CKS Practice Test 2 — 30 Questions

Question 1

You are asked to generate an SBOM for a container image and attach it as an attestation using cosign. Which two commands would you run in sequence?

Accepted Answer

syft myimage:latest -o spdx > sbom.spdx && cosign attest --type spdx --predicate sbom.spdx myimage:latest. It first uses Syft to generate an SPDX-format SBOM from the container image, then uses cosign attest to attach that SBOM as an in-toto attestation to the image. This sequence satisfies the requirement to generate an SBOM and attach it as an attestation using cosign.

Answer

trivy image --format spdx myimage:latest > sbom.spdx && cosign verify --key cosign.pub myimage:latest

Answer

cosign sign --key cosign.key myimage:latest && syft myimage:latest -o spdx

Answer

crane ls myimage:latest && cosign attest --type spdx --predicate sbom.spdx myimage:latest

Question 2

Which TWO AppArmor modes are available? (Select 2)

Accepted Answer

enforce. AppArmor has two operational modes: 'enforce' and 'complain'. In 'enforce' mode, AppArmor actively enforces the security policy, blocking actions that violate the profile and logging the denial. In 'complain' mode, AppArmor logs policy violations but does not block them, allowing administrators to test profiles before enforcing them.

Answer

audit

Answer

allow

Answer

unconfined

Question 3

An auditor requires that all audit logs from the Kubernetes API server be stored for 90 days and be tamper-proof. Which TWO measures should be implemented?

Accepted Answer

Configure the audit log backend to write to an immutable object store like S3 with Object Lock. Storing audit logs in an immutable object store like S3 with Object Lock ensures tamper-proof retention by preventing any object from being overwritten or deleted for a specified retention period. This directly satisfies the auditor's requirement for logs that cannot be altered or destroyed, regardless of the Kubernetes cluster state.

Answer

Enable the AuditDynamicConfiguration feature gate

Answer

Deploy Fluentd to forward logs to a central Elasticsearch cluster

Answer

Set --audit-log-maxbackup=10 and --audit-log-maxsize=100

Question 4

A developer wants to ensure that all containers in a pod run with a read-only root filesystem except for a specific volume mounted for writing logs. Which container-level security context field should be set to true?

Accepted Answer

readOnlyRootFilesystem. Setting `readOnlyRootFilesystem: true` in the container-level security context forces the container's root filesystem to be read-only, preventing any writes to the root filesystem. This is exactly what the developer needs to enforce immutability for the root filesystem while allowing writes only to a specific volume (e.g., for logs) mounted with write access. The field is a boolean in the `securityContext` of a container specification in Kubernetes.

Answer

allowPrivilegeEscalation

Answer

privileged

Answer

runAsNonRoot

Question 5

A microservice running as a Deployment in a Kubernetes cluster needs to authenticate to a third-party API using a static API key. Which is the most secure way to store and inject this secret into the container?

Accepted Answer

Store the API key in a Kubernetes Secret and mount it as a volume inside the container. Mounting a Kubernetes Secret as a volume provides the most secure method for injecting sensitive data into a container. Unlike environment variables, which can be exposed through process listings, container logs, or `/proc` filesystem, a volume mount stores the secret in the container's filesystem with permissions restricted to the runtime user. This approach also supports automatic rotation of secret values without restarting the pod, as the filesystem is updated in place when the Secret object changes.

Answer

Store the API key in a ConfigMap and expose it as an environment variable

Answer

Hardcode the API key in the container image

Answer

Store the API key in a Kubernetes Secret and expose it as an environment variable

Question 6

In a CI/CD pipeline, which step is MOST effective for detecting known vulnerabilities in a container image before deployment?

Accepted Answer

Run a vulnerability scan on the container image. Running a vulnerability scan on the container image (Option A) is the most effective step because it directly checks the image layers and installed packages against known Common Vulnerabilities and Exposures (CVEs) databases, such as the National Vulnerability Database (NVD). This identifies security flaws in base images and dependencies before deployment, which is a core requirement of supply chain security in Kubernetes.

Answer

Check the image size

Answer

Run unit tests on the application code

Answer

Lint the Dockerfile

Question 7

Which TWO of the following are valid audit stages in Kubernetes audit logging?

