CKS Practice Test 7 — 10 Questions

Question 1

Which THREE of the following are recommended measures to reduce the attack surface of Kubernetes nodes?

Accepted Answer

Disable unnecessary system services on nodes. Disabling unnecessary system services on Kubernetes nodes reduces the number of running processes and open ports that could be exploited by an attacker. Services like telnet, rsh, or unused SNMP daemons provide additional attack vectors. This aligns with the principle of minimalism in system hardening, as recommended by the CIS Kubernetes Benchmark.

Answer

Open all ports on nodes to allow easy debugging

Answer

Run all containers as root user

Question 2

Which THREE of the following are required to secure etcd in a Kubernetes cluster?

Accepted Answer

Require client certificate authentication. Etcd requires client certificate authentication to verify the identity of clients (such as kube-apiserver) connecting to it. Without mutual TLS (mTLS), an attacker could impersonate a legitimate client and read or modify cluster state, including secrets and configuration data.

Answer

Configure RBAC for etcd

Answer

Allow anonymous access for monitoring

Question 3

You are configuring kubelet to protect kernel defaults. Which flag enables this?

Accepted Answer

--protect-kernel-defaults. The `--protect-kernel-defaults` flag is a kubelet option that, when set to `true`, enforces kernel tunable protections by checking that sysctl settings like `vm.overcommit_memory`, `vm.panic_on_oom`, and `kernel.panic` match the kubelet's expected safe defaults. This is a critical hardening measure to prevent container breakout scenarios where a compromised pod could weaken host kernel parameters.

Answer

--security-opt=protect-kernel

Answer

--enable-protect-kernel

Answer

--kernel-security

Question 4

Match each container security context setting to its effect.

Accepted Answer

runAsNonRoot: Prevents the container from running as root. Correct matches: runAsNonRoot forces non-root execution; runAsUser sets a specific UID. Common confusion is swapping these effects. Other settings like privileged and readOnlyRootFilesystem also enforce least privilege.

Answer

runAsNonRoot: Specifies the user ID (UID) to run the container

Answer

runAsUser: Prevents the container from running as root

Question 5

A cluster administrator needs to run a workload that uses gVisor (runsc) for container sandboxing. Which Kubernetes resource is required to enable this?

Accepted Answer

RuntimeClass. A RuntimeClass resource is required to enable gVisor (runsc) because it defines the container runtime configuration that should be used for pods. By creating a RuntimeClass with the handler set to 'runsc', the cluster administrator can instruct the kubelet to use gVisor as the OCI-compatible runtime for sandboxing, providing an additional security layer through a user-space kernel.

Answer

PriorityClass

Answer

NetworkPolicy

Answer

PodSecurityPolicy

Question 6

You are tasked with securing the kubelet. Which flag must be set on the kubelet to enable the NodeRestriction admission plugin?

Accepted Answer

--enable-admission-plugins=NodeRestriction on the kube-apiserver. The NodeRestriction admission plugin is an admission controller that runs on the kube-apiserver, not on the kubelet. It limits the Node and Pod objects a kubelet can modify, enforcing that nodes can only modify their own node object and pods bound to them. The flag `--enable-admission-plugins=NodeRestriction` on the kube-apiserver activates this plugin, which is a key security control for hardening the cluster.

Answer

--admission-control=NodeRestriction on the kubelet

Answer

--enable-admission-plugins=NodeRestriction on the kubelet

Answer

--node-restriction=true on the kubelet

Question 7

A security engineer runs 'kubesec scan deployment.yaml' and receives a score of -1. What does this score indicate?

Accepted Answer

The scan failed due to an error or invalid YAML. In kubesec, a score of -1 indicates that the scan could not complete successfully, typically due to an error in the YAML file (e.g., invalid syntax, malformed structure) or a failure in the scanning process itself. Kubesec returns scores from 0 to 10 for valid deployments, where higher scores indicate better security; -1 is a special sentinel value reserved for scan failures, not a security assessment.

Answer

The deployment passed all security checks

Answer

The deployment is not secure and needs immediate attention

Answer

The deployment has critical vulnerabilities

Question 8

Which tool can be used to perform static analysis of Kubernetes manifests for security issues?

Accepted Answer

kubesec. Kubesec is a static analysis tool specifically designed to evaluate Kubernetes resource manifests against a set of built-in security best practices. It scans YAML or JSON manifests for common misconfigurations such as running containers as root, missing resource limits, or insecure capability assignments, and returns a risk score. This makes it the correct choice for static analysis of Kubernetes manifests for security issues.

Answer

syft

Answer

cosign

Answer

trivy

Question 9

A security admin wants to ensure that all container images in a Kubernetes cluster are scanned for known vulnerabilities before being deployed. Which tool can be integrated into a CI/CD pipeline to scan container images for CVEs?

Accepted Answer

Trivy. Trivy is a comprehensive vulnerability scanner for container images, filesystems, and Git repositories. It can be integrated into CI/CD pipelines to automatically scan container images for known CVEs before deployment, making it the correct choice for this requirement.

Answer

kubesec

Answer

Helm

Answer

kubectl

Question 10

You are using `crictl` to debug a container that is not responding. Which command should you use to get the list of running containers?

Accepted Answer

crictl ps. `crictl ps` is the correct command because it lists running containers managed by the CRI-compatible runtime (e.g., containerd, CRI-O). This is analogous to `docker ps` but for the Kubernetes container runtime interface, allowing you to see container IDs, names, and statuses for debugging.

Answer

crictl pods

Answer

crictl images

Answer

crictl stats