CKS Practice Test 27 — 15 Questions

Question 1

An administrator wants to secure etcd communication. Which of the following is required to enable TLS for client-to-etcd communication?

Accepted Answer

--cert-file= and --key-file=. To enable TLS for client-to-etcd communication, the etcd server must present a certificate to clients. The `--cert-file` and `--key-file` flags specify the server's TLS certificate and private key, which are required for the TLS handshake. Without these, etcd cannot serve HTTPS to clients.

Answer

Set ETCD_TLS_ENABLE=true environment variable

Answer

--client-cert-auth=true and --trusted-ca-file=<CA-file>

Answer

--tls-cert-file and --tls-key-file

Question 2

You are auditing a cluster's supply chain security. You find that many pods are running images from public registries without any pinning or verification. Which TWO actions would most effectively reduce the risk of pulling malicious images?

Accepted Answer

Configure all deployments to use image digests instead of tags.. Using image digests (e.g., `nginx@sha256:abc123...`) pins the image to an immutable content hash, ensuring that the exact same image is pulled every time, even if the tag is updated to a malicious version. This prevents tag-mutation attacks where an attacker replaces a benign image tag with a compromised one. Digests are verified by the container runtime (containerd) against the registry's manifest, providing cryptographic assurance of image integrity.

Answer

Implement RBAC to restrict which users can create pods.

Answer

Enforce PodSecurityStandard baseline or restricted to block privileged containers.

Answer

Apply a network policy that blocks egress traffic to public registries.

Question 3

What is the purpose of the --audit-log-path flag on the kube-apiserver?

Accepted Answer

It enables audit logging and sets the output file path.. The `--audit-log-path` flag on the kube-apiserver enables audit logging and specifies the file path where audit events are written. Without this flag, audit logging is disabled by default. Setting this flag is the first step to capturing API request logs for security monitoring and compliance.

Answer

It sets the maximum number of audit log files to retain.

Answer

It disables audit logging.

Answer

It specifies the path to the audit policy file.

Question 4

An administrator wants to run a container that requires the SYS_TIME capability. Which field should be used in the securityContext to add this capability?

Accepted Answer

capabilities.add. The `capabilities.add` field in the `securityContext` is specifically designed to add Linux capabilities (such as `SYS_TIME`) to a container without granting full root privileges. This follows the principle of least privilege, allowing only the required capability to modify the system clock.

Answer

privileged: true

Answer

allowPrivilegeEscalation: true

Answer

capabilities.drop

Question 5

Which TWO of the following are recommended practices for securing the Kubernetes Dashboard? (Select TWO)

Accepted Answer

Restrict Dashboard access using RBAC with minimal privileges. The Kubernetes Dashboard should be secured using Role-Based Access Control (RBAC) with minimal privileges. This follows the principle of least privilege, ensuring that users or service accounts accessing the Dashboard have only the permissions necessary for their tasks, reducing the attack surface and potential blast radius in case of compromise.

Answer

Use HTTP instead of HTTPS for Dashboard traffic

Answer

Disable authentication for the Dashboard

Answer

Use the default cluster-admin ServiceAccount for Dashboard access

Question 6

An administrator runs kube-bench and receives a failing result for CIS control 1.1.1. What does this control typically check?

Accepted Answer

That the API server pod specification file permissions are set to 644 or more restrictive. CIS control 1.1.1 specifically checks that the API server pod specification file (typically /etc/kubernetes/manifests/kube-apiserver.yaml) has permissions set to 644 or more restrictive (e.g., 600 or 640). This ensures that only authorized users (root or the kube-apiserver process) can read or modify the file, preventing unauthorized changes to critical API server configuration.

Answer

That etcd is using TLS

Answer

That the API server audit log path is configured

Answer

That anonymous authentication is disabled on the API server

Question 7

Which Pod Security Standard level allows the most relaxed security controls?

Accepted Answer

privileged. The privileged Pod Security Standard (PSS) level imposes no restrictions on pod behavior, allowing unrestricted access to host resources, capabilities, and security contexts. This makes it the most relaxed level, as it does not enforce any of the constraints found in baseline or restricted profiles.

Answer

restricted

Answer

default

Answer

baseline

Question 8

Which command is used with Cosign to sign a container image?

Accepted Answer

cosign sign . The `cosign sign ` command is used to sign a container image by attaching a digital signature to the image manifest in the container registry. This signature, typically stored as a separate tag or in an OCI artifact, allows verification of the image's origin and integrity using the corresponding public key.

Answer

cosign verify <image>

Answer

cosign attest <image>

Answer

cosign generate <image>

Question 9

You have deployed a pod and set `securityContext.readOnlyRootFilesystem: true`. The pod is failing to start with an error about writing to `/tmp`. What is the most likely cause?

