CKS Practice Test 26 — 15 Questions

Question 1

An administrator runs `kube-bench` and sees that the check 'Ensure that the --protect-kernel-defaults flag is set to true' has failed. Which component does this check apply to?

Accepted Answer

Kubelet. The `--protect-kernel-defaults` flag is a kubelet-specific security option that ensures the kubelet does not modify kernel parameters that could weaken node security. When set to true, it enforces that the kubelet respects kernel defaults, preventing privilege escalation via sysctl overrides. This check is part of the CIS Benchmark for the kubelet component, not for etcd, the API server, or the controller manager.

Answer

etcd

Answer

API server

Answer

Controller manager

Question 2

You are tasked with enabling audit logging for the Kubernetes API server. Which API server flag must be used to specify the audit log file path?

Accepted Answer

--audit-log-path. The `--audit-log-path` flag is the correct API server flag to specify the file path where audit logs are written. This flag defines the absolute or relative path to the audit log file, and the kube-apiserver will create or append to that file. Without this flag, no audit log file is generated, even if an audit policy is configured.

Answer

--audit-log-dir

Answer

--audit-policy-file

Answer

--audit-log-file

Question 3

Which TWO are benefits of using a distroless base image over a full OS image like Ubuntu? (Select two.)

Accepted Answer

Smaller image size. Distroless images contain only the application and its runtime dependencies, omitting package managers, shells, and other OS utilities. This results in a significantly smaller image size compared to full OS images like Ubuntu, which include a complete userland and filesystem. Smaller images reduce storage costs, network transfer times, and container startup latency.

Answer

Faster image build times

Answer

Better compatibility with Kubernetes security contexts

Answer

Easier debugging

Question 4

You are writing a Falco rule to detect when a container tries to read /etc/shadow. Which condition should you use?

Accepted Answer

fd.name=/etc/shadow and container.id != host. The correct condition 'fd.name=/etc/shadow and container.id != host' ensures the accessed file is /etc/shadow and the event originates from a container (not the host). Option A correctly includes both conditions. Option B specifies /etc/passwd (wrong file). Option C only checks that it's from a container but does not restrict the file. Option D checks the file but does not exclude host events.

Answer

fd.name=/etc/passwd

Answer

container.id != host

Answer

fd.name=/etc/shadow

Question 5

Which kubectl command can be used to execute a shell inside a running container for forensic analysis?

Accepted Answer

kubectl exec -it -- /bin/sh. The `kubectl exec -it -- /bin/sh` command opens an interactive TTY (`-it`) into a running container and launches a shell (`/bin/sh`), which is exactly what's needed for live forensic analysis inside a compromised or suspect container. It does not restart or alter the pod, preserving volatile evidence like running processes, open file descriptors, and in-memory artifacts. This is the standard CKS-recommended approach for container-level incident response.

Answer

kubectl delete pod <pod>

Answer

kubectl logs <pod>

Answer

kubectl describe pod <pod>

Question 6

Which TWO checks are performed by kube-bench for the master node?

Accepted Answer

Ensure that the --anonymous-auth argument is set to false. Option D is correct because kube-bench's master node checks (from the CIS Kubernetes Benchmark, section 1.2.x on API server) include verifying that the API server's --anonymous-auth argument is set to false, preventing unauthenticated requests to the API server. Option E is correct because kube-bench also checks that the --audit-log-path argument is set on the API server, ensuring audit logging is enabled and events are written to a log file. Option A is not a master node check; the NodeRestriction admission plugin is verified in the worker node section (kubelet configuration, 4.2.x). Option B is not a kube-bench master check as stated; kube-bench verifies TLS cipher suites and related API server flags rather than a simple 'uses TLS 1.2' check. Option C is incorrect because kube-bench does not require Docker as the container runtime; it supports any CRI-compliant runtime and checks runtime-specific configuration separately.

Answer

Ensure that the kubelet uses the NodeRestriction admission plugin

Answer

Ensure that the API server uses TLS 1.2

Answer

Ensure that the container runtime is Docker

Question 7

Which THREE of the following are recommended actions to secure the Kubernetes Dashboard? (Choose three.)

Accepted Answer

Use RBAC to create a dedicated service account with minimal permissions. The Kubernetes Dashboard should be accessed using a dedicated service account with minimal permissions via RBAC. This follows the principle of least privilege, ensuring the dashboard only has the permissions necessary for its function, reducing the attack surface. By default, the dashboard's service account has minimal permissions, but binding it to a role with excessive privileges (like cluster-admin) would be a security risk.

Answer

Expose the Dashboard via an Ingress with a public domain

Answer

Enable HTTPS for Dashboard communications

Question 8

Which TWO actions are effective for detecting and preventing container breakout attempts using runtime security tools?

Accepted Answer

Deploy Falco with rules that alert on 'syscall' events like 'clone' or 'unshare'.. Falco is a CNCF runtime security tool that uses eBPF or kernel modules to intercept system calls. By alerting on sensitive syscalls like 'clone' (used to spawn new processes) or 'unshare' (used to create new namespaces), Falco can detect container breakout attempts where an attacker tries to escape the container's isolation. This provides real-time detection of anomalous behavior indicative of a breakout.

