CKS Practice Test 3 — 25 Questions

Question 1

Which TWO are valid stages in a Kubernetes audit event? (Select 2)

Accepted Answer

RequestReceived. 'RequestReceived' is one of the defined stages in the Kubernetes audit event lifecycle. When an audit policy is configured, the kube-apiserver records an audit event at the 'RequestReceived' stage after it has received the request but before it has been processed by the admission controllers or the resource handler. This stage captures the raw request as it arrives.

Answer

PreProcessing

Answer

None

Answer

PostProcessing

Question 2

Which THREE of the following are correct statements about seccomp in Kubernetes? (Select 3)

Accepted Answer

Seccomp can be configured using the securityContext.seccompProfile field. The `securityContext.seccompProfile` field in a Pod or container spec allows you to configure seccomp profiles directly in the Kubernetes API. This field supports values like `RuntimeDefault`, `Localhost`, and `Unconfined`, enabling fine-grained control over system call filtering without requiring manual profile loading on the node.

Answer

Seccomp profiles can only be applied to privileged containers

Answer

Seccomp can only restrict system calls, not allow them

Question 3

Which TWO of the following are valid Pod Security Standard levels? (Select 2)

Accepted Answer

privileged. The Pod Security Standards (PSS) define three levels: privileged, baseline, and restricted. The privileged level is the most permissive, allowing known privilege escalations and is intended for system-level workloads that require unrestricted access to host resources. It is explicitly listed in the Kubernetes documentation as one of the three valid PSS levels.

Answer

medium

Answer

high

Answer

default

Question 4

Which of the following is a valid way to drop all capabilities from a container?

Accepted Answer

securityContext:
  capabilities:
    drop: ["ALL"]. In Kubernetes, the `securityContext.capabilities.drop` field is used to explicitly remove Linux capabilities from a container. Dropping `ALL` removes every capability, ensuring the container runs with the least privilege possible, which is a key security best practice for minimizing microservice vulnerabilities.

Answer

securityContext:
  dropCapabilities: true

Answer

securityContext:
  privileged: false

Answer

securityContext:
  capabilities:
    remove: ["ALL"]

Question 5

A pod has been compromised. You want to isolate it from other pods while preserving its network state for forensics. Which NetworkPolicy rule achieves this?

Accepted Answer

Create a NetworkPolicy with podSelector matching the compromised pod and empty ingress/egress rules (deny all). A NetworkPolicy with a `podSelector` matching the compromised pod and empty `ingress` and `egress` rules (i.e., no rules specified) defaults to denying all traffic to and from that pod. This isolates the pod from all other pods in the cluster while preserving its network state for forensics, as the pod remains running and its network interfaces are untouched.

Answer

Deny all ingress and egress traffic to/from the pod's namespace

Answer

Add a label to the pod and create a NetworkPolicy allowing only traffic from a forensic pod

Answer

Delete the pod

Question 6

Which THREE of the following are valid flags for enabling admission plugins on the API server?

Accepted Answer

--enable-admission-plugins=AlwaysPullImages. `--enable-admission-plugins=AlwaysPullImages` is the valid flag to enable the AlwaysPullImages admission plugin on the kube-apiserver. This flag accepts a comma-separated list of plugin names, and AlwaysPullImages is a built-in admission controller that forces every new Pod to pull images again, even if they already exist on the node, enhancing security by ensuring only authorized images are used.

Answer

--plugin-dir=/admission

Answer

--admission-control=NodeRestriction

Question 7

You are configuring an Istio service mesh for mTLS between services. Which resource defines the TLS mode for traffic between services in a namespace?

Accepted Answer

PeerAuthentication. PeerAuthentication is the correct resource because it defines the TLS mode (e.g., STRICT, PERMISSIVE, DISABLE) for mTLS between services within a namespace in Istio. It enforces the authentication policy for workloads, ensuring that all traffic between them uses mutual TLS as specified. This directly controls the TLS mode for inter-service communication at the namespace or mesh level.

Answer

ServiceEntry

Answer

VirtualService

Answer

DestinationRule

Question 8

An admin has deployed a ValidatingWebhookConfiguration that denies pods with `runAsNonRoot: false`. After creating a pod that does not set `runAsNonRoot` at all, the pod is created successfully. Why did the webhook not deny it?

Accepted Answer

The webhook configuration's rules do not match the pod create operation. A is correct because the ValidatingWebhookConfiguration's `rules` define which API operations (e.g., create, update) and resources (e.g., pods) trigger the webhook. If the rules do not include the `create` operation for pods, the webhook will not intercept the pod creation request, so the pod is created without validation. The pod's security context (missing `runAsNonRoot`) is irrelevant if the webhook never fires.

Answer

The webhook's failure policy is set to Ignore

Answer

The webhook is only applied to pods in a specific namespace

Answer

The webhook only applies to pods created with a specific service account

Question 9

Which TWO of the following are recommendations from the CIS Kubernetes Benchmark?

Accepted Answer

Enable audit logging. The CIS Kubernetes Benchmark recommends enabling audit logging to record all API server requests, which is essential for security monitoring and forensic analysis. It also recommends disabling anonymous authentication to ensure that all requests are authenticated, preventing unauthenticated access to the cluster.

Answer

Use TokenReview API for authentication

Answer

Set --protect-kernel-defaults=false on kubelet

Answer

Enable the insecure port for kubelet

Question 10

Which field in a Pod's securityContext prevents privilege escalation by the container?

Accepted Answer

allowPrivilegeEscalation. `allowPrivilegeEscalation` controls whether a process can gain more privileges than its parent process. In a Pod's securityContext, setting this field to `false` prevents the container from performing privilege escalation, such as via setuid binaries or system calls like `setuid(0)`. This directly mitigates a common attack vector where an attacker exploits a container process to gain root access.

