

Answer

--feature-gates=EncryptionAtRest=true

Answer

--enable-encryption

Answer

--encryption-config=/etc/kubernetes/enc/enc.yaml

Question 7

Which THREE of the following are characteristics of container sandboxing runtimes like gVisor and Kata Containers?

Accepted Answer

They require setting spec.runtimeClassName in the pod spec. Container sandboxing runtimes like gVisor and Kata Containers are not the default runtime in Kubernetes. To use them, you must specify the runtime class name in the pod spec via `spec.runtimeClassName`. This field references a `RuntimeClass` resource that defines which container runtime (e.g., `gvisor`, `kata`) should be used for that pod, overriding the default runc runtime.

Answer

They eliminate the need for seccomp profiles

Answer

They share the host kernel directly

Question 8

Which TWO actions help minimize vulnerabilities in microservices by securing secrets? (Choose two)

Accepted Answer

Mount Secrets as volumes instead of environment variables. Mounting secrets as volumes is more secure than using environment variables. When secrets are injected as environment variables, they can be exposed through the process environment (e.g., via `/proc/self/environ` or `env` command) and are more likely to be accidentally logged or leaked. Mounting as a volume ensures the secret is only available as a file in the container's filesystem, and the secret data is not visible in the process list or environment dumps, reducing the attack surface.

Answer

Base64 encode the secret in the YAML manifest

Answer

Set the secret as a label on the pod

Answer

Store secrets in ConfigMaps to leverage ConfigMap encryption

Question 9

Which crictl command can you use to view the logs of a specific container?

Accepted Answer

crictl logs <container-id>. `crictl logs` is the dedicated command to retrieve and display the logs of a specific container managed by a CRI-compatible runtime (e.g., containerd, CRI-O). It works similarly to `docker logs` and reads the container's stdout/stderr streams, which are captured by the container runtime.

Answer

crictl inspect <container-id>

Answer

crictl exec <container-id> cat /var/log/syslog

Answer

crictl ps

Question 10

Which of the following flags should be set on the kube-apiserver to disable anonymous authentication?

Accepted Answer

--anonymous-auth=false. The kube-apiserver uses the `--anonymous-auth` flag to control anonymous requests. Setting `--anonymous-auth=false` explicitly disables anonymous authentication, meaning unauthenticated requests (those without a valid bearer token or client certificate) will be rejected with a 401 Unauthorized response. This is a critical hardening step to prevent unauthorized access to the Kubernetes API server.

Answer

--disable-anonymous-auth

Answer

--enable-anonymous-auth=false

Answer

--anonymous-auth=off

Question 11

Which kubectl command creates a valid webhook configuration that validates pods against a policy?

Accepted Answer

kubectl apply -f validatingwebhookconfiguration.yaml. A ValidatingWebhookConfiguration is the Kubernetes resource that intercepts API server requests to validate resources (e.g., pods) against an external policy before they are persisted. The command `kubectl apply -f validatingwebhookconfiguration.yaml` creates this configuration, which triggers a webhook call to an admission webhook server that returns an admission review with an 'allowed' or 'denied' decision.

Answer

kubectl apply -f webhookconfiguration.yaml

Answer

kubectl apply -f podpreset.yaml

Answer

kubectl apply -f mutatingwebhookconfiguration.yaml

Question 12

Which of the following is a valid way to check the status of AppArmor profiles on a node?

Accepted Answer

Run 'aa-status' on the node. `aa-status` is the standard command-line tool for checking the status of AppArmor profiles on a Linux node. It displays which profiles are loaded, which processes are confined, and the enforcement mode (enforce/complain). This is the direct, node-level utility for AppArmor status verification.

Answer

Use 'apparmor_parser --status'

Answer

Run 'kubectl get apparmorprofiles'

Answer

Read the file /sys/kernel/security/apparmor/profiles

Question 13

Which TWO admission plugins are recommended by the CIS benchmark to be enabled on the kube-apiserver? (Choose two.)

Accepted Answer

NodeRestriction. The CIS Benchmark for Kubernetes recommends enabling the NodeRestriction and ServiceAccount admission plugins on the kube-apiserver. NodeRestriction limits the Node identity's ability to modify Node and Pod objects, enforcing the principle of least privilege for kubelets. ServiceAccount ensures that every Pod is assigned a default ServiceAccount and that the token is automatically mounted, which is essential for secure pod-to-API-server communication.

Answer

AlwaysDeny

Answer

AlwaysAdmit

Answer

PodSecurityPolicy

Question 14

Which flag must be set on the kube-apiserver to disable anonymous authentication?

Accepted Answer

--anonymous-auth=false. The `--anonymous-auth=false` flag explicitly disables anonymous authentication on the kube-apiserver. By default, anonymous requests are allowed (the flag defaults to `true`), which can permit unauthenticated users to access the API server. Setting this flag to `false` ensures that all requests must present valid credentials, aligning with the principle of least privilege and hardening the cluster against unauthorized access.

Answer

--tls-cert-file=/etc/kubernetes/pki/apiserver.crt

Answer

--audit-log-path=/var/log/audit.log

Answer

--authorization-mode=RBAC

Question 15

Which TWO tools can be used to directly interact with a container runtime on a Kubernetes node without using kubectl?

Accepted Answer

ctr. crictl and ctr are CLI tools for interacting with CRI-compatible container runtimes. kubectl and docker are not available on nodes by default; docker is not always the runtime.

Answer

systemctl

Answer

kubectl

Answer

docker