CKS Practice Test 34 — 15 Questions

Question 1

A CI/CD pipeline builds a Docker image and pushes it to a registry. To ensure supply chain security, the pipeline should scan the image for vulnerabilities before deployment. Which of the following is the correct command to scan a local Docker image using Trivy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

trivy image myimage:latest. `trivy image` is the specific subcommand used to scan a local Docker image for vulnerabilities. Trivy requires the `image` subcommand followed by the image name and tag (e.g., `myimage:latest`) to analyze the image layers and report CVEs. This command directly integrates with the local Docker daemon to access the image.

Answer

trivy fs --image myimage:latest

Answer

trivy scan myimage:latest

Answer

trivy check myimage:latest

Question 2

What does SBOM stand for in the context of supply chain security?

Accepted Answer

Software Bill of Materials. SBOM stands for Software Bill of Materials. It is a formal, machine-readable inventory of all components, libraries, and dependencies used to build a software artifact. In supply chain security, an SBOM enables organizations to quickly identify and remediate vulnerabilities (e.g., Log4Shell) by tracking which versions of open-source or third-party components are included in a release.

Answer

Systematic Bug and Oversight Manager

Answer

Secure Build Orchestration Manager

Answer

Source Binary Object Model

Question 3

A pod is running with securityContext.seccompProfile.type: Unconfined. Which statement is true?

Accepted Answer

The container can make any system call.. When `securityContext.seccompProfile.type` is set to `Unconfined`, the container is allowed to make any system call without restriction. Seccomp (secure computing mode) is a Linux kernel feature that filters syscalls; `Unconfined` explicitly disables this filter, granting the container full syscall access. This is the most permissive seccomp profile and is the default if no profile is specified in older Kubernetes versions.

Answer

The container is limited to a set of allowed syscalls as defined by the runtime.

Answer

Seccomp is not supported on this node.

Answer

The container is running with the host's seccomp profile.

Question 4

Which TWO of the following are valid Pod Security Standards levels?

Accepted Answer

privileged. The Pod Security Standards (PSS) define three levels: privileged, baseline, and restricted. 'Privileged' is the most permissive level, allowing all known privilege escalations and is intended for system-level workloads that require unrestricted access to host resources.

Answer

secure

Answer

default

Answer

strict

Question 5

Which TWO of the following are best practices for securing the software supply chain in a CI/CD pipeline?

Accepted Answer

Scan all container images for known vulnerabilities before deployment. Scanning container images for known vulnerabilities (e.g., using Trivy, Clair, or Grype) before deployment is a fundamental supply chain security practice. It ensures that only images free of critical or high-severity CVEs are promoted to production, reducing the attack surface and preventing exploitation of known flaws.

Answer

Use the 'latest' tag for base images to get the newest features

Answer

Store sensitive credentials directly in the pipeline YAML file

Answer

Ignore critical CVEs if they are in development environments

Question 6

Which of the following is a static analysis tool for Kubernetes manifests that can identify security misconfigurations?

Accepted Answer

kubesec. kubesec is a static analysis tool that scans Kubernetes manifests (YAML/JSON) and assigns a security score based on misconfigurations such as running containers as root, missing resource limits, or allowing privilege escalation. It operates offline without requiring a running cluster, making it a pure static analysis tool for identifying security issues in manifests before deployment.

Answer

Clair

Answer

OPA/Gatekeeper

Answer

Notary

Question 7

An admin wants to enforce that all pods in a namespace use a read-only root filesystem except for a specific deployment that needs to write to a temporary directory. Which approach best meets this requirement?

Accepted Answer

Use a Gatekeeper Constraint that denies pods with readOnlyRootFilesystem not set to true, but add an exception label on the specific deployment's namespace or pod, and modify the Constraint to skip pods with that label. Gatekeeper (OPA/Gatekeeper) allows you to define a Constraint that denies pods without `readOnlyRootFilesystem: true`, and you can add an exception label on the specific deployment's pod template. By modifying the Constraint to skip pods with that label (using a `labelSelector` or `excludedNamespaces` in the Constraint's spec), you enforce the policy for all pods except the exempted deployment, meeting the requirement without manual patching or legacy PSPs.

Answer

Set a default readOnlyRootFilesystem: true via a mutating webhook, and then manually patch the specific deployment after creation

Answer

Modify the PodSecurityPolicy to allow readOnlyRootFilesystem: false for the specific deployment's service account

Answer

Set readOnlyRootFilesystem: true in the deployment's pod template and add an emptyDir volume for the temporary directory

Question 8

Which TWO of the following are tools that can be used to generate an SBOM for a container image?

Accepted Answer

Trivy. Trivy is a comprehensive vulnerability scanner that can also generate Software Bill of Materials (SBOM) for container images. It supports multiple output formats such as CycloneDX and SPDX, making it a valid tool for SBOM generation. Syft is specifically designed to generate SBOMs from container images and filesystems, producing output in formats like CycloneDX, SPDX, and Syft's own JSON format. Both tools are widely used in supply chain security workflows.

