CKS Practice Exam 52 — 20 Questions

Question 1

Which of the following is a best practice for securing container images in a CI/CD pipeline?

Accepted Answer

Using a minimal base image such as Alpine. Using a minimal base image like Alpine reduces the attack surface by minimizing the number of installed packages and potential vulnerabilities.

Answer

Using the 'latest' tag for all base images to ensure the newest features

Answer

Running the container as root to avoid permission issues

Answer

Installing all available packages to ensure the application has all dependencies

Question 2

An etcd cluster uses TLS for peer and client communication. You need to secure etcd further by enabling RBAC. Which flag do you set on the etcd process to enable authentication?

Accepted Answer

--client-cert-auth=true. In etcd, RBAC is not enabled by a dedicated RBAC flag; instead, authentication must first be turned on using `--client-cert-auth=true`. This flag requires clients to present a valid TLS certificate, which is the prerequisite for enabling RBAC. After setting this flag, you can use `etcdctl` commands like `etcdctl role add` and `etcdctl user add` to configure RBAC roles and users.

Answer

--enable-rbac=true

Answer

--authentication-mode=RBAC

Answer

--auth-mode=rbac

Question 3

Which TWO of the following are valid steps to respond to a runtime security incident where a container is suspected to be compromised? (Select two.)

Accepted Answer

Apply a NetworkPolicy that denies all ingress and egress to the pod. Applying a NetworkPolicy that denies all ingress and egress to the compromised pod immediately isolates it, preventing lateral movement and data exfiltration while preserving the pod for forensic analysis. This aligns with the incident response principle of containment before eradication, and Kubernetes NetworkPolicy uses label selectors and pod selectors to enforce eBPF/iptables-based rules at the CNI layer.

Answer

Immediately delete the pod to stop the attack

Answer

Add a taint to the node to evict the pod

Answer

Restart the kubelet on the node

Question 4

You have configured an audit policy with level: Request. Which request information is logged?

Accepted Answer

Request metadata and request body. In the Kubernetes audit policy, the Request level logs the request metadata (who, what, when, where) plus the request body, but not the response body. This is useful for capturing what was sent to the API server without the overhead of logging responses. The Response level would additionally log the response body.

Answer

Only metadata for the request

Answer

Nothing is logged because Request is not a valid level

Answer

Request metadata, request body, and response body

Question 5

You want to run crictl to list all running containers on a node. Which command should you execute?

Accepted Answer

crictl ps. The crictl ps command lists running containers on a node by querying the CRI-compatible container runtime (containerd or CRI-O). It is the direct equivalent of 'docker ps' in the CRI world and is the correct command to enumerate running containers.

Answer

crictl stats

Answer

crictl images

Answer

crictl pods

Question 6

Which THREE of the following practices help protect microservice applications against supply chain attacks? (Choose three.)

Accepted Answer

Use minimal base images (e.g., distroless or scratch) to reduce attack surface. Using minimal base images like distroless or scratch significantly reduces the attack surface by eliminating unnecessary packages, libraries, and utilities that could contain vulnerabilities. This aligns with the principle of least functionality, as fewer components mean fewer potential entry points for an attacker to exploit in a supply chain attack.

Answer

Use images from any public registry for flexibility

Answer

Always use the latest tag to get the most recent patches

Question 7

What is the purpose of the CIS Kubernetes Benchmark?

Accepted Answer

To provide a set of security best practices for Kubernetes. The CIS Kubernetes Benchmark is a set of security best practices developed by the Center for Internet Security (CIS) specifically for hardening Kubernetes clusters. It provides prescriptive guidance on configuring cluster components (e.g., kube-apiserver, kubelet, etcd) to reduce the attack surface and meet compliance standards. Option A correctly identifies this purpose, as the benchmark is not about performance, networking, or automation.

Answer

To benchmark performance of Kubernetes clusters

Answer

To test network policies

Answer

To automate deployment of Kubernetes clusters

Question 8

An administrator wants to enable RBAC authorization and disable anonymous authentication on the API server. Which set of flags should be added to the kube-apiserver configuration?

Accepted Answer

--authorization-mode=RBAC --anonymous-auth=false. To enable RBAC authorization on the API server, you must set `--authorization-mode=RBAC`. Disabling anonymous authentication is achieved with `--anonymous-auth=false`, which prevents unauthenticated requests from being processed. Together, these flags enforce role-based access control and block anonymous access, meeting the administrator's requirements.

Answer

--enable-admission-plugins=NodeRestriction --anonymous-auth=false

Answer

--authorization-mode=AlwaysAllow --anonymous-auth=false

Answer

--authorization-mode=Node --anonymous-auth=true

Question 9

Which TWO of the following are valid AppArmor profile modes? (Select two.)

Accepted Answer

complain. AppArmor has two primary profile modes: 'complain' (also known as 'learning' mode) and 'enforce' (also known as 'confined' mode). In complain mode, policy violations are logged but not blocked, allowing administrators to test profiles. In enforce mode, violations are both logged and blocked, actively enforcing the security policy.

Answer

kill

Answer

audit

Answer

permissive

Question 10

You want to ensure that kubelets only serve pods that have been scheduled by the API server. Which admission plugin should be enabled?

Accepted Answer

NodeRestriction. The NodeRestriction admission plugin limits the Node and Pod objects a kubelet can modify. When enabled, each kubelet can only create/modify pods bound to its own node, and only pods that have been scheduled by the API server (i.e., have a non-empty `spec.nodeName` set by the scheduler). This prevents a compromised kubelet from creating arbitrary pods or modifying pods on other nodes, enforcing that only the API server schedules pods.