Accepted Answer

ResponseStarted. The Kubernetes audit stages include RequestReceived, ResponseStarted, ResponseComplete, and Panic. In the given options, ResponseStarted (A) and RequestReceived (E) are valid stages and are the two correct answers according to the question. Option C (ResponseComplete) is also a valid stage, but since the question explicitly asks for two, it is not selected as a correct answer here. Options B (ResponseDelay) and D (RequestProcessing) are not valid audit stages.

Answer

ResponseDelay

Answer

ResponseComplete

Answer

RequestProcessing

Question 8

Which TWO of the following are valid audit stages in Kubernetes audit logging?

Accepted Answer

ResponseComplete. Valid Kubernetes audit stages include RequestReceived, ResponseStarted, ResponseComplete, and Panic. All three options B (ResponseComplete), D (RequestReceived), and E (ResponseStarted) are valid audit stages. The question asks for two, but there are three valid options; thus, the correct set includes B, D, and E.

Answer

Authentication

Answer

Authorization

Question 9

In a Falco rule, you have the condition: 'evt.type=execve and proc.name=bash and container.id!=host'. What does this rule detect?

Accepted Answer

A bash shell being spawned inside a container. The rule triggers when a bash shell is executed (execve) inside any container (container.id != host). It does not check for interactive use; it simply detects bash execution.

Answer

A non-root bash process on the host

Answer

An interactive shell session inside a container

Answer

A bash process reading /etc/shadow

Question 10

Which TWO of the following are valid audit stages in Kubernetes?

Accepted Answer

Panic. Kubernetes audit stages include RequestReceived, ResponseStarted, ResponseComplete, and Panic. Among the given options, RequestReceived (D), ResponseStarted (C), and Panic (B) are all valid stages. Options A (ResponseReceived) and E (RequestSent) are not standard stages.

Answer

ResponseReceived

Answer

RequestSent

Question 11

Which command can be used to check if the API server has anonymous authentication enabled?

Accepted Answer

kubectl describe pod kube-apiserver -n kube-system | grep anonymous-auth. The kube-apiserver pod's manifest (or its runtime configuration) contains the `--anonymous-auth` flag. By inspecting the pod's YAML with `kubectl describe pod kube-apiserver -n kube-system` and grepping for `anonymous-auth`, you can see whether the flag is set to `true` (enabled) or `false` (disabled). This is the direct way to check the API server's runtime configuration for anonymous authentication.

Answer

kubectl get clusterrole cluster-admin -o yaml

Answer

kubectl get node -o yaml

Answer

kubectl auth can-i --list --as=system:anonymous

Question 12

Which admission plugin is recommended by the CIS Kubernetes Benchmark to restrict the kubelet's ability to modify nodes?

Accepted Answer

NodeRestriction. The NodeRestriction admission plugin is recommended by the CIS Kubernetes Benchmark to restrict the kubelet's ability to modify nodes. It limits the kubelet's permissions to only modify its own node and its own pods, preventing it from altering other nodes or performing unauthorized operations. This plugin enforces a security boundary by rejecting requests that attempt to modify node labels, taints, or status outside the kubelet's assigned scope.

Answer

PodNodeSelector

Answer

SecurityContextDeny

Answer

AlwaysPullImages

Question 13

A cluster administrator wants to ensure that all pods in a namespace run with the `seccomp` profile set to `RuntimeDefault`. Which OPA Gatekeeper ConstraintTemplate would achieve this?

Accepted Answer

violation[{"msg": "Seccomp profile must be RuntimeDefault"}] { input.review.object.spec.containers[_].securityContext.seccompProfile.type != "RuntimeDefault" }. It uses the Rego rule `input.review.object.spec.containers[_].securityContext.seccompProfile.type != "RuntimeDefault"` to check that every container in the pod has its seccomp profile type set to `RuntimeDefault`. This ensures that any container without the required profile triggers a violation, enforcing the cluster administrator's policy.

Answer

violation[{"msg": "Seccomp profile must be RuntimeDefault"}] { input.review.object.spec.containers[_].securityContext.seccompProfile.type == "Unconfined" }

Answer

violation[{"msg": "Seccomp profile must be RuntimeDefault"}] { input.review.object.spec.containers[_].securityContext.seccompProfile == "RuntimeDefault" }

Answer

violation[{"msg": "Seccomp profile must be RuntimeDefault"}] { input.review.object.spec.securityContext.seccompProfile.type != "RuntimeDefault" }

Question 14

Which TWO of the following are valid audit stages in Kubernetes audit logging?

