CKS Practice Test 41 — 15 Questions

Question 1

Which command would you run to check if anonymous authentication is enabled on the API server?

Accepted Answer

ps aux | grep kube-apiserver | grep anonymous-auth. The `--anonymous-auth` flag on the kube-apiserver binary controls whether anonymous requests are allowed. Running `ps aux | grep kube-apiserver | grep anonymous-auth` directly inspects the running process arguments to see if the flag is set to `true` (enabled) or `false` (disabled). This is the most direct way to check the runtime configuration of the API server.

Answer

kubectl get nodes -o yaml | grep anonymous

Answer

kubectl describe configmap anonymous

Answer

kubectl get clusterrolebinding anonymous

Question 2

To encrypt secrets at rest in Kubernetes, an administrator configures an EncryptionConfiguration. What is the correct flag to pass to the kube-apiserver to use this configuration?

Accepted Answer

--encryption-provider-config=/path/to/config.yaml. The `--encryption-provider-config` flag is the exact command-line option that the kube-apiserver expects to locate the EncryptionConfiguration YAML file. This flag tells the API server to read the configuration that defines which encryption providers (e.g., `aescbc`, `secretbox`) to use for encrypting Kubernetes secrets at rest in etcd.

Answer

--feature-gates=EncryptionAtRest=true

Answer

--encryption-key=/path/to/config.yaml

Answer

--encryption-config=/path/to/config.yaml

Question 3

An administrator runs 'trivy image myapp:1.0' and receives an output with several CRITICAL vulnerabilities. What is the best next step to ensure the image is secure before deployment?

Accepted Answer

Rebuild the image using updated base images and fix the identified vulnerabilities. The best practice for addressing container image vulnerabilities is to rebuild the image using updated base images and apply patches for the identified CVEs. Trivy reports vulnerabilities in the image layers, and simply deleting or ignoring them does not resolve the security issues; rebuilding with patched dependencies ensures the image is secure before deployment.

Answer

Delete the image entirely and do not deploy

Answer

Deploy the image anyway because vulnerabilities are common

Answer

Ignore the output and re-run the scan

Question 4

In a Falco rule, you have the condition: 'evt.type=execve and proc.name=bash and container.id!=host'. What does this rule detect?

Accepted Answer

A bash shell being spawned inside a container. The rule triggers when a bash shell is executed (execve) inside any container (container.id != host). It does not check for interactive use; it simply detects bash execution.

Answer

A non-root bash process on the host

Answer

An interactive shell session inside a container

Answer

A bash process reading /etc/shadow

Question 5

Which annotation is used to apply an AppArmor profile named 'custom-profile' to a container named 'app' in a pod?

Accepted Answer

container.apparmor.security.beta.kubernetes.io/app: localhost/custom-profile. The annotation for applying an AppArmor profile to a specific container in a pod follows the format `container.apparmor.security.beta.kubernetes.io/: localhost/`. This annotation targets the container named 'app' with the profile 'custom-profile', which is loaded locally on the node.

Answer

apparmor.security.beta.kubernetes.io/container.app: localhost/custom-profile

Answer

security.beta.kubernetes.io/apparmor: localhost/custom-profile

Answer

pod.apparmor.security.beta.kubernetes.io/app: localhost/custom-profile

Question 6

An administrator wants to enable audit logging for the Kubernetes API server. Which of the following is required?

Accepted Answer

Set --audit-log-path and --audit-policy-file flags on the kube-apiserver. Audit logging in Kubernetes is configured directly on the kube-apiserver component. The `--audit-log-path` flag specifies the file path where audit logs are written, and the `--audit-policy-file` flag points to a YAML file that defines which events (e.g., requests, responses, metadata) should be logged and at what level (e.g., Metadata, Request, RequestResponse). These flags are required to enable and control audit logging; no feature gate is needed because audit logging is built-in since Kubernetes 1.8.

Answer

Enable the AuditLogging feature gate

Answer

Create a ClusterRoleBinding with audit permissions

Answer

Set --audit-log-path flag on the kubelet

Question 7

Which tool is used to generate an SBOM (Software Bill of Materials) for a container image?

Accepted Answer

Syft. Syft is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. It uses a pluggable cataloger system to extract package metadata (e.g., dpkg, RPM, APK, Python, Java JARs) and outputs the SBOM in formats like CycloneDX or SPDX, which are the standard formats for supply chain transparency.

Answer

Clair

Answer

Kubesec

Answer

Trivy

Question 8

Which THREE of the following are valid capabilities that should be dropped for a container running a typical non-privileged application to adhere to the principle of least privilege?

Accepted Answer

SYS_ADMIN. The SYS_ADMIN capability is a highly privileged capability that grants access to a wide range of system administration operations, such as mounting filesystems, namespace manipulation, and kernel settings. For a typical non-privileged application, dropping SYS_ADMIN is essential to adhere to the principle of least privilege, as it prevents the container from performing host-level administrative actions that could compromise isolation.

Answer

CHOWN

Answer

SETUID

Question 9

An administrator wants to enforce that all containers in a Kubernetes cluster run as non-root and have read-only root filesystems using OPA/Gatekeeper. Which two resources must be created?

