CKS Practice Exam 51 — 20 Questions

Question 1

You are tasked with creating a ConstraintTemplate in OPA/Gatekeeper that denies pods running with the 'latest' image tag. Which Rego rule should the ConstraintTemplate include?

Accepted Answer

violation[{"msg": msg}] { ... }. In OPA/Gatekeeper ConstraintTemplates, the Rego rule must be named `violation` to define the logic that triggers a denial when a resource violates the constraint. The `violation` rule returns a message in the `msg` field, which Gatekeeper uses to reject the resource. Option B is correct because it follows the required syntax for Gatekeeper constraints, where `violation[{"msg": msg}]` is the standard entry point for enforcing policies.

Answer

admit[{"msg": msg}] { ... }

Answer

reject[{"msg": msg}] { ... }

Answer

deny[{"msg": msg}] { ... }

Question 2

Which THREE of the following are best practices for securing the software supply chain in Kubernetes?

Accepted Answer

Sign container images and verify signatures in the CI/CD pipeline. Option B is correct because cryptographically signing container images (e.g., with Sigstore/Cosign or Notary) and verifying those signatures in the CI/CD pipeline ensures that only trusted, unmodified images are deployed, preventing tampering and supply-chain injection. Option C is correct because admission controllers such as OPA/Gatekeeper (or Kyverno) enforce policies at admission time, blocking images that violate rules like untrusted registries, missing signatures, or disallowed configurations before pods are created. Option E is correct because scanning images for known CVEs (e.g., with Trivy, Grype, or Clair) before deployment identifies vulnerable dependencies and base images, allowing remediation prior to production. Option A is not a best practice: running containers as root violates least privilege and increases the blast radius of a compromise; instead, use non-root users and restricted security contexts. Option D is not a best practice: mutable tags like 'latest' are non-deterministic and can silently pull different images, undermining reproducibility and integrity; immutable, digest-pinned tags should be used instead.

Answer

Run containers as root to avoid permission issues

Answer

Use mutable tags like 'latest' for easier updates

Question 3

A DevOps engineer needs to restrict the outbound network traffic from pods running in namespace 'secure-ns'. Which NetworkPolicy configuration achieves this by default?

Accepted Answer

Apply a NetworkPolicy that selects pods in 'secure-ns' and has an empty egress section.. By default, Kubernetes NetworkPolicies are additive and deny-all unless explicitly allowed. Applying a NetworkPolicy with an empty egress section (no egress rules) to pods in 'secure-ns' effectively denies all outbound traffic from those pods, because the policy's egress field defaults to an empty list, which matches no traffic. This is the standard Kubernetes behavior for restricting egress.

Answer

Apply a NetworkPolicy that selects pods in 'secure-ns' and has an egress rule allowing all traffic.

Answer

No NetworkPolicy is needed because egress is denied by default.

Answer

Apply a NetworkPolicy that selects pods in 'secure-ns' and has an egress rule allowing traffic to port 53.

Question 4

Which of the following is the recommended method to enable encryption at rest for secrets in etcd using the EncryptionConfiguration?

Accepted Answer

Use provider: aescbc. The recommended encryption provider for Kubernetes secrets at rest is `aescbc` (AES-CBC), as per the official documentation. While `secretbox` is a valid provider, it is less commonly used and not the default recommendation. Options 'encryption' and 'aesgcm' are invalid or deprecated.

Answer

Use provider: encryption

Answer

Use provider: secretbox

Answer

Use provider: aesgcm

Question 5

Which TWO of the following are valid methods to supply a Kubernetes manifest to kubesec for static analysis?

Accepted Answer

cat deploy.yaml | kubesec scan /dev/stdin. Option A is correct because kubesec scan accepts a manifest from standard input, and piping the file content via cat deploy.yaml | kubesec scan /dev/stdin explicitly supplies the manifest through /dev/stdin, which kubesec reads as the scan target. Option D is correct because kubesec scan deploy.yaml passes the manifest file path directly as an argument, which is the standard documented way to scan a local YAML file. Option B is not valid because kubectl apply -f deploy.yaml sends the manifest to the Kubernetes API server and outputs the server's apply result, not the original manifest, so kubesec would receive non-manifest text. Option C is not valid because kubectl get deployment myapp -o yaml returns a live Deployment object with runtime metadata and status fields, not a clean input manifest, and kubesec expects a manifest to analyze. Option E is not valid because kubesec has no curl subcommand; it cannot fetch a remote URL in that manner.

