CKS Practice Test 30 — 15 Questions

Question 1

Which THREE Falco priority levels sequences are correctly ordered from lowest to highest severity? (Choose three)

Accepted Answer

WARNING, ERROR, CRITICAL, ALERT, EMERGENCY. Options A, B, and E are correctly ordered from lowest to highest severity according to Falco's priority levels, which follow the standard syslog severity ordering (RFC 5424). Option A: WARNING, ERROR, CRITICAL, ALERT, EMERGENCY is correct. Option B: DEBUG, INFORMATIONAL, NOTICE, WARNING is correct. Option E: NOTICE, WARNING, ERROR, CRITICAL is correct. Options C and D are incorrectly ordered (C has DEBUG after NOTICE, and D starts with ALERT which is higher than ERROR).

Answer

INFORMATIONAL, NOTICE, DEBUG, WARNING

Answer

ALERT, CRITICAL, ERROR, WARNING

Question 2

You need to isolate a compromised pod named 'malicious-pod' in the 'default' namespace so that it cannot communicate with any other pod, but can still receive traffic from a specific monitoring pod. Which NetworkPolicy should you apply?

Accepted Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate-pod
spec:
  podSelector:
    matchLabels:
      app: malicious-pod
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: monitoring-pod
  policyTypes:
  - Ingress
  - Egress. It selects the compromised pod, allows ingress only from the monitoring pod (using podSelector), and specifies policyTypes as both Ingress and Egress. Since no egress rules are defined, egress traffic is denied by default, isolating the pod from initiating communication. Option B incorrectly allows all egress via an empty egress rule. Option C denies all ingress (no ingress rules) and thus blocks the monitoring pod. Option D allows all ingress and does not restrict egress, failing to isolate the pod.

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate-pod
spec:
  podSelector:
    matchLabels:
      app: malicious-pod
  egress:
  - {}
  policyTypes:
  - Egress

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate-pod
spec:
  podSelector:
    matchLabels:
      app: malicious-pod
  policyTypes:
  - Ingress
  - Egress

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate-pod
spec:
  podSelector:
    matchLabels:
      app: malicious-pod
  ingress:
  - {}
  policyTypes:
  - Ingress

Question 3

Which TWO practices help secure the Kubernetes Dashboard?

Accepted Answer

Use a ClusterIP service and access it via kubectl proxy. Accessing the Kubernetes Dashboard via `kubectl proxy` creates a secure, authenticated HTTP proxy between your local machine and the API server. This method leverages the API server's built-in authentication and authorization, ensuring that only users with valid kubeconfig credentials can reach the Dashboard. It also avoids exposing the Dashboard directly to the network, reducing the attack surface.

Answer

Enable anonymous access to the Dashboard

Answer

Grant the Dashboard service account cluster-admin role for full functionality

Answer

Expose the Dashboard via a NodePort service for easy access

Question 4

Which TWO admission plugins are recommended to be enabled for security hardening?

Accepted Answer

NodeRestriction. NodeRestriction is correct because it limits the Node object modifications a kubelet can make, preventing compromised nodes from modifying other nodes or escalating privileges. PodSecurity is correct because it enforces Pod Security Standards (baseline, restricted) via admission, replacing the deprecated PodSecurityPolicy with a built-in, stable mechanism for controlling pod security contexts.

Answer

AlwaysPullImages

Answer

NamespaceLifecycle

Answer

DefaultStorageClass

Question 5

An administrator runs 'falco --list' and sees many default rules. What is the correct way to load a custom Falco rules file?

Accepted Answer

falco -r /path/to/rules.yaml. The `-r` flag (short for `--rules`) is the standard Falco command-line option to specify a custom rules file. When you run `falco -r /path/to/rules.yaml`, Falco loads the rules from that YAML file instead of or in addition to the default rules. The `--list` flag shows all loaded rules, so using `-r` ensures your custom rules are included in that list.

Answer

falco --load /path/to/rules.yaml

Answer

falco --rules /path/to/rules.yaml

Answer

falco --config /path/to/rules.yaml

Question 6

Which TWO of the following are valid ways to enforce that containers cannot run as root in a Kubernetes cluster? (Select TWO.)

Accepted Answer

Create a Gatekeeper Constraint that requires runAsNonRoot. Gatekeeper, using the Open Policy Agent (OPA) framework, can enforce custom policies via ConstraintTemplates. A Constraint requiring `runAsNonRoot: true` in the Pod security context ensures containers cannot run as root, providing a flexible, admission-time control that works across all namespaces.

Answer

Use a NetworkPolicy to block root containers

Answer

Set the kubelet flag --run-non-root

Answer

Use a ServiceAccount to restrict root

Question 7

Which TWO of the following are benefits of using an SBOM (Software Bill of Materials) in supply chain security?

Accepted Answer

It helps in identifying known vulnerabilities in dependencies. An SBOM lists all components and dependencies in a software artifact, enabling teams to cross-reference against vulnerability databases (e.g., NVD) to identify known CVEs. This proactive identification is a core supply chain security practice, as mandated by frameworks like SLSA and EO 14028.

