CKS Practice Test 49 — 15 Questions

Question 1

You want to ensure that a container's root filesystem is immutable. Which field in the Pod spec should you set?

Accepted Answer

spec.containers[].securityContext.readOnlyRootFilesystem. The correct field to make a container's root filesystem immutable is 'spec.containers[].securityContext.readOnlyRootFilesystem'. When set to true, this mounts the container's root filesystem as read-only, preventing any writes to the filesystem. This is a key security measure to prevent runtime modifications.

Answer

spec.containers[].securityContext.privileged

Answer

spec.hostNetwork

Answer

spec.containers[].volumeMounts[].readOnly

Question 2

A DevOps team deploys a microservice that needs to access a third-party API using credentials stored in a Kubernetes Secret. The team wants to minimize the risk of credential exposure. Which approach best achieves this goal while following security best practices?

Accepted Answer

Store the credentials in a Secret, mount it as a read-only volume, and use a dedicated service account with RBAC limiting access to that secret.. Mounting the Secret as a read-only volume prevents runtime modification, and using a dedicated service account with RBAC ensures only the specific microservice can access the Secret. This follows the principle of least privilege and minimizes exposure, as the credentials are never injected as environment variables (which can be leaked via /proc or logs) and are only available to the intended pod.

Answer

Store the credentials in a Secret and mount it as a volume with default permissions.

Answer

Use a sidecar container that reads the secret from a file and exposes it via a Unix socket, running the container as root.

Answer

Store the credentials in a ConfigMap and inject them as environment variables.

Question 3

A developer creates a Deployment with the following container spec:

```yaml
containers:
- name: app
  image: myapp:latest
  env:
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: db-secret
        key: password
```

Which of the following is a security concern with this approach?

Accepted Answer

The secret is exposed in the container environment variables, which can be accessed via /proc or logs if the container is compromised.. Injecting secrets as environment variables exposes them in the container's process environment, which can be read from /proc/self/environ or /proc/1/environ by any process running in the container. If the container is compromised, an attacker can easily extract the secret from the environment, and it may also leak into logs or error messages. Kubernetes secrets should be mounted as files (e.g., via volumes) to reduce exposure, as environment variables are more accessible to malicious code.

Answer

The secret is not encrypted at rest in etcd.

Answer

The secret name 'db-secret' is too generic.

Answer

The secret is not base64 encoded.

Question 4

You are a security engineer for a financial services company running a Kubernetes cluster on-premises. The cluster uses kubeadm for bootstrapping and Calico for network policy. Recently, a compliance audit revealed that all nodes in the cluster have the kubelet port 10250 open to the public network, allowing unauthenticated access to the kubelet API. This poses a severe security risk. The cluster has 10 worker nodes and 3 control plane nodes. You need to remediate this without disrupting running workloads. The nodes are behind a corporate firewall, but the internal network is considered untrusted. You have access to the node's iptables and can modify configuration files. Which course of action best secures the kubelet port while maintaining cluster functionality?

Accepted Answer

Use iptables on each node to allow incoming connections to port 10250 only from the cluster's CIDR (e.g., 10.0.0.0/8).. Using iptables to restrict access to port 10250 to only the cluster's internal CIDR (e.g., 10.0.0.0/8) directly addresses the audit finding by blocking unauthenticated public access while allowing necessary kubelet API communication from within the cluster. This approach does not disrupt running workloads, as it only modifies firewall rules without restarting kubelet or changing its configuration. It leverages the existing network infrastructure (iptables) and is consistent with the principle of least privilege for an untrusted internal network.

Answer

Configure a Calico GlobalNetworkPolicy to block inbound traffic to port 10250 on all nodes.

Answer

Change the kubelet port to a non-standard port (e.g., 10260) and update all kubelet configurations.

Answer

Set the --anonymous-auth flag to false on each kubelet and restart them one by one.

Question 5

A security auditor reviews a Kubernetes cluster and finds that several nodes have container runtimes with default configurations. Which TWO of the following actions should be taken to harden the container runtime?