Answer

kubectl apply -f deploy.yaml | kubesec scan

Answer

kubectl get deployment myapp -o yaml | kubesec scan

Answer

kubesec curl https://example.com/deploy.yaml

Question 6

Which kubectl command would you use to create a ValidatingWebhookConfiguration from a YAML file?

Accepted Answer

kubectl apply -f webhook.yaml. `kubectl apply -f webhook.yaml` is the standard command to create or update Kubernetes resources from a YAML file, including a ValidatingWebhookConfiguration. This command uses declarative management, applying the configuration defined in the file to the cluster, which is the recommended approach for creating admission webhooks.

Answer

kubectl run webhook --image=webhook --restart=Never

Answer

kubectl create -f webhook.yaml

Answer

kubectl expose deployment webhook --port=443

Question 7

Which kubectl command would you use to create a Secret from a file named 'db-password.txt'?

Accepted Answer

kubectl create secret generic db-password --from-file=db-password.txt. `kubectl create secret generic` is the command to create a generic (opaque) Secret from a file using the `--from-file` flag. This reads the content of `db-password.txt` and stores it as a key-value pair in the Secret, where the key defaults to the filename. This is the standard method for creating a Secret from a plaintext file in Kubernetes.

Answer

kubectl apply -f db-password.txt

Answer

kubectl create configmap db-password --from-file=db-password.txt

Answer

kubectl create secret tls db-password --cert=db-password.txt

Question 8

Which crictl command is used to view the logs of a specific container?

Accepted Answer

crictl logs. crictl logs <container-id> displays logs from a container. crictl ps lists containers, crictl exec runs a command in a container, and crictl inspect shows detailed container information.

Answer

crictl ps

Answer

crictl exec

Answer

crictl inspect

Question 9

Which command can be used to view the logs of a container using the container runtime interface (crictl)?

Accepted Answer

crictl logs <container-id>. crictl logs is the command to fetch logs of a container, similar to 'docker logs'.

Answer

crictl status <container-id>

Answer

crictl inspect <container-id>

Answer

crictl log <container-id>

Question 10

You need to preserve forensic evidence from a compromised pod. Which TWO actions should you take?

Accepted Answer

Take a snapshot of the container's filesystem. Taking a snapshot of the container filesystem (e.g., using crictl export) and capturing the container logs are standard forensic steps.

Answer

Delete the pod immediately

Answer

Apply a NetworkPolicy to allow all traffic

Answer

Restart the container

Question 11

A pod is using a RuntimeClass that specifies gVisor (runsc). Which of the following scenarios is most likely to cause the pod to fail?

Accepted Answer

The pod attempts to mount a hostPath directory with privileged access.. GVisor (runsc) operates as a sandboxed kernel that intercepts system calls, and it does not support privileged operations such as mounting hostPath directories with privileged access. The `privileged: true` flag attempts to bypass the sandbox, which gVisor explicitly denies, causing the pod to fail. This is a core security constraint of gVisor, which aims to minimize microservice vulnerabilities by restricting host-level interactions.

Answer

The pod runs a web server listening on port 8080.

Answer

The pod mounts a ConfigMap as a volume.

Answer

The pod uses a PersistentVolumeClaim for storage.

Question 12

An administrator wants to prevent pods from running as root. Which SecurityContext field should be set at the pod level?

Accepted Answer

runAsNonRoot: true. Setting `runAsNonRoot: true` at the pod-level SecurityContext enforces that all containers in the pod must run with a non-root user (UID > 0). If a container image specifies a user with UID 0 (root) or does not specify a user, the container will fail to start, preventing privilege escalation from root access.

Answer

fsGroup: 2000

Answer

runAsGroup: 3000

Answer

runAsUser: 1000

Question 13

Which command correctly creates a secret from a file named 'config.json'?

Accepted Answer

kubectl create secret generic my-secret --from-file=config.json. `kubectl create secret generic` with `--from-file=config.json` reads the file content and stores it as a key-value pair in the Secret, where the key defaults to the filename ('config.json') and the value is the raw file data. This is the standard method for creating a generic Secret from a file in Kubernetes.

