CKS Practice Test 35 — 15 Questions

Question 1

You want to run a container with gVisor for sandboxing. After installing gVisor and creating a RuntimeClass named 'gvisor', which Pod configuration enables it?

Accepted Answer

Set spec.runtimeClassName: gvisor. The `spec.runtimeClassName` field in a Pod spec is the standard Kubernetes mechanism to select a specific container runtime for that Pod. When a RuntimeClass named 'gvisor' is created, setting `spec.runtimeClassName: gvisor` instructs the kubelet to use the gVisor runtime (runsc) to run the Pod's containers, providing an additional sandboxing layer for security.

Answer

Set spec.nodeSelector with 'gvisor: true'

Answer

Define an environment variable RUNTIME=gvisor in the container

Answer

Add an annotation 'container.runtime: gvisor' to the Pod

Question 2

A cluster has EncryptionConfiguration with aescbc provider. After rotating the encryption key, what must be done to re-encrypt existing Secrets with the new key?

Accepted Answer

Use 'kubectl get secrets --all-namespaces -o yaml | kubectl replace -f -'. After rotating the encryption key in the EncryptionConfiguration, existing Secrets are still encrypted with the old key. To re-encrypt them with the new key, you must read all Secrets and write them back using 'kubectl get secrets --all-namespaces -o yaml | kubectl replace -f -'. This triggers the API server to encrypt the data with the new key (the first provider in the list) during the write operation.

Answer

Delete and recreate all Secrets

Answer

Restart the API server

Answer

Run 'kubectl encrypt secrets --key new-key'

Question 3

A security audit reveals that etcd does not encrypt data at rest. Which resource must be created to enable encryption?

Accepted Answer

EncryptionConfiguration YAML file and pass it to the API server via --encryption-provider-config. Kubernetes enables etcd data-at-rest encryption through an EncryptionConfiguration YAML file, which defines how to encrypt resources at the API server level. This file is passed to the kube-apiserver via the `--encryption-provider-config` flag, allowing providers like `aescbc` or `secretbox` to encrypt etcd data transparently.

Answer

Secret with encryption key

Answer

Deployment for etcd with encryption flag

Answer

ConfigMap with encryption key

Question 4

Which TWO of the following are valid methods to verify the integrity of a container image before deployment?

Accepted Answer

Use the image digest (SHA256) instead of a tag. Using the image digest (SHA256) provides a cryptographic hash of the image manifest, ensuring that the exact same image content is pulled every time, regardless of tag changes. This prevents tag mutability attacks where a malicious actor could overwrite a tag with a compromised image. The digest is immutable and uniquely identifies the image content.

Answer

Run a vulnerability scan on the image

Answer

Use the latest tag to ensure the most recent version

Answer

Generate an SBOM for the image

Question 5

During a CI/CD pipeline, you run 'trivy image myapp:latest' and get a high number of vulnerabilities. What is the BEST action to reduce the vulnerability count?

Accepted Answer

Switch to a distroless base image. Distroless base images contain only the essential runtime dependencies (e.g., glibc, libssl) and exclude package managers, shells, and other utilities that are common sources of CVEs. By switching to a distroless image, you drastically reduce the attack surface and the number of packages that Trivy scans, directly lowering the vulnerability count without changing application code.

Answer

Increase CPU and memory limits for the container

Answer

Sign the image with Cosign

Answer

Remove all environment variables from the Dockerfile

Question 6

What is the purpose of the 'seccomp' feature in Kubernetes?

Accepted Answer

To restrict the system calls a container can make. Seccomp (secure computing mode) is a Linux kernel feature that allows a process to specify a filter for the system calls it can make. In Kubernetes, seccomp profiles can be applied to pods or containers to restrict the allowed syscalls, reducing the kernel attack surface. This is a key mechanism for container runtime security, distinct from filesystem, capability, or network controls.

Answer

To restrict file system access for a container

Answer

To restrict the Linux capabilities a container can use

Answer

To restrict network access for a container

Question 7

Which admission controller is responsible for validating and mutating requests based on webhooks?

Accepted Answer

ValidatingAdmissionWebhook and MutatingAdmissionWebhook. The ValidatingAdmissionWebhook and MutatingAdmissionWebhook admission controllers are specifically designed to intercept admission requests and call external webhooks to validate or mutate the request. MutatingAdmissionWebhook can modify the object (e.g., inject sidecar containers) before it is persisted, while ValidatingAdmissionWebhook only validates and can reject the request. These controllers are the only ones that delegate admission decisions to external HTTP callbacks.

Answer

ServiceAccount

Answer

PodSecurityPolicy

Answer

NodeRestriction

Question 8

A pod is created with the following security context:
securityContext:
  seccompProfile:
    type: Localhost
    localhostProfile: profiles/audit.json
Where must the 'audit.json' file be placed on the node?