Answer

Set 'securityContext.seccompProfile.type: Unconfined' to allow all syscalls.

Answer

Enable Kubernetes audit logging to capture exec commands.

Answer

Use PodSecurityPolicy to deny privileged containers.

Question 9

Which TWO of the following are valid methods to verify the integrity of a container image in a Kubernetes supply chain? (Select 2)

Accepted Answer

Signing the image with Cosign and verifying the signature before deployment. Cosign is a tool for signing container images using cryptographic keys, and verifying the signature before deployment ensures that the image has not been tampered with since it was signed. This provides integrity and authenticity in the software supply chain, as the signature can be validated against a trusted public key or a keyless identity (e.g., via Fulcio).

Answer

Running the container in a separate namespace

Answer

Scanning the image for vulnerabilities using Trivy

Answer

Using a base image with the latest tag

Question 10

You want to use an external secret management system like HashiCorp Vault to manage database credentials for your application. Which of the following are valid approaches to integrate Vault with Kubernetes?

Accepted Answer

Store Vault tokens in a Kubernetes Secret and mount them. Storing Vault tokens in a Kubernetes Secret and mounting them into pods is a valid integration approach. The token is retrieved from Vault (e.g., via a Kubernetes auth method) and stored as a Secret, which is then mounted as a volume or environment variable, allowing the application to authenticate with Vault and fetch secrets dynamically.

Answer

Use environment variables from Vault with a script

Answer

Store Vault tokens in a ConfigMap and mount them into pods

Question 11

Which of the following is the correct way to drop all Linux capabilities for a container?

Accepted Answer

capabilities:
  drop: ["ALL"]. In a Kubernetes Pod security context, the `capabilities` field is a list of capabilities to add or drop. Dropping `ALL` removes all Linux capabilities from the container, which is the most restrictive and secure approach. The correct YAML syntax uses `capabilities:` (plural) with a `drop:` list containing `"ALL"`.

Answer

capability:
  drop: ["ALL"]

Answer

capabilities:
  drop: ["NET_RAW", "CHOWN"]

Answer

capabilities:
  add: ["ALL"]

Question 12

Which THREE are valid methods to verify the integrity and origin of a container image? (Select 3)

Accepted Answer

Notary. Notary is correct because it is a tool that enables the signing and verification of container images using The Update Framework (TUF), ensuring both integrity (the image has not been tampered with) and origin (the image was signed by a trusted publisher). It works by managing cryptographic signatures and metadata in a trusted collection, allowing clients to verify the signature chain before pulling an image.

Answer

Trivy fs

Answer

Syft

Question 13

Which THREE of the following are recommended practices for securing container images in a Kubernetes environment?

Accepted Answer

Scan images for vulnerabilities before deployment. Scanning container images for vulnerabilities before deployment is a fundamental security practice in Kubernetes environments. Tools like Trivy, Clair, or Anchore Grype can identify known CVEs in the base image and application dependencies, allowing teams to remediate issues before the image is run. This aligns with the principle of shifting security left and is a key requirement for compliance with standards like the NIST Application Container Security Guide.

Option C is correct because using imagePullSecrets is a recommended practice to authenticate to private container registries. While imagePullSecrets do not enforce access control policies on which images can be pulled, they securely store credentials and enable pods to pull images from private registries, which is essential for using images that are not publicly accessible. This prevents unauthorized access to private images and reduces the risk of using compromised public images.

Option D is correct because using minimal base images such as distroless or scratch reduces the attack surface by eliminating unnecessary packages, libraries, and utilities. This aligns with the principle of least functionality and minimizes the number of potential vulnerabilities that could be exploited.

Answer

Store sensitive configuration data directly in the image

Answer

Run containers as root to avoid permission issues

Question 14

Which TWO of the following are valid methods to apply a seccomp profile to a Kubernetes pod? (Select two.)

Accepted Answer

Using the pod annotation: seccomp.security.alpha.kubernetes.io/pod. The seccomp.security.alpha.kubernetes.io/pod annotation was the original method to apply a seccomp profile to an entire pod in Kubernetes versions prior to v1.19. This annotation specifies the seccomp profile path or type (e.g., 'runtime/default' or 'localhost/<profile>') for the pod's containers, and it remains valid in older clusters or when using legacy configurations.

Answer

Using the field: spec.seccompProfile

Answer

Using the command line flag: --seccomp-profile when running kubectl run

Answer

Using the pod annotation: container.seccomp.security.alpha.kubernetes.io

Question 15

Which TWO tools can generate an SBOM for a container image? (Select two.)

Accepted Answer

trivy. Trivy is a comprehensive vulnerability scanner that can generate an SBOM (Software Bill of Materials) for container images using its `trivy image --format cyclonedx` or `trivy image --format spdx` commands, outputting in CycloneDX or SPDX formats. Syft is a dedicated SBOM generation tool from Anchore that produces detailed SBOMs from container images using `syft packages <image>` and supports multiple output formats including CycloneDX and SPDX. Both tools are specifically designed to inventory all software components within a container image, making them correct choices for SBOM generation.

Answer

checkov

Answer

cosign

Answer

kubesec