CKS Practice Questions 2 — 50 Questions

Question 1

Given the exhibit, what will happen when a user creates a pod with an image from an untrusted registry?

Accepted Answer

The pod is created and the image is pulled. By default, Kubernetes does not enforce any restrictions on image registries. The kubelet will attempt to pull the image from any registry, including untrusted ones, unless an admission controller like ImagePolicyWebhook or a runtime-specific policy (e.g., containerd's `untrusted_workload` mode) is explicitly configured. In this scenario, no such policy is mentioned, so the pod is created and the image is pulled.

Answer

The pod is rejected by NodeRestriction admission

Answer

The pod is rejected by PodSecurity admission

Answer

The pod is created but the image is not pulled because it's untrusted

Question 2

Which TWO of the following are valid ways to verify a container image signature using cosign?

Accepted Answer

cosign verify-attestation --key cosign.pub myimage:latest. `cosign verify-attestation --key cosign.pub myimage:latest` validates an in-toto attestation attached to a container image using a public key, which is a valid method to verify the image's provenance and integrity. Option E is correct because `cosign verify --key cosign.pub myimage:latest` directly verifies the container image's signature against the provided public key, confirming the image was signed by the holder of the corresponding private key.

Answer

cosign validate myimage:latest

Answer

cosign check myimage:latest

Answer

cosign attest --key cosign.key myimage:latest

Question 3

Which TWO are benefits of using a distroless base image over a full OS image like Ubuntu? (Select two.)

Accepted Answer

Smaller image size. Distroless images contain only the application and its runtime dependencies, omitting package managers, shells, and other OS utilities. This results in a significantly smaller image size compared to full OS images like Ubuntu, which include a complete userland and filesystem. Smaller images reduce storage costs, network transfer times, and container startup latency.

Answer

Faster image build times

Answer

Better compatibility with Kubernetes security contexts

Answer

Easier debugging

Question 4

You are auditing RBAC and find a ClusterRoleBinding named 'admin-binding' that binds the 'cluster-admin' ClusterRole to a service account in the 'default' namespace. What is the security concern?

Accepted Answer

It grants too broad permissions to the service account. The 'cluster-admin' ClusterRole grants super-user permissions across the entire cluster, including access to all namespaces and all resources. Binding this role to a service account via a ClusterRoleBinding gives that service account unrestricted cluster-wide privileges, which violates the principle of least privilege. This is a significant security concern because if the service account is compromised, an attacker gains full control over the cluster.

Answer

The binding should be a RoleBinding instead of ClusterRoleBinding

Answer

The service account name must be changed

Answer

The binding is fine as long as the service account is used in the default namespace

Question 5

You are configuring kubelet security. Which flag prevents containers from modifying kernel parameters?

Accepted Answer

--protect-kernel-defaults. The `--protect-kernel-defaults` flag ensures that the kubelet enforces kernel parameter protections, preventing containers from modifying sensitive kernel parameters (e.g., via sysctl). This is a critical security hardening measure to maintain node stability and prevent container breakout through kernel tuning.

Answer

--read-only-port=0

Answer

--kernel-memcg-notification

Answer

--allow-privileged=false

Question 6

Which kubectl command creates a valid webhook configuration that validates pods against a policy?

Accepted Answer

kubectl apply -f validatingwebhookconfiguration.yaml. A ValidatingWebhookConfiguration is the Kubernetes resource that intercepts API server requests to validate resources (e.g., pods) against an external policy before they are persisted. The command `kubectl apply -f validatingwebhookconfiguration.yaml` creates this configuration, which triggers a webhook call to an admission webhook server that returns an admission review with an 'allowed' or 'denied' decision.

Answer

kubectl apply -f webhookconfiguration.yaml

Answer

kubectl apply -f podpreset.yaml

Answer

kubectl apply -f mutatingwebhookconfiguration.yaml

Question 7

What is the effect of setting 'hostPID: true' in a pod's spec?