Accepted Answer

The pod is missing an emptyDir volume mounted at `/tmp`. When `securityContext.readOnlyRootFilesystem: true` is set, the container's root filesystem becomes read-only. Many applications, including those that write temporary files, expect to write to `/tmp`. Without a writable volume mounted at `/tmp`, the container fails to start because it cannot write to that directory. Mounting an `emptyDir` volume at `/tmp` provides a writable location that is ephemeral and tied to the pod's lifecycle, resolving the issue.

Answer

The `securityContext` is misspelled

Answer

The container image does not have `/tmp` directory

Answer

The container is running as a non-root user

Question 10

Which TWO of the following are valid approaches to manage secrets in a Kubernetes cluster?

Accepted Answer

Mount secrets as volumes in pods. Kubernetes allows secrets to be mounted as volumes in pods, which is a secure approach as the secret data is stored in tmpfs (RAM-backed filesystem) and not written to disk on the node. This method avoids exposing secrets in environment variables that can be leaked through process dumps or logs, and it supports automatic updates when secrets are modified.

Answer

Pass secrets as environment variables

Answer

Embed secrets directly in the pod YAML definition

Answer

Store secrets as plain text in ConfigMap

Question 11

What is the purpose of the --authorization-mode=RBAC flag on the API server?

Accepted Answer

It enables role-based access control for the API server. The `--authorization-mode=RBAC` flag configures the Kubernetes API server to use Role-Based Access Control (RBAC) as its authorization mode. This means that when a request reaches the API server, after authentication, the authorization module checks the request against RBAC roles and role bindings to determine if the user or service account has permission to perform the requested action. Without this flag, the API server would default to other modes (e.g., AlwaysAllow) or require explicit configuration of a different authorizer.

Answer

It disables anonymous authentication

Answer

It enables the NodeRestriction admission plugin

Answer

It enables audit logging for RBAC events

Question 12

You need to configure Kubernetes audit logging to log all requests to the 'secrets' API. Which audit policy level captures the body of the request?

Accepted Answer

Request. The 'Request' audit level logs the request metadata and the request body, which includes the body of the request. This is exactly what the question asks for. 'RequestResponse' adds the response body, which is not required per the question. Therefore, the correct answer is A.

Answer

None

Answer

RequestResponse

Answer

Metadata

Question 13

You are the lead security engineer for a large financial institution. The organization runs a Kubernetes cluster with 500+ microservices. The supply chain security team has implemented the following measures: (1) All images are built from a minimal base image (distroless) and scanned with Trivy before being pushed to a private registry. (2) Images are signed using cosign with a key stored in a hardware security module (HSM). (3) Kyverno policies enforce that only signed images from the private registry can run, and also enforce that containers run as non-root. (4) A binary authorization (binauthz) style admission controller verifies attestations. Recently, a critical vulnerability (CVE-2024-0001) was discovered in a popular open-source library used by several microservices. The library is included as a dependency in the base image. The vulnerability is remotely exploitable and has a CVSS score of 9.8. The security team needs to remediate this quickly. They have already patched the library and updated the base image. What is the BEST course of action to ensure all running pods use the new image?

Accepted Answer

Update the image tag in each Deployment's spec to point to the new patched image, then perform a rolling update. The admission controller will verify signatures and attestations for the new image.. Updating the image tag in each Deployment triggers a rolling update, which creates new pods with the patched image. The admission controller (Kyverno) will verify the cosign signature and binary authorization attestation for the new image, ensuring supply chain security is maintained. This approach is the standard Kubernetes method for deploying image updates while preserving security controls.

Answer

SSH into each node, pull the new image, and use kubectl exec to update the library inside running containers.

Answer

Temporarily disable the admission controller that verifies signatures and then update the image tags.

Answer

Delete all running pods and let the ReplicaSets recreate them from the existing image.

Question 14

A security auditor recommends limiting the use of host namespaces in pods. Which THREE of the following fields, if set to true, expose the host namespace to a container?

Accepted Answer

hostPID. Setting `hostPID: true` in a Pod spec allows the container to share the host's process ID namespace. This means the container can see and interact with all processes running on the host node, which breaks process isolation and can lead to privilege escalation or information leakage.

Answer

hostFS

Answer

hostUsers

Question 15

Which TWO of the following are CIS Benchmark recommendations for securing the Kubernetes API server? (Select TWO)

Accepted Answer

Enable audit logging. The CIS Benchmark for Kubernetes recommends enabling audit logging to record all API server requests, which is essential for security monitoring, incident response, and compliance. Audit logs capture the sequence of actions performed by users, administrators, and system components, providing an immutable record that can be analyzed for suspicious activity or policy violations.

Answer

Disable RBAC

Answer

Enable anonymous authentication

Answer

Use TLS 1.0