CKS Cluster Setup and Hardening Practice Test 8 — 15 Questions

Question 1

An administrator runs `kube-bench` on a Kubernetes node and receives a warning that the kubelet is configured with `--anonymous-auth=true`. Which kubectl command should be used to fix this on the kubelet?

Accepted Answer

kubectl edit configmap kubelet-config -n kube-system and set authentication.anonymous.enabled to false. Option D is correct because the kubelet's anonymous authentication is configured via a KubeletConfiguration object, which is typically stored as a ConfigMap in the kube-system namespace. Editing the `kubelet-config` ConfigMap and setting `authentication.anonymous.enabled` to false is the proper kubectl-based method to disable anonymous authentication for the kubelet, as the kubelet reads its configuration from this ConfigMap when the `--config` flag is used.

Answer

kubectl annotate node --all kubelet.kubernetes.io/anonymous-auth=false

Answer

kubectl edit node <node-name> and set spec.anonymousAuth to false

Answer

kubectl set env daemonset/kubelet -n kube-system ANONYMOUS_AUTH=false

Question 2

You are tasked with enabling audit logging for the Kubernetes API server. Which API server flag must be used to specify the audit log file path?

Accepted Answer

--audit-log-path. The `--audit-log-path` flag is the correct API server flag to specify the file path where audit logs are written. This flag defines the absolute or relative path to the audit log file, and the kube-apiserver will create or append to that file. Without this flag, no audit log file is generated, even if an audit policy is configured.

Answer

--audit-log-dir

Answer

--audit-policy-file

Answer

--audit-log-file

Question 3

A security scan reports that the etcd cluster does not encrypt data at rest. The cluster uses aescbc encryption. Which resource type should be created to configure encryption at rest?

Accepted Answer

EncryptionConfiguration. The correct resource type is an EncryptionConfiguration, which is a Kubernetes API object used to configure encryption at rest for etcd. When the aescbc provider is specified in the EncryptionConfiguration, Kubernetes encrypts secret data before writing it to etcd, ensuring data at rest is protected. This configuration is passed to the kube-apiserver via the --encryption-provider-config flag.

Answer

ConfigMap

Answer

ClusterRole

Answer

Secret

Question 4

Which admission plugin should be enabled on the kubelet to ensure it only registers nodes and sets labels as allowed by the Node REST API?

Accepted Answer

NodeRestriction. The NodeRestriction admission plugin is the correct choice because it limits the kubelet's ability to modify node and pod labels, ensuring that nodes can only register themselves and set labels that are explicitly allowed by the Node REST API. This plugin enforces a whitelist of labels that the kubelet can set, preventing privilege escalation through label manipulation.

Answer

PodSecurity

Answer

DenyEscalatingExec

Answer

AlwaysPullImages

Question 5

An administrator wants to ensure that a service account used by a deployment cannot automatically mount its token. Which field should be set to `false` in the Pod spec?

Accepted Answer

automountServiceAccountToken. Option C is correct because the `automountServiceAccountToken` field in the Pod spec controls whether the service account token is automatically mounted into the container. Setting this field to `false` prevents the automatic mounting of the token, which is a security best practice to reduce the attack surface for compromised pods. This field can be set at the Pod level or overridden at the ServiceAccount level.

Answer

mountServiceAccountToken

Answer

disableTokenMount

Answer

automountToken

Question 6

You need to create an RBAC role that allows reading secrets only in namespace 'production'. Which ClusterRole and RoleBinding combination is correct?

Accepted Answer

Create a Role with get and list on secrets in namespace 'production', then a RoleBinding in 'production'. Option D is correct because a Role is namespaced and can only grant permissions within a specific namespace, which is 'production' in this case. A RoleBinding then binds that Role to a user, group, or service account within the same namespace, ensuring the permissions are scoped correctly. This combination restricts secret read access exclusively to the 'production' namespace, meeting the requirement precisely.

Answer

Create a ClusterRole with get and list on secrets, then a RoleBinding in 'production'

Answer

Create a Role with get and list on secrets in namespace 'production', then a ClusterRoleBinding

Answer

Create a ClusterRole with get and list on secrets, then a ClusterRoleBinding to bind it to the user

Question 7

Which of the following flags should be set to `false` to disable anonymous authentication to the Kubernetes API server?

Accepted Answer

--anonymous-auth=false. Option C is correct because setting `--anonymous-auth=false` on the kube-apiserver disables anonymous requests. By default, anonymous authentication is enabled (set to `true`), allowing unauthenticated users to access the API server. Disabling it is a critical hardening step to prevent unauthorized access.

Answer

--disable-anonymous=true

Answer

--auth-mode=RBAC

Answer

--enable-anonymous-auth=false

Question 8

A pod runs with a service account that has a ClusterRoleBinding granting cluster-admin. What is the best practice to reduce the risk of privilege escalation?