Accepted Answer

Enable AppArmor profiles on the nodes. Enabling AppArmor profiles on nodes enforces mandatory access control (MAC) on container processes, restricting them to only the resources they need. This hardens the container runtime by confining containers beyond the default, often permissive, runtime configuration. AppArmor profiles are a key security mechanism for system hardening in Kubernetes.

Answer

Set readOnlyRootFilesystem in pod security contexts

Answer

Set --no-new-privileges flag in the container runtime configuration

Answer

Disable swap on all nodes

Question 6

A pod is failing to start with: 'Error: container has runAsNonRoot and image will run as root'. The pod spec sets securityContext.runAsNonRoot: true. The container image is 'nginx:latest' which runs as root. Which change allows the pod to run while maintaining security?

Accepted Answer

Set runAsUser: 1000 in the container securityContext. Setting `runAsUser: 1000` in the container's securityContext overrides the default user (root) in the image, ensuring the container process runs as a non-root user (UID 1000). This satisfies the `runAsNonRoot: true` constraint at the pod level, which requires that the container's user ID is non-zero, while still maintaining security by not running as root.

Answer

Remove runAsNonRoot: true

Answer

Add a PodSecurityPolicy that allows root

Answer

Use a mutating webhook to change the image

Question 7

An administrator runs 'crictl ps' and sees no containers listed, but kubectl shows running pods. What is the most likely cause?

Accepted Answer

crictl is not configured to connect to the correct container runtime socket. The most likely cause is that crictl is not configured to connect to the correct container runtime socket. crictl is a command-line tool for interacting with CRI-compatible container runtimes. If it is not pointed to the correct socket (e.g., /var/run/containerd/containerd.sock or /var/run/crio/crio.sock), it will not see any containers, even though kubectl (which communicates with the kubelet) shows running pods. This is a common misconfiguration when multiple runtimes are installed or when the default socket path differs.

Answer

The images have not been pulled yet

Answer

The containers are running in a different namespace

Answer

The kubelet is not running

Question 8

Which TWO of the following are valid methods to detect a container spawning a shell (e.g., /bin/bash) using Falco? (Select two.)

Accepted Answer

Check if proc.name is 'bash' and container is true. Option B is correct because Falco rules can directly match the process name field proc.name against 'bash' (or other shell binaries) while also requiring container=true, which scopes the detection to containerized workloads and reliably flags a shell being launched inside a container. Option C is correct because Falco ships a 'spawned_process' macro that encapsulates the execve/execveat event conditions for process creation, and combining it with a container filter (e.g., container.id != host or container=true) is the idiomatic way to detect any process, including a shell, spawned inside a container. Option A is not a shell-spawning detection method; 'Launch Sensitive Mount' targets mount-related activity such as sensitive host paths being mounted, not process execution. Option D is wrong because checking for a parent of 'sshd' detects remote login sessions, not a container spawning a shell, and misses container-internal shell launches. Option E is incorrect because fd.name refers to file descriptor names (files, sockets), not the executable being run, so it would not properly identify a shell being executed via execve.

Answer

Use the rule 'Launch Sensitive Mount'

Answer

Check if the process's parent is 'sshd'

Answer

Check if evt.type is 'execve' and fd.name contains 'bash'

Question 9

Which of the following is NOT a valid method to enforce pod security standards in a Kubernetes cluster?

Accepted Answer

Using OPA/Gatekeeper with the built-in PSS templates. OPA/Gatekeeper does not have built-in Pod Security Standards (PSS) templates; it enforces custom policies defined in Rego, not the predefined PSS profiles (privileged, baseline, restricted). While Gatekeeper can be used to implement PSS-like controls, it requires writing custom constraint templates, whereas the built-in PSS templates are a feature of Pod Security Admission (PSA), not OPA/Gatekeeper. Therefore, stating that OPA/Gatekeeper uses 'built-in PSS templates' is incorrect.

