CKS Practice Test 25 — 15 Questions

Question 1

A container is running with the following securityContext:

securityContext:
  capabilities:
    drop: ["ALL"]
    add: ["NET_BIND_SERVICE"]

Which capabilities will the container have?

Accepted Answer

Only NET_BIND_SERVICE. The securityContext first drops all capabilities with `drop: ["ALL"]`, which removes every capability from the container's bounding set. Then `add: ["NET_BIND_SERVICE"]` adds back only that single capability. Therefore, the final effective set is exactly `NET_BIND_SERVICE`, making option B correct.

Answer

All capabilities except NET_BIND_SERVICE

Answer

No capabilities

Answer

All default capabilities plus NET_BIND_SERVICE

Question 2

A CI/CD pipeline uses cosign attest to add an SBOM attestation to an image. Later, during deployment, which command verifies the attestation?

Accepted Answer

cosign verify-attestation --key cosign.pub myimage:latest. `cosign verify-attestation` is the specific command designed to verify an in-toto attestation (such as an SBOM) attached to a container image. It checks the signature on the attestation using the provided public key (`--key cosign.pub`) and validates that the attestation's payload matches the image digest, ensuring the SBOM was generated and signed by the trusted party.

Answer

cosign verify --key cosign.pub myimage:latest

Answer

cosign attest --key cosign.key --predicate sbom.json myimage:latest

Answer

cosign download attestation myimage:latest

Question 3

A Kubernetes cluster has Kyverno installed. A policy requires that all images come from a trusted registry 'trusted.example.com'. A Deployment uses the image 'nginx:latest'. When the Deployment is created, it is blocked. What Kyverno policy action is being used?

Accepted Answer

validate with failureAction: enforce. Kyverno's `validate` policy with `failureAction: enforce` is the mechanism that blocks resource creation when validation rules are violated. In this scenario, the policy checks that the image comes from `trusted.example.com`, and since `nginx:latest` does not match, the policy actively denies the Deployment, which is the behavior of `enforce` mode.

Answer

audit

Answer

mutate

Answer

generate

Question 4

Which tool can generate an SBOM for a container image?

Accepted Answer

Syft. Syft is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) for container images and filesystems. It scans the image layers and package managers (e.g., APT, RPM, pip, npm) to produce an SBOM in formats like CycloneDX or SPDX, directly addressing the question's requirement.

Answer

Trivy

Answer

Cosign

Answer

Kubescape

Question 5

Which TWO of the following are valid methods to ensure only signed images are deployed in a Kubernetes cluster?

Accepted Answer

Configure ImagePolicyWebhook to require signatures. The ImagePolicyWebhook admission controller can be configured to reject pods that reference images without valid signatures. It works by sending an admission review request to an external webhook service (e.g., using Cosign or Notary) that validates the image signature before allowing the pod to be created. This enforces signature verification at admission time, preventing unsigned images from running in the cluster.

Answer

Set imagePullPolicy: Always

Answer

Run 'cosign verify' manually before every deployment

Answer

Use NodeRestriction admission controller

Question 6

Which TWO of the following are valid ways to enforce that containers run with a read-only root filesystem?

Accepted Answer

Using a MutatingWebhookConfiguration that adds `readOnlyRootFilesystem: true` to all containers. A MutatingWebhookConfiguration can intercept Pod creation requests and automatically add the `readOnlyRootFilesystem: true` field to every container's securityContext, enforcing a read-only root filesystem without requiring manual changes to Pod specs. Option E is correct because setting `readOnlyRootFilesystem: true` directly in the container's securityContext is the explicit Kubernetes API field that makes the container's root filesystem read-only, preventing writes to the filesystem layer.

Answer

Setting `runAsNonRoot: true` in the pod's securityContext

Answer

Using an emptyDir volume mounted at /

Answer

Setting `fsGroup: 1000` in the pod's securityContext

Question 7

Which THREE of the following are recommended practices for hardening RBAC in a Kubernetes cluster? (Select 3)

Accepted Answer

Regularly audit ClusterRoleBindings and RoleBindings for over-privileged subjects.. Regular auditing of ClusterRoleBindings and RoleBindings helps identify over-privileged subjects, such as service accounts or users with excessive permissions, which is a key hardening practice. This aligns with the principle of least privilege and is recommended by Kubernetes security best practices to reduce the attack surface.

Answer

Use the default service account in each namespace with cluster-admin.

Answer

Use RoleBindings with ClusterRoles in the same namespace to increase security.

Question 8

You are securing etcd. Which of the following is required to enable TLS client authentication for etcd?

Accepted Answer

Set --client-cert-auth to true and provide --trusted-ca-file. Etcd requires `--client-cert-auth=true` to enforce TLS client certificate authentication for incoming client requests, and `--trusted-ca-file` must be provided to specify the CA certificate used to validate client certificates. Without both, client certificate authentication is not enabled.

