CKS Practice Test 46 — 15 Questions

Question 1

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the memory limit in the pod's container resource specification. The pod is in CrashLoopBackOff due to OOMKilled, meaning the container is being terminated by the Linux kernel's Out-Of-Memory (OOM) killer because it exceeds its memory limit. Increasing the memory limit in the container's resource specification allows the container to allocate more memory without being killed, directly addressing the root cause.

Answer

Delete the namespace and redeploy all workloads

Answer

Delete and recreate the pod to clear the crash loop

Answer

Increase the CPU request for the container

Question 2

You are auditing a cluster for runtime security best practices. Which TWO of the following actions are recommended to improve container runtime security?

Accepted Answer

Deploy Falco to monitor system calls and detect anomalous behavior.. Falco is a CNCF-graduated runtime security tool that uses eBPF or kernel modules to monitor system calls in real time, detecting anomalous behavior such as unexpected process execution or file writes. Deploying Falco is a recommended best practice for runtime security because it provides deep visibility into container activity without requiring application changes, and it can trigger alerts or actions based on customizable rules.

Answer

Disable the container runtime's security engine to reduce overhead.

Answer

Run containers in privileged mode for better performance.

Answer

Set AppArmor to unconfined for all pods to avoid profile conflicts.

Question 3

You need to enable audit logging for the Kubernetes API server to capture all requests at the RequestResponse level. Which flag should you add to the kube-apiserver configuration?

Accepted Answer

--audit-policy-file=/etc/kubernetes/audit-policy.yaml. The --audit-policy-file flag points the kube-apiserver to the YAML file that defines audit levels (None, Metadata, Request, RequestResponse) and rules for which requests to log. To capture requests at the RequestResponse level, you must define that level in the audit policy file and pass it via this flag. Without this flag, the API server has no audit policy and will not produce audit events.

Answer

--audit-webhook-config-file=/etc/kubernetes/audit-webhook.yaml

Answer

--audit-log-path=/var/log/audit.log

Answer

--authorization-mode=RBAC

Question 4

Arrange the steps to enable and configure audit logging in Kubernetes.

Accepted Answer

1. Create audit policy file, 2. Mount policy file to API server, 3. Add audit flags to API server, 4. Restart API server, 5. Verify audit logs. Audit logging requires a policy file, mounting it, adding flags, restarting, and verifying logs.

Answer

1. Add audit flags to API server, 2. Create audit policy file, 3. Mount policy file to API server, 4. Restart API server, 5. Verify audit logs

Answer

1. Create audit policy file, 2. Add audit flags to API server, 3. Mount policy file to API server, 4. Restart API server, 5. Verify audit logs

Answer

1. Create audit policy file, 2. Mount policy file to API server, 3. Restart API server, 4. Add audit flags to API server, 5. Verify audit logs

Question 5

What is the purpose of an SBOM (Software Bill of Materials) in the context of supply chain security?

Accepted Answer

To provide a list of all software components and dependencies in an artifact. An SBOM is a formal, machine-readable inventory of all software components, libraries, and dependencies that make up an artifact such as a container image. Its purpose is to provide transparency into the supply chain so that when a new vulnerability is disclosed, you can quickly determine whether your artifact contains the affected component. It does not itself perform signing, scanning, or runtime enforcement.

Answer

To sign container images

Answer

To scan images for vulnerabilities

Answer

To enforce runtime security policies

Question 6

Which audit stage is logged after the request is fully processed and the response is sent?

Accepted Answer

ResponseComplete. The ResponseComplete audit stage is logged after the request is fully processed and the response is sent. It includes the final status and any response data. This stage is the last in the audit logging sequence, following RequestReceived, ResponseStarted, and Panic (if applicable).

Answer

Panic

Answer

ResponseStarted

Answer

RequestReceived

Question 7

Which kubectl command(s) can you use to view the logs of a specific container in a multi-container pod? (Select all that apply)

Accepted Answer

kubectl logs -c . The `kubectl logs` command supports both `-c` and `--container` flags to specify a container name in a multi-container pod. Both are equivalent and valid. The other options are either incorrect syntax or would display logs from all containers, which does not target a specific container.

Answer

kubectl logs

Answer

kubectl logs <pod> --all-containers

Question 8

A security team wants to detect any attempt to read the /etc/shadow file inside a container. Which Falco rule condition would detect this syscall?

Accepted Answer

evt.type in (open, openat) and fd.name=/etc/shadow. The correct condition is 'evt.type in (open, openat) and fd.name=/etc/shadow' because reading a file in Linux involves the open or openat syscall to obtain a file descriptor. Falco's fd.name field captures the file path, and using 'in (open, openat)' covers both variants. This directly detects access to /etc/shadow.