Accepted Answer

ResponseStarted. Kubernetes audit logging defines four stages: RequestReceived, ResponseStarted, ResponseComplete, and Panic. Among the options, valid stages are A (ResponseStarted), B (Panic), and E (RequestReceived). Since the question asks for exactly two, the selected correct answers are A and E. Both are valid. Option B (Panic) is also a valid stage but is not included as a correct answer for this specific question.

Answer

Panic

Answer

ResponseFinished

Answer

RequestProcessing

Question 15

Which of the following is the best practice for providing sensitive data like passwords to a pod?

Accepted Answer

Mount secrets as volumes into the pod.. Mounting secrets as volumes into the pod is the best practice because it ensures that secrets are stored in a tmpfs (RAM-backed) filesystem, which is never written to disk and is automatically cleaned up when the pod terminates. This approach also allows the kubelet to update the secret contents in the volume without restarting the pod, and it avoids exposing the secret in process listings, logs, or environment variable dumps.

Answer

Use environment variables to inject secrets directly.

Answer

Pass secrets via command-line arguments.

Answer

Hardcode the secret in the container image.

Question 16

Which static analysis tool is specifically designed to evaluate Kubernetes manifests against security best practices?

Accepted Answer

kubesec. Kubesec is a static analysis tool that evaluates Kubernetes manifests (YAML files) against security best practices and provides a security score. Cosign (A) is for container signing and verification, Syft (B) is for generating SBOMs, and Clair (D) is for container vulnerability scanning. Therefore, option C is correct.

Answer

cosign

Answer

syft

Answer

clair

Question 17

An administrator runs 'kubectl describe pod secure-pod' and sees that the pod is in a Pending state with the event 'Error: ImagePullBackOff' and the message 'unauthorized: authentication required'. The image is stored in a private registry. What is the most likely cause?

Accepted Answer

Missing imagePullSecret in the pod spec or in the namespace's default service account. The error 'unauthorized: authentication required' indicates that the kubelet cannot authenticate to the private registry. Kubernetes requires an imagePullSecret, which contains registry credentials (typically a Docker config JSON), to be attached either directly to the pod spec or to the namespace's default service account. Without this secret, the kubelet cannot pull the image, resulting in the ImagePullBackOff state.

Answer

The registry requires TLS 1.3 but the kubelet uses TLS 1.2

Answer

The image tag is misspelled

Answer

The registry hostname is not resolvable

Question 18

Which of the following is a best practice for securing container images?

Accepted Answer

Use minimal base images like distroless or Alpine. Using minimal base images like distroless or Alpine significantly reduces the attack surface by eliminating unnecessary packages, libraries, and utilities that could contain vulnerabilities. Distroless images contain only the application and its runtime dependencies, while Alpine uses musl libc and BusyBox to keep the image size small and minimize the number of Common Vulnerabilities and Exposures (CVEs) that need to be patched.

Answer

Hardcode passwords in Dockerfile as environment variables for convenience

Answer

Use the latest tag for base images to get the newest features

Answer

Run containers as root to simplify permission management

Question 19

Which of the following is a static analysis tool for Kubernetes manifests that can be used to find misconfigurations?

Accepted Answer

Kubesec. Kubesec is a static analysis tool specifically designed to evaluate Kubernetes manifests against a set of built-in security policies. It scans YAML or JSON resource definitions and assigns a risk score based on misconfigurations such as running containers as root, missing resource limits, or insecure capability assignments. This makes it the correct choice for identifying misconfigurations in Kubernetes manifests without executing them.

Answer

Trivy

Answer

Syft

Answer

Cosign

Question 20

Which TWO of the following tools can generate an SBOM (Software Bill of Materials) for a container image?

Accepted Answer

syft. Syft (A) is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. Cosign attest (B) can also generate an SBOM for a container image using the `--type sbom` flag and attach it as an in-toto attestation. Both tools are capable of producing SBOMs.

Answer

Clair

Answer

kubesec

Answer

Snyk