Accepted Answer

Create a more restrictive Role/ClusterRole with only required permissions and bind it to the service account, removing the cluster-admin binding. Option C is correct because the principle of least privilege dictates that a service account should only have the permissions necessary for its function. By creating a more restrictive Role/ClusterRole with only required permissions and binding it to the service account, you remove the excessive cluster-admin privileges, directly reducing the risk of privilege escalation. This aligns with Kubernetes RBAC best practices for hardening cluster setup.

Answer

Use a PodSecurityPolicy to restrict the service account

Answer

Delete the service account and create a new one without any roles

Answer

Add a NetworkPolicy to block outbound traffic from the pod

Question 9

You are securing etcd. Which of the following is required to enable TLS client authentication for etcd?

Accepted Answer

Set --client-cert-auth to true and provide --trusted-ca-file. Option D is correct because etcd requires `--client-cert-auth=true` to enforce TLS client certificate authentication for incoming client requests, and `--trusted-ca-file` must be provided to specify the CA certificate used to validate client certificates. Without both, client certificate authentication is not enabled.

Answer

Set --auto-tls to true

Answer

Set --peer-client-cert-auth to true

Answer

Use --cert-file and --key-file only

Question 10

The Kubernetes Dashboard is deployed in the cluster. To secure it, which of the following is a recommended practice?

Accepted Answer

Access it via kubectl proxy. Accessing the Kubernetes Dashboard via `kubectl proxy` is recommended because it creates an authenticated HTTP proxy between your local machine and the Kubernetes API server. This ensures that all traffic to the Dashboard is tunneled through the API server's authentication and authorization mechanisms, preventing direct exposure of the Dashboard to the network and reducing the attack surface.

Answer

Create a NodePort service to access it externally

Answer

Use an Ingress without TLS

Answer

Expose it using a LoadBalancer service for easy access

Question 11

Which flag enables the NodeRestriction admission plugin on the API server?

Accepted Answer

--enable-admission-plugins=NodeRestriction. The `--enable-admission-plugins` flag is the correct parameter to activate admission controllers in the kube-apiserver. The NodeRestriction plugin limits the Node and Pod objects a kubelet can modify, enforcing the principle of least privilege. Option A correctly uses this flag with the plugin name.

Answer

--admission-control=NodeRestriction

Answer

--kubelet-restriction=NodeRestriction

Answer

--node-restriction=true

Question 12

An administrator runs `kube-bench` and sees that the check 'Ensure that the --protect-kernel-defaults flag is set to true' has failed. Which component does this check apply to?

Accepted Answer

Kubelet. The `--protect-kernel-defaults` flag is a kubelet-specific security option that ensures the kubelet does not modify kernel parameters that could weaken node security. When set to true, it enforces that the kubelet respects kernel defaults, preventing privilege escalation via sysctl overrides. This check is part of the CIS Benchmark for the kubelet component, not for etcd, the API server, or the controller manager.

Answer

etcd

Answer

API server

Answer

Controller manager

Question 13

Which two of the following are recommended by the CIS Kubernetes Benchmark? (Choose two.)

Accepted Answer

Disable anonymous authentication on the API server. Option C is correct because the CIS Kubernetes Benchmark explicitly recommends disabling anonymous authentication on the API server to prevent unauthenticated access. Anonymous requests bypass all authentication checks and can lead to unauthorized cluster operations if RBAC is not properly scoped. Setting the `--anonymous-auth=false` flag on the API server ensures that only authenticated users can interact with the cluster.

Answer

Use NodePort services for internal communication

Answer

Enable the insecure port on the API server

Answer

Use the default service account for all pods

Question 14

Which three of the following are valid methods to restrict access to etcd? (Choose three.)

Accepted Answer

Enable RBAC authorization on etcd. Option A is correct because etcd supports Role-Based Access Control (RBAC) natively since version 3.0. By enabling RBAC on etcd, you can define roles and permissions to restrict which users or processes can read or write to specific keys or prefixes. This is a direct method to secure the etcd datastore against unauthorized access.

Answer

Disable the etcd API and use only the embedded etcd in control plane

Answer

Encrypt etcd data at rest using EncryptionConfiguration

Question 15

Which two of the following are correct ways to enforce least privilege for service accounts? (Choose two.)

Accepted Answer

Set automountServiceAccountToken: false in Pod spec for pods that do not need API access. Setting `automountServiceAccountToken: false` in the Pod spec prevents the automatic mounting of the service account token into the container. This enforces least privilege by ensuring that pods which do not require API access cannot inadvertently use the token to authenticate to the Kubernetes API server, reducing the attack surface.

Answer

Add multiple ClusterRoleBindings to a single service account to ensure it has access to all resources

Answer

Use the default service account for all workloads

Answer

Grant cluster-admin ClusterRole to the service account for simplicity