CKS Practice Test 28 — 15 Questions

Question 1

Which flag disables anonymous authentication on the Kubernetes API server?

Accepted Answer

--anonymous-auth=false. The `--anonymous-auth=false` flag explicitly disables anonymous authentication on the Kubernetes API server. By default, anonymous requests are allowed (equivalent to `--anonymous-auth=true`), so setting this flag to `false` prevents unauthenticated users from accessing the API server, which is a key hardening requirement for the CKS exam.

Answer

--disable-anonymous-auth

Answer

--anonymous-auth=true

Answer

--no-anonymous-auth

Question 2

Which tool is used to load AppArmor profiles on a node?

Accepted Answer

apparmor_parser. The `apparmor_parser` tool is the standard utility for loading AppArmor profiles into the kernel's security module. It reads profile definitions from text files, compiles them into binary form, and loads them into the kernel's LSM (Linux Security Module) subsystem. Without this tool, AppArmor profiles cannot be activated on a node.

Answer

aa-enforce

Answer

aa-status

Answer

kubectl apply

Question 3

Which TWO of the following are recommended practices according to the CIS Kubernetes Benchmark? (Select 2)

Accepted Answer

Enable audit logging on the API server. The CIS Kubernetes Benchmark recommends enabling audit logging on the API server to record all requests and responses, which is essential for security monitoring, forensics, and compliance. Option B is correct because disabling anonymous authentication on the API server prevents unauthenticated requests from being processed, reducing the attack surface. The benchmark specifically advises setting `--anonymous-auth=false` on the API server to enforce authentication for all requests.

Answer

Enable anonymous authentication on the kubelet

Answer

Use the AlwaysAllow authorization mode

Answer

Disable the NodeRestriction admission plugin

Question 4

After running kube-bench, you see a failing check: '1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive'. What is the remediation?

Accepted Answer

Change permissions of /etc/kubernetes/manifests/kube-apiserver.yaml to 600. Check 1.1.1 from kube-bench specifically targets the API server pod specification file, which is located at /etc/kubernetes/manifests/kube-apiserver.yaml. The remediation is to set its permissions to 600 or more restrictive to prevent unauthorized read or write access, as this file contains critical configuration parameters for the API server.

Answer

Change permissions of /var/lib/kubelet/config.yaml to 600

Answer

Change permissions of /var/log/audit.log to 600

Answer

Change permissions of /etc/kubernetes/manifests/kube-controller-manager.yaml to 600

Question 5

Which TWO of the following are valid AppArmor profile modes? (Select 2 correct answers)

Accepted Answer

enforce. AppArmor profile modes determine how the Mandatory Access Control (MAC) policy is applied. 'Enforce' (option A) actively enforces the profile's rules, blocking any actions that violate the policy and logging the denial. 'Complain' (option E) logs policy violations without blocking them, allowing for testing and debugging of profiles before switching to enforce mode.

Answer

disabled

Answer

audit

Answer

unconfined

Question 6

A security team is hardening a Kubernetes cluster. They need to ensure that all control plane components run with the least privilege. Which approach should they take?

Accepted Answer

Configure control plane containers to run as non-root user and with read-only root filesystem. Running control plane containers as a non-root user and with a read-only root filesystem directly enforces the principle of least privilege at the container level. This approach limits the ability of an attacker who compromises a control plane component to escalate privileges or modify critical system files, which is a fundamental hardening requirement for the control plane.

Answer

Use seccomp profiles to block privilege escalation syscalls

Answer

Apply AppArmor profiles to all control plane pods

Answer

Enable PodSecurityPolicy with 'MustRunAsNonRoot' for control plane namespaces

Question 7

Which THREE of the following are valid ways to secure etcd in a Kubernetes cluster? (Select THREE)

Accepted Answer

Enable encryption at rest for etcd data. Enabling encryption at rest for etcd data ensures that the stored Kubernetes secrets and cluster state are encrypted on disk using a provider like AES-CBC or AES-GCM. This protects sensitive data if the underlying storage is compromised, and is a required hardening step for compliance with standards like PCI-DSS or SOC 2.

Answer

Allow anonymous access to etcd for ease of management

Answer

Expose etcd on a public IP for external monitoring

Question 8

Which kubelet flag prevents the kubelet from serving anonymous requests?