Answer

Set --auto-tls to true

Answer

Set --peer-client-cert-auth to true

Answer

Use --cert-file and --key-file only

Question 9

Arrange the steps to configure and use kube-bench to audit a Kubernetes cluster's security.

Accepted Answer

Install kube-bench, then run kube-bench against the cluster, then review audit results, then apply remediation, then re-run kube-bench to verify.. kube-bench audits CIS benchmarks. After installation, run it, analyze results, remediate, and re-audit.

Answer

Run kube-bench against the cluster, then review audit results, then install kube-bench, then apply remediation, then re-run kube-bench to verify.

Answer

Install kube-bench, then review audit results, then run kube-bench against the cluster, then apply remediation, then re-run kube-bench to verify.

Answer

Install kube-bench, then run kube-bench against the cluster, then apply remediation, then review audit results, then re-run kube-bench to verify.

Question 10

A security auditor recommends enabling audit logging for the Kubernetes API server with a policy that logs all requests at the Metadata level. Which configuration ensures this requirement?

Accepted Answer

Create an audit policy file with 'level: Metadata' for all resources and pass it via --audit-policy-file. Kubernetes audit logging requires an audit policy file that defines the log level for different request stages and resources. The requirement to log all requests at the Metadata level is achieved by creating a policy file with `level: Metadata` for all resources (or a catch-all rule) and passing it to the API server via the `--audit-policy-file` flag. The audit policy file is the only mechanism to specify the log level (None, Metadata, Request, RequestResponse) per resource or stage.

Answer

Enable the 'Audit' admission plugin

Answer

Set --audit-log-level=Metadata

Answer

Use --audit-log-maxage=30 to retain logs

Question 11

Which command loads an AppArmor profile into the kernel?

Accepted Answer

apparmor_parser -r /path/to/profile. The `apparmor_parser` command is the standard tool for loading AppArmor profiles into the Linux kernel. The `-r` flag (replace) loads or reloads the specified profile file, merging it into the kernel's security policy. This is the correct method because AppArmor profiles are text files that must be parsed and loaded by the kernel's LSM (Linux Security Module) subsystem via this utility.

Answer

apparmor_load /path/to/profile

Answer

aa-load /path/to/profile

Answer

aa-status /path/to/profile

Question 12

Which THREE practices help ensure the integrity and confidentiality of container logs in a Kubernetes cluster?

Accepted Answer

Configure the log collector to use TLS when shipping logs to a central system.. Configuring the log collector to use TLS (e.g., Fluentd with TLS output plugin or Filebeat with SSL/TLS) encrypts log data in transit, preventing eavesdropping or tampering during shipping to a central system like Elasticsearch or Splunk. This directly protects confidentiality and integrity against man-in-the-middle attacks on the network path.

Answer

Set container 'stdout' logging only, avoiding file-based logs.

Answer

Disable log rotation to prevent log tampering during rotation.

Question 13

A cluster administrator wants to enforce that all pods in the 'restricted' namespace use the Restricted Pod Security Standard. Which command achieves this?

Accepted Answer

kubectl label ns restricted pod-security.kubernetes.io/enforce=restricted. The `kubectl label` command with the key `pod-security.kubernetes.io/enforce` and value `restricted` applies the Restricted Pod Security Standard to the namespace. This label instructs the Pod Security Admission controller to enforce the most restrictive policy, rejecting any pod that violates the standard. The command targets the namespace 'restricted' as required.

Answer

kubectl annotate ns restricted pod-security.kubernetes.io/restricted=restricted

Answer

kubectl label ns restricted pod-security.kubernetes.io/enforce=privileged

Answer

kubectl create podsecuritypolicy restricted --namespace restricted

Question 14

A security engineer wants to ensure that only images signed with a specific key are allowed to run in the cluster. Which tool can be used to sign container images?

Accepted Answer

cosign. Cosign is the correct tool because it is specifically designed for signing and verifying container images using cryptographic keys, integrating directly with OCI-compliant registries. It supports keyless signing via Fulcio and transparency logs via Rekor, making it the standard choice for enforcing image signature verification in Kubernetes admission controllers like Kyverno or OPA.

Answer

kubesec

Answer

syft

Answer

trivy

Question 15

An audit policy is configured with the following rule:
- level: RequestResponse
  users: ["system:serviceaccount:kube-system:admin"]
  verbs: ["get", "list"]
  resources:
  - group: ""
    resources: ["secrets"]
What will be logged when the service account 'admin' in kube-system performs a GET request on a Secret?

Accepted Answer

The request and response metadata and body will be logged. The audit rule specifies `level: RequestResponse`, which instructs the API server to log both the request metadata and body, as well as the response metadata and body, for matching events. The rule matches the service account `system:serviceaccount:kube-system:admin` performing a GET on secrets (empty API group matches core API group), so the full request and response payloads are captured.

Answer

Only the request metadata will be logged

Answer

Only the response will be logged

Answer

Nothing will be logged because the rule uses an empty api group