Accepted Answer

The container runs in the host's PID namespace.. Setting 'hostPID: true' in a pod's spec allows the container to share the host node's PID namespace, meaning the container can see and interact with all processes running on the host, not just those within its own PID namespace. This is a privileged-level setting that bypasses the default process isolation provided by Kubernetes and Linux namespaces.

Answer

The container runs with the host's IPC namespace.

Answer

The container can access the host's network interfaces.

Answer

The container can mount the host's filesystem.

Question 8

Which crictl command can you use to view the logs of a specific container?

Accepted Answer

crictl logs <container-id>. `crictl logs` is the dedicated command to retrieve and display the logs of a specific container managed by a CRI-compatible runtime (e.g., containerd, CRI-O). It works similarly to `docker logs` and reads the container's stdout/stderr streams, which are captured by the container runtime.

Answer

crictl inspect <container-id>

Answer

crictl exec <container-id> cat /var/log/syslog

Answer

crictl ps

Question 9

Which THREE of the following are valid methods to enforce pod security standards in a Kubernetes cluster?

Accepted Answer

Use Kyverno policy engine. Kyverno is a Kubernetes-native policy engine that can enforce pod security standards by validating, mutating, and generating resources based on policies written as Kubernetes custom resources. It integrates with the Kubernetes API server via dynamic admission webhooks, allowing it to reject non-compliant pod specs before they are persisted.

Answer

Run kube-bench on the cluster

Answer

Manual review of all pod specs

Question 10

Which TWO of the following flags are used to secure the kubelet?

Accepted Answer

--protect-kernel-defaults. The `--protect-kernel-defaults` flag is used to secure the kubelet by ensuring that kernel tunable parameters (e.g., `vm.overcommit_memory`, `kernel.panic`) are set to safe values. If the kernel defaults are not properly configured, the kubelet will fail to start, preventing insecure kernel settings from being used. This flag is part of the kubelet's security hardening measures, as recommended by the CIS Kubernetes Benchmark.

Answer

--enable-admission-plugins

Answer

--audit-log-path

Answer

--authorization-mode=RBAC

Question 11

A security auditor runs kube-bench and reports that the kubelet is not configured with --protect-kernel-defaults. What is the impact of this misconfiguration?

Accepted Answer

Kernel parameters may be modified, potentially reducing node security. The `--protect-kernel-defaults` flag ensures that the kubelet enforces kernel parameter hardening, preventing modifications that could weaken node security. Without it, a compromised or misconfigured pod could alter kernel settings (e.g., `net.ipv4.ip_forward`, `vm.overcommit_memory`), reducing the overall security posture of the node. This does not affect image pulling, pod scheduling, or kubelet startup.

Answer

Container runtime will not be able to pull images

Answer

The node will be unable to schedule pods

Answer

The kubelet will refuse to start

Question 12

Which Pod Security Standard level allows the use of hostNetwork, hostPID, and hostIPC?

Accepted Answer

Privileged. The Privileged Pod Security Standard (PSS) level is the most permissive, allowing unrestricted access to host-level resources, including hostNetwork, hostPID, and hostIPC. These settings grant the pod direct access to the host's network namespace, process table, and inter-process communication mechanisms, which are explicitly prohibited in the Baseline and Restricted levels. The Privileged level is designed for system-level workloads that require such elevated permissions, such as CNI plugins or monitoring agents.

Answer

None of the above

Answer

Baseline

Answer

Restricted

Question 13

You need to run kube-bench on a control plane node. Which command should you use?

Accepted Answer

kube-bench run --targets=master. `kube-bench` uses the `--targets` flag to specify which CIS benchmark targets to scan, and for control plane nodes, the correct target is `master` (not `controlplane`). This is because the CIS Kubernetes Benchmark historically refers to the control plane node as the 'master' node, and `kube-bench` follows that naming convention.

Answer

kube-bench run --targets=controlplane

Answer

kube-bench run --targets=node

Answer

kube-bench run --targets=etcd

Question 14

An administrator runs kube-bench on a cluster node and receives failures for CIS benchmark checks related to kubelet configuration. Which kubelet flag should be set to ensure that kernel defaults are not used when they might be insecure?