Accepted Answer

ConstraintTemplate and Constraint. OPA/Gatekeeper enforces policies via the Constraint Framework, which requires two resources: a ConstraintTemplate (defining the policy logic in Rego) and a Constraint (applying the template to specific resources). Together, they allow you to require containers run as non-root and have read-only root filesystems by evaluating admission requests against the defined rules.

Answer

NetworkPolicy and RoleBinding

Answer

PodSecurityPolicy and ClusterRole

Answer

ValidatingWebhookConfiguration and MutatingWebhookConfiguration

Question 10

A cluster uses Kyverno to enforce that all images come from a trusted registry. A new Deployment fails with a message that the image 'docker.io/library/nginx:latest' is not allowed. What Kyverno policy rule likely caused this?

Accepted Answer

A validate rule that checks the image registry. Kyverno uses validate rules to enforce policies by checking resource attributes against defined conditions. The error message indicates that the image 'docker.io/library/nginx:latest' was rejected because it does not come from a trusted registry. A validate rule with a pattern or deny condition that inspects the image field (e.g., `spec.containers[*].image`) and restricts it to a specific registry prefix (like `trusted-registry.io/*`) would cause this rejection.

Answer

A validate rule that checks the container's resource limits

Answer

A generate rule that creates a ConfigMap

Answer

A mutating rule that adds a label to the pod

Question 11

An administrator wants to secure etcd communication. Which of the following is required?

Accepted Answer

Enable TLS with client certificate authentication. Etcd, as a distributed key-value store, requires TLS encryption with mutual authentication (client certificates) to secure communication between the API server and etcd, as well as between etcd peers. The `--etcd-servers` flag in kube-apiserver must point to HTTPS endpoints, and `--etcd-certfile` and `--etcd-keyfile` enable client certificate authentication, ensuring that only authenticated clients can access etcd data.

Answer

Set --etcd-servers to use HTTPS

Answer

Use SSH tunneling between etcd members

Answer

Enable etcd RBAC

Question 12

You have a pod that is in CrashLoopBackOff. You want to inspect the logs from the previous instance of the container. Which flag should you use with kubectl logs?

Accepted Answer

--previous. When a pod is in CrashLoopBackOff, the current container instance has crashed and restarted, so its logs may be empty or not reflect the crash. The `--previous` flag (or `-p`) tells `kubectl logs` to show logs from the previous instance of the container, which contains the output from the crashed process. This is the correct way to retrieve crash-related logs without waiting for the new instance to produce output.

Answer

--tail

Answer

--all-containers

Answer

--since

Question 13

You are responsible for a production Kubernetes cluster running critical workloads. The cluster uses containerd as the container runtime. The security team has deployed Falco with default rules and it is running as a DaemonSet. Recently, the team noticed that several pods have been unexpectedly terminated by the OOMKiller. You suspect a container is performing a fork bomb attack, exhausting memory. You need to detect and prevent such attacks in real-time. Falco is already installed. Which single action should you take to best address this threat?

Accepted Answer

Enable the Falco rule that detects rapid process creation (fork bomb) and configure an alert.. Falco's default rules include a rule for 'Fork Bomb' that detects rapid process creation by monitoring the `clone` and `fork` syscalls. Enabling this rule and configuring an alert allows real-time detection of fork bomb attacks, which is the most direct and effective action to address the threat. This leverages Falco's existing capability to identify anomalous syscall patterns without requiring additional tooling or configuration changes.

Answer

Adjust the OOM score of critical pods to prevent them from being killed.

Answer

Apply a seccomp profile that blocks the fork and clone syscalls.

Answer

Set resource quotas on all namespaces to limit memory usage.

Question 14

An administrator creates a custom seccomp profile and places it at /var/lib/kubelet/seccomp/myprofile.json. Which securityContext field is used to apply this profile to a container?

Accepted Answer

seccompProfile:
  type: Localhost
  localhostProfile: "myprofile.json". When using a custom seccomp profile stored on the node, the `type` must be `Localhost`, and the `localhostProfile` field must contain only the filename (e.g., `myprofile.json`), not the full path. Kubernetes automatically prepends `/var/lib/kubelet/seccomp/` to the filename, so specifying the full path would cause the profile to be looked up in the wrong location, resulting in a failure to apply the profile.

Answer

seccompProfile:
  type: Localhost
  localhostProfile: "/var/lib/kubelet/seccomp/myprofile.json"

Answer

seccompProfile:
  type: RuntimeDefault
  localhostProfile: "myprofile.json"

Answer

seccompProfile:
  type: Unconfined
  localhostProfile: "myprofile.json"

Question 15

Which of the following is the correct flag to enable audit logging on the kube-apiserver?

Accepted Answer

--audit-log-path. `--audit-log-path` is the flag used to specify the file path where the kube-apiserver writes audit log entries. This flag is defined in the Kubernetes API server component and is required to enable audit logging; without it, no audit logs are written.

Answer

--audit-file

Answer

--audit-policy-file

Answer

--audit-log-file