Answer

evt.type=read and fd.name=/etc/shadow

Answer

evt.type=open and fd.name contains /etc/shadow

Answer

proc.name=cat and fd.name=/etc/shadow

Question 9

A pod is stuck in 'Pending' state. You run 'kubectl describe pod mypod' and see the event: '0/1 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate'. What is the most likely solution?

Accepted Answer

Add a toleration to the pod spec for the taint 'node-role.kubernetes.io/master'. The pod is unschedulable because the node has a taint that the pod does not tolerate. To allow the pod to be scheduled on that node, you must add a toleration to the pod spec that matches the taint. This is the correct solution.

Answer

Delete the pod and recreate it without any tolerations

Answer

Remove the taint from the node using 'kubectl taint nodes ...'

Answer

Add a nodeSelector to the pod to match the node's labels

Question 10

A Falco rule is written to detect access to /etc/shadow inside a container. Which condition should be used?

Accepted Answer

evt.type=open and fd.name=/etc/shadow. The correct condition is 'evt.type=open and fd.name=/etc/shadow' because reading a file in Linux typically involves the open or openat syscall to obtain a file descriptor. Falco's fd.name field captures the file path, and evt.type=open detects the attempt to open the file. This directly detects access to /etc/shadow without relying on specific tools like cat or less.

Answer

evt.type=read and fd.name=/etc/shadow

Answer

spawned_process and proc.name in (cat, less) and container

Answer

evt.type=execve and proc.name=cat and fd.name=/etc/shadow

Question 11

In a Falco rule, what does the 'priority' field indicate?

Accepted Answer

The severity level of the event. In a Falco rule, the priority field specifies the severity level of the event, such as EMERGENCY, ALERT, CRITICAL, ERROR, WARNING, NOTICE, INFORMATIONAL, or DEBUG. It determines how the alert is classified and can be used to filter or route notifications based on importance.

Answer

The syscall filter condition

Answer

The format of the output message

Answer

The rule name

Question 12

An administrator wants to ensure that containers in the 'secure-app' namespace cannot write to their own filesystem. Which pod security context setting should be used?

Accepted Answer

securityContext: { readOnlyRootFilesystem: true }. Setting readOnlyRootFilesystem: true mounts the container's root filesystem as read-only, preventing any process inside the container from writing to it. This directly satisfies the requirement that containers cannot write to their own filesystem. Writable volumes can still be mounted separately for legitimate write needs.

Answer

securityContext: { runAsNonRoot: true }

Answer

securityContext: { privileged: false }

Answer

securityContext: { capabilities: { drop: ["ALL"] } }

Question 13

What is the primary benefit of using external secret managers (e.g., HashiCorp Vault) in Kubernetes?

Accepted Answer

They provide better control over secret rotation, auditing, and access policies. External secret managers such as HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault provide centralized lifecycle management for secrets, including automated rotation, detailed audit logging, and fine-grained access policies. In Kubernetes, integrating these tools (via CSI drivers or operators) gives teams stronger governance than native Kubernetes Secrets, which lack built-in rotation and rich auditing. The primary benefit is therefore better control over rotation, auditing, and access policies.

Answer

They ensure that secrets are never stored in etcd

Answer

They prevent all unauthorized access to secrets

Answer

They eliminate the need for Kubernetes Secrets entirely

Question 14

You run 'kubectl exec -it <pod> -- /bin/sh' inside a pod that has an immutable root filesystem. What happens?

Accepted Answer

The shell starts successfully, but any attempt to write to the root filesystem will be denied. When a container has an immutable root filesystem (e.g., readOnlyRootFilesystem: true in Kubernetes), the root filesystem is mounted as read-only. Running 'kubectl exec' to start a shell will succeed because the shell binary is already present and executable. However, any attempt to write to the root filesystem (e.g., creating a file) will be denied with a 'Read-only file system' error. The shell itself does not bypass the restriction.

Answer

The command fails with an error because the container has an immutable root filesystem

Answer

The shell starts and can write to any directory because 'exec' bypasses the restriction

Answer

The pod is restarted with a writable filesystem

Question 15

Which crictl command is used to view the logs of a specific container in a node?

Accepted Answer

crictl logs <container-id>. The crictl logs command retrieves the logs of a specific container identified by its container ID, analogous to docker logs or kubectl logs. It queries the container runtime (via CRI) for the container's stdout/stderr output. This is the correct tool for inspecting logs directly on a node without going through the Kubernetes API.

Answer

crictl exec -it <container-id> sh

Answer

crictl pods

Answer

crictl ps -a