Answer

ServiceAccount

Answer

AlwaysPullImages

Answer

PodNodeSelector

Question 11

A CI pipeline fails with the error 'cosign: error: unable to verify image: no matching signatures' when running 'cosign verify --key pubkey.pem myregistry/myapp:latest'. The image was previously signed with a private key. What is the MOST likely cause?

Accepted Answer

The image tag was overwritten without signing. If the image tag was overwritten (e.g., pushed again without signing), the old signatures are lost and the new image is unsigned.

Answer

The public key is incorrect

Answer

The registry requires authentication

Answer

Cosign is not installed correctly

Question 12

You are configuring ImagePolicyWebhook admission controller to reject images not signed by a trusted authority. After deploying the webhook, you notice that pods are being rejected even for images that are properly signed. Which configuration change is MOST likely to fix this?

Accepted Answer

Set failurePolicy to Ignore in the webhook configuration. The ImagePolicyWebhook admission controller uses a webhook to validate images. When the webhook is unreachable or returns an error, the default behavior is to reject the request. Setting `failurePolicy` to `Ignore` allows the API server to admit the pod when the webhook fails, which is necessary if the webhook is temporarily unavailable or misconfigured but images are properly signed.

Answer

Increase the memory limit of the API server

Answer

Change the webhook from 'MutatingAdmissionWebhook' to 'ValidatingAdmissionWebhook'

Answer

Grant the webhook service account cluster-admin role

Question 13

Which kubectl command can be used to exec into a running container for forensic analysis during an incident response?

Accepted Answer

kubectl exec -it -- /bin/sh. `kubectl exec -it -- /bin/sh` allows you to start an interactive shell session inside a running container, which is essential for live forensic analysis during incident response. This command uses the Kubernetes API to execute a process (e.g., /bin/sh) in the container's namespaces, enabling you to inspect running processes, file systems, network connections, and memory artifacts without stopping the container.

Answer

kubectl run --stdin --tty --image=busybox

Answer

kubectl logs <pod>

Answer

kubectl attach <pod>

Question 14

During a security incident, you need to isolate a compromised pod named 'malicious-pod' in namespace 'default' to prevent it from communicating with other pods. Which command should you run?

Accepted Answer

kubectl apply -f networkpolicy.yaml. Pod isolation is achieved by applying a NetworkPolicy that denies ingress/egress traffic. 'kubectl apply -f networkpolicy.yaml' applies the policy. The policy must be written to deny all traffic.

Answer

kubectl run networkpolicy --image=nginx --restart=Never

Answer

kubectl delete pod malicious-pod

Answer

kubectl create networkpolicy isolate --pod-selector=app=malicious --policy-types=Ingress,Egress

Question 15

A Falco rule has the following output: 'Sensitive file opened for reading (user=root command=cat /etc/shadow)'. Which macro is most likely used in the rule condition?

Accepted Answer

sensitive_file_names. Falco has a macro called 'sensitive_file_names' that includes files like /etc/shadow, /etc/passwd, etc. The rule likely uses that macro to match on open syscalls targeting those files.

Answer

shell_procs

Answer

outbound

Answer

binaries

Question 16

You need to configure Kubernetes audit logging to log all requests to the 'secrets' resource at the RequestResponse level. Which audit policy rule would achieve this?

Accepted Answer

- level: RequestResponse
  resources:
  - group: ""
    resources: ["secrets"]. An audit policy rule with resources: groups: [""]; resources: ["secrets"]; level: RequestResponse will log all requests to secrets at the RequestResponse level (metadata + request + response).

Answer

- level: Metadata
  resources:
  - group: ""
    resources: ["secrets"]

Answer

- level: RequestResponse
  resources:
  - group: ""
    resources: ["pods"]

Answer

- level: Request
  resources:
  - group: ""
    resources: ["secrets"]

Question 17

Which flag is used when starting kube-apiserver to enable audit logging?

Accepted Answer

--audit-policy-file. The --audit-policy-file flag specifies the path to the audit policy file, which is required to enable audit logging.

Answer

--audit-log-path

Answer

--audit-webhook-config-file

Answer

--feature-gates=Audit=true

Question 18

You want to ensure that kubelet does not allow anonymous requests. Which flag must be set on the kubelet?

Accepted Answer

--anonymous-auth=false. The kubelet's `--anonymous-auth` flag controls whether anonymous requests to the kubelet API are permitted. Setting `--anonymous-auth=false` explicitly denies all anonymous requests, ensuring that only authenticated users can interact with the kubelet. This is a critical hardening step to prevent unauthenticated access to node-level operations.

Answer

--authentication-anonymous=false

Answer

--allow-anonymous=false

Answer

--read-only-port=0

Question 19

A security engineer runs the following command to inspect a container's security context. What vulnerability does this configuration expose?

Accepted Answer

The container has all capabilities enabled, which is a security risk. The command `docker run --privileged` or a similar configuration that grants all capabilities (e.g., `--cap-add=ALL`) removes all kernel-level isolation, giving the container full access to the host's kernel capabilities. This means the container can perform privileged operations like loading kernel modules, modifying network settings, and accessing raw devices, which directly violates the principle of least privilege and exposes the host to container breakout attacks.

Answer

The container is running without any capabilities

Answer

The container has dropped all capabilities except NET_BIND_SERVICE

Answer

The container has default Docker capabilities, which is secure

Question 20

You suspect a container is running an unexpected process. Which crictl command can you use to list all running containers on the node?

Accepted Answer

crictl ps. The `crictl ps` command lists all running containers on a node by querying the CRI-compatible container runtime (containerd or CRI-O) through the Container Runtime Interface. It returns container ID, image, state, name, and pod association, making it the correct tool for identifying unexpected processes running inside containers on a Kubernetes node.

Answer

crictl stats

Answer

crictl pods

Answer

crictl images