Accepted Answer

--protect-kernel-defaults. The `--protect-kernel-defaults` kubelet flag ensures that the kubelet will not use insecure kernel defaults by enforcing that certain sysctl settings (e.g., `kernel.panic`, `vm.overcommit_memory`) are set to secure values. If these kernel parameters are not explicitly configured to safe values, the kubelet will fail to start, preventing the node from running with potentially insecure kernel defaults. This directly addresses CIS benchmark checks that require hardening of the kubelet's interaction with the host kernel.

Answer

--read-only-port=0

Answer

--anonymous-auth=false

Answer

--kubelet-extra-args

Question 15

Which TWO of the following are best practices for securing secrets in Kubernetes?

Accepted Answer

Enabling encryption at rest for secrets. Kubernetes stores secrets in etcd by default without encryption. Enabling encryption at rest (via the EncryptionConfiguration resource with a provider like AES-CBC or KMS) ensures that secret data is encrypted before being written to etcd, protecting it from unauthorized access to the underlying storage. This is a fundamental security control required for compliance and defense-in-depth.

Answer

Storing secrets as environment variables

Answer

Using the default secret type (Opaque) for all secrets

Answer

Limiting the number of secrets in the cluster

Question 16

You are securing a cluster and want to ensure that service account tokens are not automatically mounted in pods that do not need them. Which THREE actions should you take?

Accepted Answer

Set automountServiceAccountToken: false in the service account definition for service accounts that do not need tokens. Setting `automountServiceAccountToken: false` in the service account definition prevents the automatic mounting of the service account token into any pod that uses that service account. This is a declarative, scalable approach to disable token mounting for all pods associated with that service account, aligning with the principle of least privilege.

Answer

Set --service-account-lookup=false on the API server

Answer

Delete all service accounts except those used by system components

Question 17

You are using crictl to debug a container. Which command lists all running containers on the node?

Accepted Answer

crictl ps. `crictl ps` is the command used to list running containers on a node when using the CRI (Container Runtime Interface) compatible runtimes like containerd or CRI-O. It mirrors the Docker `docker ps` syntax and shows only running containers by default, which is exactly what the question asks for.

Answer

crictl containers

Answer

crictl get pods

Answer

crictl list

Question 18

Which TWO of the following are valid ways to securely manage secrets in Kubernetes? (Choose two.)

Accepted Answer

Mount Kubernetes Secrets as volumes into the pod.. Mounting Kubernetes Secrets as volumes into the pod ensures that secret data is stored in the pod's filesystem as files, which are created with in-memory tmpfs to avoid writing to disk. This approach leverages Kubernetes' native secret handling, where the secret data is base64-decoded and presented as plaintext files, and access can be controlled via RBAC and PodSecurityPolicies. It also supports automatic rotation when secrets are updated, provided the pod is restarted or the volume is remounted.

Answer

Use environment variables from the pod spec referencing Secret keys.

Answer

Pass secrets as command-line arguments to the container.

Answer

Store secrets in ConfigMaps with base64 encoded data.

Question 19

Which command is used with Cosign to sign a container image?

Accepted Answer

cosign sign . The `cosign sign ` command is used to sign a container image by attaching a digital signature to the image manifest in the container registry. This signature, typically stored as a separate tag or in an OCI artifact, allows verification of the image's origin and integrity using the corresponding public key.

Answer

cosign verify <image>

Answer

cosign attest <image>

Answer

cosign generate <image>

Question 20

Which TWO of the following are valid methods to verify the integrity of a container image in a Kubernetes supply chain? (Select 2)

Accepted Answer

Signing the image with Cosign and verifying the signature before deployment. Cosign is a tool for signing container images using cryptographic keys, and verifying the signature before deployment ensures that the image has not been tampered with since it was signed. This provides integrity and authenticity in the software supply chain, as the signature can be validated against a trusted public key or a keyless identity (e.g., via Fulcio).

Answer

Running the container in a separate namespace

Answer

Scanning the image for vulnerabilities using Trivy

Answer

Using a base image with the latest tag