Accepted Answer

--anonymous-auth=false. The kubelet flag `--anonymous-auth=false` disables anonymous authentication, preventing unauthenticated requests from being served. By default, anonymous requests are enabled (`--anonymous-auth=true`), which allows any user without credentials to access the kubelet API. Setting this flag to `false` enforces authentication for all requests, a critical hardening step for cluster security.

Answer

--authentication-anonymous=false

Answer

--enable-anonymous=false

Answer

--anonymous-requests=false

Question 9

Which TWO are best practices for Dockerfile security? (Select 2)

Accepted Answer

Use a non-root user. Running containers as a non-root user reduces the risk of privilege escalation attacks. If an attacker compromises the container, they will not have root privileges, limiting their ability to modify system files or escape the container. This is enforced by using the USER directive in the Dockerfile to specify a non-root UID (e.g., USER 1001).

Answer

Store secrets in environment variables

Answer

Install SSH server for debugging

Answer

Run the container as root

Question 10

Which THREE of the following are effective methods to preserve evidence during a container security incident?

Accepted Answer

Take a memory dump of the container. Taking a memory dump of the container captures volatile data (processes, network connections, encryption keys) that is lost when the container stops. This preserves runtime evidence critical for forensic analysis, as memory artifacts are not persisted to disk and must be collected before the container is terminated.

Answer

Delete the pod immediately

Answer

Run kubectl exec to explore and modify files

Question 11

The Kubernetes Dashboard is deployed in the cluster. To secure it, which of the following is a recommended practice?

Accepted Answer

Access it via kubectl proxy. Accessing the Kubernetes Dashboard via `kubectl proxy` is recommended because it creates an authenticated HTTP proxy between your local machine and the Kubernetes API server. This ensures that all traffic to the Dashboard is tunneled through the API server's authentication and authorization mechanisms, preventing direct exposure of the Dashboard to the network and reducing the attack surface.

Answer

Create a NodePort service to access it externally

Answer

Use an Ingress without TLS

Answer

Expose it using a LoadBalancer service for easy access

Question 12

A compromised pod is making unexpected outbound connections. You want to isolate the pod by blocking all egress traffic while keeping it running for forensic analysis. Which action is correct?

Accepted Answer

Apply a NetworkPolicy that selects the pod and has no egress rules, effectively blocking all outbound traffic. Applying a NetworkPolicy that selects the pod with no egress rules blocks all outbound traffic while leaving the pod running, which is exactly what forensic isolation requires. In Kubernetes, once a pod is selected by a NetworkPolicy with an egress policy type, only explicitly allowed egress is permitted — an empty egress rule set means deny all. This preserves the pod's state and memory for analysis.

Answer

Use kubectl exec to kill the outbound processes inside the container

Answer

Modify the pod's /etc/hosts to block external IPs

Answer

Delete the pod and recreate it with a restrictive NetworkPolicy

Question 13

Match each Kubernetes certificate type to its usage.

Accepted Answer

API server serving certificate: Encrypts communication between clients and the API server. Two common certificate types in Kubernetes are the API server serving certificate (used for HTTPS encryption) and the kubelet client certificate (used for kubelet authentication to the API server). A common confusion is swapping their purposes: the API server serving certificate does not authenticate the API server to the kubelet, and the kubelet client certificate does not encrypt inter-node communication.

Answer

API server serving certificate: Authenticates the API server to the kubelet

Answer

Kubelet client certificate: Encrypts communication between nodes

Question 14

Which RBAC resource should be used to grant cluster-wide permissions to a user?

Accepted Answer

ClusterRoleBinding. ClusterRoleBinding is the correct resource because it binds a ClusterRole (which defines cluster-wide permissions) to a user, granting permissions across all namespaces. A ClusterRole itself only defines the rules; the binding is what actually grants those permissions to a specific subject. Therefore, to grant cluster-wide permissions to a user, you need a ClusterRoleBinding referencing a ClusterRole.

Answer

Role

Answer

RoleBinding

Answer

ClusterRole

Question 15

Which THREE of the following are capabilities that should typically be dropped from a container to minimize vulnerabilities?

Accepted Answer

NET_ADMIN. NET_ADMIN (B) is a powerful Linux capability that allows a container to perform network administration tasks such as modifying routing tables, firewall rules (iptables/nftables), and network interface configurations. Dropping this capability prevents a compromised container from altering the host's network stack or bypassing network policies, which is critical for minimizing the attack surface in a microservice environment.

Answer

CHOWN

Answer

KILL