Answer

capabilities.add: ["SYS_ADMIN"]

Answer

runAsNonRoot

Answer

privileged

Question 11

Which THREE of the following are recommended measures to reduce the attack surface of Kubernetes nodes?

Accepted Answer

Disable unnecessary system services on nodes. Disabling unnecessary system services on Kubernetes nodes reduces the number of running processes and open ports that could be exploited by an attacker. Services like telnet, rsh, or unused SNMP daemons provide additional attack vectors. This aligns with the principle of minimalism in system hardening, as recommended by the CIS Kubernetes Benchmark.

Answer

Open all ports on nodes to allow easy debugging

Answer

Run all containers as root user

Question 12

Which THREE of the following are required to secure etcd in a Kubernetes cluster?

Accepted Answer

Require client certificate authentication. Etcd requires client certificate authentication to verify the identity of clients (such as kube-apiserver) connecting to it. Without mutual TLS (mTLS), an attacker could impersonate a legitimate client and read or modify cluster state, including secrets and configuration data.

Answer

Configure RBAC for etcd

Answer

Allow anonymous access for monitoring

Question 13

You are configuring kubelet to protect kernel defaults. Which flag enables this?

Accepted Answer

--protect-kernel-defaults. The `--protect-kernel-defaults` flag is a kubelet option that, when set to `true`, enforces kernel tunable protections by checking that sysctl settings like `vm.overcommit_memory`, `vm.panic_on_oom`, and `kernel.panic` match the kubelet's expected safe defaults. This is a critical hardening measure to prevent container breakout scenarios where a compromised pod could weaken host kernel parameters.

Answer

--security-opt=protect-kernel

Answer

--enable-protect-kernel

Answer

--kernel-security

Question 14

Match each container security context setting to its effect.

Accepted Answer

runAsNonRoot: Prevents the container from running as root. Correct matches: runAsNonRoot forces non-root execution; runAsUser sets a specific UID. Common confusion is swapping these effects. Other settings like privileged and readOnlyRootFilesystem also enforce least privilege.

Answer

runAsNonRoot: Specifies the user ID (UID) to run the container

Answer

runAsUser: Prevents the container from running as root

Question 15

A cluster administrator needs to run a workload that uses gVisor (runsc) for container sandboxing. Which Kubernetes resource is required to enable this?

Accepted Answer

RuntimeClass. A RuntimeClass resource is required to enable gVisor (runsc) because it defines the container runtime configuration that should be used for pods. By creating a RuntimeClass with the handler set to 'runsc', the cluster administrator can instruct the kubelet to use gVisor as the OCI-compatible runtime for sandboxing, providing an additional security layer through a user-space kernel.

Answer

PriorityClass

Answer

NetworkPolicy

Answer

PodSecurityPolicy

Question 16

You are tasked with securing the kubelet. Which flag must be set on the kubelet to enable the NodeRestriction admission plugin?

Accepted Answer

--enable-admission-plugins=NodeRestriction on the kube-apiserver. The NodeRestriction admission plugin is an admission controller that runs on the kube-apiserver, not on the kubelet. It limits the Node and Pod objects a kubelet can modify, enforcing that nodes can only modify their own node object and pods bound to them. The flag `--enable-admission-plugins=NodeRestriction` on the kube-apiserver activates this plugin, which is a key security control for hardening the cluster.

Answer

--admission-control=NodeRestriction on the kubelet

Answer

--enable-admission-plugins=NodeRestriction on the kubelet

Answer

--node-restriction=true on the kubelet

Question 17

A security engineer runs 'kubesec scan deployment.yaml' and receives a score of -1. What does this score indicate?

Accepted Answer

The scan failed due to an error or invalid YAML. In kubesec, a score of -1 indicates that the scan could not complete successfully, typically due to an error in the YAML file (e.g., invalid syntax, malformed structure) or a failure in the scanning process itself. Kubesec returns scores from 0 to 10 for valid deployments, where higher scores indicate better security; -1 is a special sentinel value reserved for scan failures, not a security assessment.

Answer

The deployment passed all security checks

Answer

The deployment is not secure and needs immediate attention

Answer

The deployment has critical vulnerabilities

Question 18

Which tool can be used to perform static analysis of Kubernetes manifests for security issues?

Accepted Answer

kubesec. Kubesec is a static analysis tool specifically designed to evaluate Kubernetes resource manifests against a set of built-in security best practices. It scans YAML or JSON manifests for common misconfigurations such as running containers as root, missing resource limits, or insecure capability assignments, and returns a risk score. This makes it the correct choice for static analysis of Kubernetes manifests for security issues.

Answer

syft

Answer

cosign

Answer

trivy

Question 19

A security admin wants to ensure that all container images in a Kubernetes cluster are scanned for known vulnerabilities before being deployed. Which tool can be integrated into a CI/CD pipeline to scan container images for CVEs?

Accepted Answer

Trivy. Trivy is a comprehensive vulnerability scanner for container images, filesystems, and Git repositories. It can be integrated into CI/CD pipelines to automatically scan container images for known CVEs before deployment, making it the correct choice for this requirement.

Answer

kubesec

Answer

Helm

Answer

kubectl

Question 20

You are using `crictl` to debug a container that is not responding. Which command should you use to get the list of running containers?

Accepted Answer

crictl ps. `crictl ps` is the correct command because it lists running containers managed by the CRI-compatible runtime (e.g., containerd, CRI-O). This is analogous to `docker ps` but for the Kubernetes container runtime interface, allowing you to see container IDs, names, and statuses for debugging.

Answer

crictl pods

Answer

crictl images

Answer

crictl stats