CKS Practice Test 33 — 15 Questions

Question 1

You need to enforce that all containers in a namespace run with a read-only root filesystem. Which OPA Gatekeeper resource would you use to define the policy?

Accepted Answer

ConstraintTemplate. A ConstraintTemplate in OPA Gatekeeper defines the reusable policy logic (Rego rules) that enforces a specific constraint, such as requiring containers to run with a read-only root filesystem. The ConstraintTemplate is then instantiated by a Constraint resource to apply the policy to a namespace. Without the ConstraintTemplate, there is no policy definition to enforce.

Answer

Constraint

Answer

ValidatingWebhookConfiguration

Answer

ConfigMap

Question 2

Which TWO of the following are valid methods to apply a custom seccomp profile to a pod in Kubernetes?

Accepted Answer

Setting the annotation 'seccomp.security.alpha.kubernetes.io/pod' on the pod. The annotation 'seccomp.security.alpha.kubernetes.io/pod' was the original method to apply a seccomp profile to a pod in Kubernetes versions prior to 1.19. This annotation is still valid in older clusters or when using the alpha API, and it directly specifies the seccomp profile path or type for the pod.

Answer

Using 'securityContext.seccompProfile.type: RuntimeDefault' with 'localhostProfile' set

Answer

Configuring the kubelet with --seccomp-default-profile flag

Answer

Adding a seccomp profile to the container image and referencing it in the pod spec

Question 3

Which TWO of the following are CIS Benchmark recommendations for securing the API server?

Accepted Answer

Disable anonymous authentication. The CIS Benchmark for Kubernetes recommends disabling anonymous authentication to ensure that all requests to the API server are authenticated. By setting the `--anonymous-auth=false` flag on the kube-apiserver, unauthenticated requests are rejected, which prevents anonymous users from accessing the cluster. This is a fundamental security hardening step to enforce identity verification for every API call.

Answer

Enable the insecure port (--insecure-port)

Answer

Use ABAC mode for authorization

Answer

Disable TLS

Question 4

A developer wants to ensure that a pod always uses a specific version of an image that cannot be changed without updating the manifest. Which image reference should be used?

Accepted Answer

myimage@sha256:abcdef.... (myimage@sha256:abcdef...) uses a digest-based image reference, which pins the image to an immutable content hash. This ensures that the exact same image is always pulled, regardless of tag updates, and any change to the image would require updating the manifest. This aligns with the requirement that the image version cannot be changed without modifying the manifest.

Answer

myimage:latest

Answer

myimage:v1.0

Answer

myimage:1.0.0

Question 5

You run 'kubectl auth can-i --list --as=admin' and see that the admin user has full cluster-admin access. Which command would create a ClusterRoleBinding for a user named 'viewer' with read-only access to all resources?

Accepted Answer

kubectl create clusterrolebinding viewer-binding --clusterrole=view --user=viewer. It uses `kubectl create clusterrolebinding` to bind the built-in `view` ClusterRole (which grants read-only access: get, list, watch) to the user `viewer` at the cluster scope. A ClusterRoleBinding is required to grant permissions across all namespaces, and the `--clusterrole` flag correctly references the ClusterRole, not a Role.

Answer

kubectl create rolebinding viewer-binding --clusterrole=view --user=viewer

Answer

kubectl create clusterrole viewer --verb=get,list,watch --resource=*

Answer

kubectl create clusterrolebinding viewer-binding --role=view --user=viewer

Question 6

Which TWO of the following are recommended settings for the Kubernetes API server according to the CIS Kubernetes Benchmark? (Select TWO)

Accepted Answer

--anonymous-auth=false. The CIS Kubernetes Benchmark recommends disabling anonymous authentication by setting `--anonymous-auth=false` on the API server. This ensures that all requests must be authenticated, preventing unauthenticated access to the cluster's control plane.

Answer

--authorization-mode=AlwaysAllow

Answer

--anonymous-auth=true

Answer

--enable-admission-plugins=AlwaysAdmit

Question 7

Which THREE of the following are best practices for RBAC hardening in Kubernetes? (Select THREE)

Accepted Answer

Avoid using the cluster-admin ClusterRole for service accounts. The cluster-admin ClusterRole grants unrestricted access to all Kubernetes resources across all namespaces, which violates the principle of least privilege. Service accounts should be assigned only the specific permissions required for their function, not full administrative access. Using cluster-admin for service accounts increases the blast radius of a potential compromise and is a common misconfiguration that the CKS exam penalizes.

Answer

Grant cluster-admin to all service accounts for simplicity

Answer

Use the default namespace for all service accounts

Question 8

A security team wants to ensure that all container images in a cluster are scanned for critical CVEs before they are run. They decide to use an admission controller. Which Kubernetes built-in admission controller should they configure?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller is the correct choice because it allows an external webhook to validate container images against a policy (e.g., scanning for critical CVEs) before they are admitted into the cluster. It intercepts Pod creation requests and queries an external service to decide whether the image is allowed, making it ideal for enforcing image security scanning at admission time.