Accepted Answer

/var/lib/kubelet/seccomp/profiles/audit.json. When a pod uses a `seccompProfile` of type `Localhost` with `localhostProfile: profiles/audit.json`, the file path is relative to the kubelet's seccomp root directory, which defaults to `/var/lib/kubelet/seccomp`. Therefore, the complete path on the node must be `/var/lib/kubelet/seccomp/profiles/audit.json`. This is the only location where the kubelet will look for the seccomp profile when `type: Localhost` is specified.

Answer

/etc/kubernetes/seccomp/profiles/audit.json

Answer

/var/lib/kubelet/audit.json

Answer

/var/lib/containerd/seccomp/audit.json

Question 9

What is the primary purpose of using a service mesh like Istio for microservices security?

Accepted Answer

To provide mTLS communication between services for encrypted and authenticated traffic.. The primary purpose of a service mesh like Istio for microservices security is to enforce mutual TLS (mTLS) between services, ensuring that all inter-service communication is both encrypted and authenticated. This is achieved by injecting sidecar proxies (Envoy) that handle TLS termination and certificate management transparently, without requiring changes to application code.

Answer

To replace Kubernetes NetworkPolicies for network segmentation.

Answer

To provide a centralized logging solution.

Answer

To automatically scale pods based on CPU usage.

Question 10

An OPA/Gatekeeper constraint is configured to allow only images from 'trusted-registry.io'. A pod is created with image 'trusted-registry.io/app:v1' but is denied. Which is the MOST likely cause?

Accepted Answer

The constraint uses regex and the image does not match the pattern. The most likely cause is that the OPA/Gatekeeper constraint uses a regex pattern to match allowed image registries, and the image 'trusted-registry.io/app:v1' does not match that pattern. Gatekeeper constraints often rely on Rego rules that check image strings against regex patterns; if the pattern is too restrictive or incorrectly defined (e.g., requiring a trailing slash or specific path), valid images can be denied. This is a common misconfiguration where the regex does not account for the full image reference format.

Answer

The constraint is only applied in the default namespace

Answer

The image tag is not pinned to a digest

Answer

The image is not signed

Question 11

A cluster administrator wants to audit all pod creations and modifications using an admission webhook. Which resource type should be created to register the webhook?

Accepted Answer

ValidatingWebhookConfiguration. A ValidatingWebhookConfiguration is the correct resource type to register an admission webhook that audits pod creations and modifications. This resource tells the API server which external HTTP callbacks to invoke during the admission process, specifically for validation (non-mutating) purposes. It defines the rules for matching API requests (e.g., operations like CREATE and UPDATE on pods) and the webhook endpoint that receives AdmissionReview requests.

Answer

WebhookConfiguration

Answer

MutatingWebhookConfiguration

Answer

AdmissionWebhook

Question 12

Which of the following is a valid approach to enforce that containers cannot escalate privileges?

Accepted Answer

Set securityContext.allowPrivilegeEscalation: false. Setting `securityContext.allowPrivilegeEscalation: false` directly prevents a container from gaining more privileges than its parent process, such as through setuid binaries or `NO_NEW_PRIVS` flag. This is a key control to block privilege escalation attacks even if the container runs with some capabilities. It is enforced at the kernel level via the `no_new_privs` attribute, which disables privilege-gaining operations like `setuid` and `setgid`.

Answer

Set securityContext.readOnlyRootFilesystem: true

Answer

Set securityContext.privileged: false

Answer

Set securityContext.capabilities.drop: ["ALL"]

Question 13

Which THREE of the following are common indicators of a container compromise that Falco can detect? (Select 3)

Accepted Answer

Unexpected outbound network connections. Falco is a runtime security tool that monitors system calls and container behavior. Unexpected outbound network connections are a classic indicator of compromise, such as a reverse shell or data exfiltration, and Falco can detect these by monitoring syscalls like `connect()` and `sendto()` against a rule set that flags connections to suspicious destinations or on unusual ports.

Answer

High CPU usage

Answer

Pod restarting in a loop

Question 14

Which three of the following are valid methods to restrict access to etcd? (Choose three.)

Accepted Answer

Enable RBAC authorization on etcd. Etcd supports Role-Based Access Control (RBAC) natively since version 3.0. By enabling RBAC on etcd, you can define roles and permissions to restrict which users or processes can read or write to specific keys or prefixes. This is a direct method to secure the etcd datastore against unauthorized access.

Answer

Disable the etcd API and use only the embedded etcd in control plane

Answer

Encrypt etcd data at rest using EncryptionConfiguration

Question 15

A cluster administrator wants to run some workloads in a sandboxed environment using gVisor. Which Kubernetes resource must be created first to allow pods to request the gVisor runtime?

Accepted Answer

Create a RuntimeClass resource that specifies the gVisor runtime handler. C is correct because in Kubernetes, a RuntimeClass resource must be created to define a container runtime configuration, such as gVisor. This resource specifies a runtime handler (e.g., 'runsc') that the container runtime uses to run pods in a sandboxed environment. Pods can then reference this RuntimeClass via the `runtimeClassName` field in their spec to request the gVisor runtime.

Answer

Create a new PodSecurityPolicy that allows the gVisor runtime

Answer

Create a custom resource definition for the runtime

Answer

Add a `runtimeClass` field to the pod spec