Answer

kubectl create configmap my-secret --from-file=config.json

Answer

kubectl create secret tls my-secret --cert=config.json

Answer

kubectl create secret generic my-secret --from-literal=config.json

Question 14

You suspect a container has been compromised. You want to preserve the container's filesystem for forensic analysis before terminating the pod. Which approach should you use?

Accepted Answer

Use kubectl cp to copy files from the container to a safe location. Using kubectl cp to copy files from the container to a safe location preserves the container's filesystem for forensic analysis without altering the running container. This method allows you to extract files for offline analysis while keeping the container intact for further investigation.

Answer

Exec into the container and delete suspicious files

Answer

Restart the kubelet on the node

Answer

Immediately delete the pod to stop the attack

Question 15

Which TWO of the following are best practices for securing the container supply chain? (Select 2)

Accepted Answer

Scan container images for vulnerabilities. Using minimal base images reduces the attack surface, and scanning images for vulnerabilities helps identify and fix security issues before deployment.

Answer

Disable image pull secrets to reduce complexity

Answer

Hardcode secrets in the Dockerfile for convenience

Answer

Run containers as root to simplify permissions

Question 16

Which TWO of the following are valid approaches to restrict which nodes a pod can run on?

Accepted Answer

Use nodeSelector in pod spec. `nodeSelector` is a simple field in the Pod spec that constrains which nodes a Pod can be scheduled on by matching against node labels. This is a native Kubernetes scheduling mechanism that directly restricts node placement based on key-value pairs defined on nodes.

Answer

Define NetworkPolicy to allow only certain nodes

Answer

Enable PodSecurity with baseline profile

Answer

Use tolerations in pod spec

Question 17

An administrator wants to enforce that no container in a specific namespace runs with the privileged security context. They decide to use Pod Security Standards. Which Pod Security Standard level should be applied to the namespace?

Accepted Answer

restricted. The restricted Pod Security Standard (PSS) level is the correct choice because it enforces the most stringent set of security controls, including the prohibition of privileged containers. This level denies any pod that requests `privileged: true` or uses other privileged capabilities, ensuring that no container in the namespace can run with elevated host access. The baseline level is less restrictive and allows some privileged configurations, while the privileged level imposes no restrictions at all.

Answer

baseline

Answer

custom

Answer

privileged

Question 18

A microservice container needs to perform DNS lookups using TCP rather than UDP. Which Kubernetes security context setting should be configured to allow this?

Accepted Answer

Add `NET_RAW` capability. TCP DNS lookups use standard TCP sockets, not raw sockets. These are permitted by the default syscall policy, and no additional Linux capability is required. All listed capabilities are unnecessary, as the container already has the ability to create TCP sockets.

Answer

Add `DAC_OVERRIDE` capability

Answer

Add `NET_ADMIN` capability

Answer

Add `NET_BIND_SERVICE` capability

Question 19

Which TWO of the following are valid ways to enable mTLS between services in a service mesh (e.g., Istio)?

Accepted Answer

Creating a DestinationRule with a trafficPolicy that sets tls mode to ISTIO_MUTUAL. A DestinationRule with `trafficPolicy.tls.mode: ISTIO_MUTUAL` explicitly configures the client-side proxy (Envoy) to use mutual TLS when sending requests to the destination service. This is the standard Istio mechanism to enforce mTLS at the service-to-service communication level, ensuring both client and server certificates are exchanged and verified.

Answer

Creating a ServiceEntry for the destination service

Answer

Creating a NetworkPolicy that allows ingress on port 443

Answer

Creating an AuthorizationPolicy with DENY action

Question 20

An administrator wants to restrict pods from running as root. Which admission controller should be enabled?

Accepted Answer

PodSecurity. The PodSecurity admission controller (D) is the correct choice because it enforces the Pod Security Standards (Privileged, Baseline, Restricted) defined in the Kubernetes documentation. By enabling this controller, the administrator can configure a policy that prevents pods from running as root, typically by setting the 'Restricted' profile which requires 'runAsNonRoot: true' and 'runAsUser: > 10000' in the pod security context.

Answer

NodeRestriction

Answer

AlwaysPullImages

Answer

ServiceAccount