Answer

Using Pod Security Policy (PSP) if still available in the cluster

Answer

Using a mutating webhook to apply security contexts

Answer

Using Pod Security Admission (PSA) with labels on namespaces

Question 10

You are deploying an application that needs to access a database password stored in a Kubernetes Secret. To minimize risk, you should mount the Secret as a volume rather than using environment variables. Which of the following is the primary security benefit of using mounted volumes over environment variables?

Accepted Answer

Environment variables can be leaked through commands like 'env' or 'cat /proc/1/environ', while mounted files are only accessible if the container has a shell and reads the file.. Environment variables are inherited by all processes in the container and can be read via commands like `env` or by accessing `/proc/1/environ` from any process, even without a shell. In contrast, secrets mounted as volumes are only accessible to processes that explicitly read the file path, and only if the container has a shell or the process has file system access. This reduces the attack surface by limiting exposure to processes that need the secret.

Answer

Mounted volumes are not visible in /proc, making them inaccessible to other processes.

Answer

Environment variables are stored in etcd in plaintext, while volumes are encrypted at rest.

Answer

Mounted volumes automatically rotate the secret when the Secret object is updated.

Question 11

A pod has the following security context: capabilities: { drop: ['ALL'] } and privileged: false. The pod fails to start because it requires the ability to run iptables commands. Which of the following should be added to the pod's security context?

Accepted Answer

capabilities: { add: ['NET_ADMIN'] }. The pod needs to run iptables commands, which require the NET_ADMIN capability. Since the security context drops ALL capabilities, you must explicitly add NET_ADMIN back. Option D correctly adds NET_ADMIN, granting the necessary network administration privileges without making the container fully privileged.

Answer

privileged: true

Answer

capabilities: { add: ['SYS_ADMIN'] }

Answer

capabilities: { drop: ['NET_ADMIN'] }

Question 12

An administrator wants to reduce the attack surface of a Kubernetes node by disabling unnecessary system services. Which of the following services is considered unnecessary on a dedicated Kubernetes worker node and can be safely disabled?

Accepted Answer

cups. (cups) is correct because CUPS (Common Unix Printing System) is a print service that is unnecessary on a dedicated Kubernetes worker node, which does not require printing capabilities. Disabling it reduces the attack surface by removing a potential vector for privilege escalation or remote exploitation, as CUPS historically has had vulnerabilities like CVE-2024-35235. On a worker node, only essential services for container runtime, orchestration, and system management should run.

Answer

containerd

Answer

sshd

Answer

kubelet

Question 13

Which tool is specifically designed to generate a Software Bill of Materials (SBOM) for container images?

Accepted Answer

Syft. Syft is an open-source CLI tool developed by Anchore specifically for generating Software Bill of Materials (SBOMs) from container images and filesystems. It uses static analysis to catalog packages, libraries, and dependencies in formats such as CycloneDX and SPDX, making it the correct choice for this purpose.

Answer

Checkov

Answer

Cosign

Answer

Trivy

Question 14

Which of the following is a CIS benchmark recommendation for securing the Kubernetes API server?

Accepted Answer

Use RBAC for authorization. C is correct because the CIS Benchmark for Kubernetes recommends using Role-Based Access Control (RBAC) to authorize API requests, ensuring that users and service accounts have only the minimum necessary permissions. RBAC is a core security control that restricts access based on roles, and its use is explicitly required to meet CIS compliance for the API server.

Answer

Disable audit logging to reduce overhead

Answer

Enable anonymous authentication

Answer

Allow all service accounts to use cluster-admin

Question 15

Which flag must be set on the kubelet to prevent it from using the default namespace for pods and to enforce that pods only use namespaces that match the node's assigned namespace?

Accepted Answer

--authentication-token-webhook=true. The kubelet does not have a flag to directly enforce that pods only use namespaces matching the node's assigned namespace. Namespace enforcement for pods on a node is part of the NodeRestriction admission plugin on the API server, which restricts kubelet's ability to only update pods bound to its node. None of the listed kubelet flags provide this functionality. --authentication-token-webhook=true enables token authentication but does not enforce namespace restrictions.

Answer

--protect-kernel-defaults=true

Answer

--namespace-default=restricted

Answer

--anonymous-auth=false