Answer

Cosign

Answer

Clair

Answer

Kubesec

Question 9

In an Istio service mesh, you want to enforce mutual TLS (mTLS) between all services in the 'default' namespace. Which resource should you create?

Accepted Answer

PeerAuthentication with mTLS mode STRICT. To enforce mutual TLS (mTLS) between all services in the 'default' namespace, you create a PeerAuthentication resource with mTLS mode set to STRICT. This policy enforces that all traffic within the namespace must use mTLS, rejecting any plaintext connections. PeerAuthentication is the Istio resource specifically designed to define mTLS enforcement at the namespace or mesh level.

Answer

Sidecar resource with outboundTrafficPolicy REGISTRY_ONLY

Answer

ServiceEntry with resolution NONE

Answer

DestinationRule with trafficPolicy tls mode ISTIO_MUTUAL

Question 10

A cluster administrator wants to ensure that all Secrets are encrypted at rest using AES-CBC with a key managed by the local Kubernetes API server. Which configuration is required?

Accepted Answer

Set --encryption-provider-config flag to a file containing EncryptionConfiguration with 'aescbc' provider. The `--encryption-provider-config` flag on the kube-apiserver points to a YAML file containing an `EncryptionConfiguration` resource. Within that configuration, specifying the `aescbc` provider enables AES-CBC encryption for Secrets at rest, with the encryption key managed locally by the API server. This is the only option that satisfies the requirement for AES-CBC encryption with a locally managed key.

Answer

Enable etcd encryption by setting --experimental-encryption-provider-config

Answer

Use Secret resource's 'data' field with base64 encoding

Answer

Set --encryption-provider-config flag to a file containing EncryptionConfiguration with 'identity' provider

Question 11

You are using External Secrets Operator to sync secrets from HashiCorp Vault. The operator is deployed but secrets are not being created. Which resource defines the mapping between Vault secrets and Kubernetes secrets?

Accepted Answer

ExternalSecret. The ExternalSecret resource is the core custom resource definition (CRD) in the External Secrets Operator (ESO) that defines the mapping between a secret stored in an external provider (like HashiCorp Vault) and a Kubernetes Secret. It specifies which remote secret path and key to fetch, and how to transform that data into the desired Kubernetes Secret object. Without an ExternalSecret, the operator has no instruction to create or sync any Kubernetes Secret.

Answer

ClusterSecretStore

Answer

VaultSecret

Answer

SecretStore

Question 12

You need to ensure that the kubelet only serves authenticated and authorized requests. Which flag(s) should be set on the kubelet?

Accepted Answer

--anonymous-auth=false and --authorization-mode=Webhook. Setting `--anonymous-auth=false` disallows unauthenticated requests to the kubelet, and `--authorization-mode=Webhook` delegates authorization decisions to an external service (e.g., the API server's SubjectAccessReview), ensuring that only authenticated and authorized requests are served. This combination enforces both authentication and authorization, which is required for hardening the kubelet.

Answer

--anonymous-auth=false and --authorization-mode=AlwaysAllow

Answer

--anonymous-auth=true and --authorization-mode=Webhook

Answer

--authenticated=true and --authorization=RBAC

Question 13

A pod fails to start with the error 'Container runtime network not ready', and the node uses Kata Containers (RuntimeClass: kata). What is the most likely cause?

Accepted Answer

The CNI plugin is not configured correctly for the kata RuntimeClass. Kata Containers use lightweight VMs for pod isolation, which require a separate CNI plugin (e.g., flannel, calico) to be configured specifically for the kata RuntimeClass. The error 'Container runtime network not ready' indicates that the CNI plugin is either missing, misconfigured, or not compatible with the kata runtime, preventing the pod's network namespace from being set up.

Answer

The node has insufficient memory

Answer

The pod is trying to mount a hostPath volume

Answer

The pod's securityContext sets runAsNonRoot: true

Question 14

Which TWO of the following are recommended practices for securing container images and runtime?

Accepted Answer

Set runAsNonRoot to true in securityContext. Setting `runAsNonRoot: true` in the securityContext ensures that the container's entrypoint runs with a user ID other than 0 (root), reducing the risk of container escape if an attacker gains code execution. Setting `readOnlyRootFilesystem: true` makes the container's filesystem read-only, preventing attackers from modifying critical system files or binaries. Both are key hardening practices recommended by Kubernetes security best practices.

Answer

Run containers as root inside the container for easier management

Answer

Mount the docker socket inside the container for debugging

Answer

Use the latest tag for all images

Question 15

Which THREE of the following are true about Istio PeerAuthentication? (Select THREE.)

Accepted Answer

It can be used to enable mTLS for all workloads in a namespace. Istio PeerAuthentication defines the mutual TLS (mTLS) mode for traffic between services within a mesh. When applied at the namespace level, it enforces the specified mTLS mode (e.g., STRICT) for all workloads in that namespace, ensuring that all inter-service communication uses TLS certificates for identity and encryption.

Answer

It configures how traffic is routed between services

Answer

It requires a DestinationRule to define the TLS settings