Answer

It allows for faster image pulls

Answer

It reduces the size of the container image

Answer

It automatically patches vulnerabilities

Question 8

Which TWO actions are part of the CIS Kubernetes Benchmark recommendations?

Accepted Answer

Enable audit logging on the API server. The CIS Kubernetes Benchmark recommends enabling audit logging on the API server to record all requests and responses, which is essential for security monitoring, forensics, and compliance. Audit logs capture the sequence of activities, including who performed an action, what resource was accessed, and the outcome, enabling detection of unauthorized or suspicious behavior.

Answer

Allow all service accounts to list secrets

Answer

Expose the API server on port 8080

Answer

Use HTTP for kubelet communication

Question 9

Which THREE of the following are recommended practices for securing the etcd datastore?

Accepted Answer

Bind etcd to localhost only if not required to be accessible from other nodes. Binding etcd to localhost (127.0.0.1) when it does not need to be accessed from other nodes restricts network exposure, reducing the attack surface. This is a fundamental network hardening practice that prevents unauthorized remote access to the etcd datastore, which stores all cluster state and secrets.

Answer

Disable peer client cert authentication

Answer

Allow anonymous access to etcd for performance

Question 10

Which TWO of the following are valid ways to restrict access to the Kubernetes API server?

Accepted Answer

Use webhook token authentication. Webhook token authentication (Option B) is a valid method to restrict API server access because it delegates token validation to an external service via a webhook, allowing custom authentication logic. This is a supported authentication strategy in Kubernetes, enabling fine-grained control over who can access the API server.

Answer

Use static token file

Answer

Enable NodeRestriction admission plugin

Answer

Enable anonymous access

Question 11

Which THREE of the following are correct statements about Kubernetes admission controllers in the context of supply chain security? (Select 3)

Accepted Answer

Admission controllers are executed in a specific order that can affect the final state of the resource. Admission controllers are executed in a specific order: mutating controllers run first, then validating controllers. This ordering is critical because a mutating webhook can modify the resource before a validating webhook evaluates it, potentially bypassing intended policies if the order is not carefully managed. The Kubernetes API server processes admission controllers sequentially based on the order defined in the API server flags or the built-in chain, which directly affects the final resource state.

Answer

MutatingAdmissionWebhook can only modify pods, not other resources

Answer

OPA/Gatekeeper uses MutatingAdmissionWebhook to enforce policies

Question 12

Which TWO of the following are valid audit stages in Kubernetes audit logging? (Choose two)

Accepted Answer

ResponseStarted. `ResponseStarted` is a valid audit stage in Kubernetes audit logging. It occurs when the response headers are sent, but the response body is not yet complete. This stage is useful for auditing the start of a response, especially for streaming or large responses.

Answer

ResponseFinished

Answer

RequestProcessing

Answer

AuthorizationChecked

Question 13

Which TWO admission plugins should be enabled to improve cluster security according to CIS benchmarks? (Choose two.)

Accepted Answer

PodSecurity. PodSecurity is correct because it replaces the deprecated PodSecurityPolicy (PSP) and enforces the Pod Security Standards (baseline, restricted, privileged) via admission webhooks or built-in admission controllers. This prevents pods from running with excessive privileges, such as privileged containers or hostPath mounts, directly aligning with CIS benchmarks for Kubernetes hardening. NodeRestriction is correct because it limits the Node and Pod objects a kubelet can modify, preventing a compromised node from escalating privileges or modifying other nodes' statuses, which is a key CIS control for node-level security.

Answer

NamespaceLifecycle

Answer

PodSecurityPolicy

Answer

ServiceAccount

Question 14

An administrator wants to set an immutable root filesystem for a container in a Pod. Which securityContext field should be set to true?

Accepted Answer

readOnlyRootFilesystem. The readOnlyRootFilesystem field, when set to true in a container's securityContext, mounts the container's root filesystem as read-only. This prevents any process inside the container from writing to the root filesystem, which is a key security hardening measure to prevent runtime modifications, such as an attacker downloading tools or modifying binaries. It directly addresses the requirement for an immutable root filesystem.

Answer

allowPrivilegeEscalation

Answer

runAsNonRoot

Answer

privileged

Question 15

Given the exhibit, what will happen when a user creates a pod with an image from an untrusted registry?

Accepted Answer

The pod is created and the image is pulled. By default, Kubernetes does not enforce any restrictions on image registries. The kubelet will attempt to pull the image from any registry, including untrusted ones, unless an admission controller like ImagePolicyWebhook or a runtime-specific policy (e.g., containerd's `untrusted_workload` mode) is explicitly configured. In this scenario, no such policy is mentioned, so the pod is created and the image is pulled.

Answer

The pod is rejected by NodeRestriction admission

Answer

The pod is rejected by PodSecurity admission

Answer

The pod is created but the image is not pulled because it's untrusted