Answer

MutatingAdmissionWebhook

Answer

ValidatingAdmissionPolicy

Answer

PodSecurity

Question 9

Which of the following is a BEST practice for securing container images in a Dockerfile?

Accepted Answer

Use the USER directive to specify a non-root user. The USER directive in a Dockerfile sets the user for the container process, and using a non-root user (e.g., USER 1000) follows the principle of least privilege. This reduces the attack surface by preventing an attacker who gains code execution from having root access to the host or container, which is a critical security requirement for containerized workloads.

Answer

Store secrets in environment variables in the image

Answer

Run the container as root to simplify permission management

Answer

Use the 'latest' tag to always get the newest base image

Question 10

What is the purpose of the `allowPrivilegeEscalation: false` setting in a container's security context?

Accepted Answer

It prevents processes from gaining additional privileges (e.g., via setuid).. The `allowPrivilegeEscalation: false` setting in a container's security context directly controls whether processes within the container can gain more privileges than their parent process. This is achieved by dropping the `CAP_SETUID`, `CAP_SETGID`, and `CAP_SETPCAP` capabilities and, crucially, by setting the `no_new_privs` flag on the container's process, which prevents the use of setuid/setgid binaries and other privilege-escalation mechanisms. This is a core security control to mitigate container breakout via privilege escalation.

Answer

It prevents the container from running as root.

Answer

It prevents the container from using host networking.

Answer

It prevents the container from accessing host devices.

Question 11

A pod named 'busybox-pod' is compromised. You want to isolate it from all other pods using a NetworkPolicy. Which YAML snippet correctly denies all ingress and egress traffic to/from the pod?

Accepted Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate
spec:
  podSelector:
    matchLabels:
      app: busybox
  policyTypes:
  - Ingress
  - Egress. It uses the correct apiVersion (networking.k8s.io/v1) and explicitly specifies both Ingress and Egress in policyTypes with an empty rules array, which denies all ingress and egress traffic to/from the selected pod. Without any rules, the policy defaults to denying all traffic of the specified types, effectively isolating the pod.

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate
spec:
  podSelector:
    matchLabels:
      app: busybox
  egress:
  - to:
    - podSelector: {}

Answer

apiVersion: v1
kind: NetworkPolicy
metadata:
  name: isolate
spec:
  podSelector: {}
  policyTypes:
  - Ingress

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate
spec:
  podSelector:
    matchLabels:
      app: busybox
  ingress:
  - from:
    - podSelector: {}

Question 12

You are tasked with creating a Kubernetes admission controller that validates image signatures before allowing pods to run. Which admission controller should you configure?

Accepted Answer

ImagePolicyWebhook. The ImagePolicyWebhook admission controller is specifically designed to validate container image signatures against an external policy engine (e.g., OPA, Sigstore) before a pod is admitted. It intercepts pod creation requests and sends the image metadata to a webhook endpoint, which returns an allow/deny decision based on signature verification. This directly addresses the requirement to enforce image signature validation as part of supply chain security.

Answer

MutatingAdmissionWebhook

Answer

ValidatingAdmissionWebhook

Answer

NodeRestriction

Question 13

You need to ensure that all containers in a pod run as non-root. Which security context field should you set to enforce this?

Accepted Answer

runAsNonRoot: true. Setting `runAsNonRoot: true` in the pod or container security context instructs Kubernetes to verify that the container's user ID (UID) is non-zero (i.e., not root) before starting the container. If the container image is configured to run as root (UID 0), the Pod will fail to start, ensuring compliance with the requirement that all containers run as non-root.

Answer

privileged: false

Answer

readOnlyRootFilesystem: true

Answer

allowPrivilegeEscalation: false

Question 14

Match each Kubernetes network security concept to its definition.

Accepted Answer

NetworkPolicy: A Kubernetes resource that defines rules for ingress and egress traffic to and from pods.. Correct matches: NetworkPolicy defines ingress/egress rules; Calico network policy extends with advanced features; Ingress rule controls inbound traffic; Egress rule controls outbound traffic; Default deny blocks all unless allowed. Common confusions include swapping ingress and egress definitions and mistaking non-native policies as native.

Answer

Egress rule: In a NetworkPolicy, specifies which incoming traffic is allowed to reach pods.

Answer

Calico network policy: A Kubernetes native resource for network segmentation.

Question 15

Which THREE of the following are valid approaches to prevent containers from running as root in a Kubernetes cluster?

Accepted Answer

Use Pod Security Admission with the 'restricted' profile. Pod Security Admission (PSA) is a built-in Kubernetes admission controller that enforces Pod Security Standards (PSS). The 'restricted' profile, as defined in the Kubernetes documentation, requires that containers run with `runAsNonRoot: true`, preventing root execution at the admission level without needing external tools.

Answer

Set the container's entrypoint to 'sudo'

Answer

Use a Seccomp profile that blocks root system calls