CKS Minimize Microservice Vulnerabilities Practice Test 10 — 15 Questions

Question 1

Which of the following is a MutatingAdmissionWebhook that is built into Kubernetes and can automatically inject a sidecar proxy for service mesh?

Accepted Answer

Istio sidecar injector. Kubernetes does not include a built-in MutatingAdmissionWebhook that automatically injects a sidecar proxy for service mesh. The Istio sidecar injector (option B) is a common example but is deployed as an add-on, not built into Kubernetes. PodSecurity (option A) is a built-in admission controller but is not a webhook and does not inject sidecars. Cert-manager (option C) and Gatekeeper (option D) are also add-on webhooks not built-in.

Answer

PodSecurity admission controller

Answer

Cert-manager

Answer

Gatekeeper

Question 2

Which TWO of the following are best practices for securing secrets in Kubernetes? (Select 2)

Accepted Answer

Use external secret management systems like HashiCorp Vault. External secret management systems like HashiCorp Vault decouple secrets from the cluster, providing centralized access control, audit logging, and dynamic secret rotation without storing plaintext secrets in etcd. This aligns with the principle of least privilege and reduces the attack surface by avoiding direct Kubernetes secret storage.

Answer

Enable encryption at rest for etcd

Answer

Set secrets with kubectl create secret generic --from-literal

Answer

Store secrets in ConfigMaps for easier rotation

Question 3

Which THREE of the following security context settings help mitigate container breakout attacks? (Select 3)

Accepted Answer

readOnlyRootFilesystem: true. Setting `readOnlyRootFilesystem: true` makes the container's root filesystem read-only, preventing attackers from writing malicious binaries or modifying system files even if they gain code execution inside the container. This directly limits the ability to plant tools or alter configuration files that could facilitate a breakout to the host.

Answer

privileged: true

Answer

capabilities: add: ['NET_ADMIN']

Question 4

Which TWO of the following are valid methods to enforce mTLS in an Istio service mesh? (Select 2)

Accepted Answer

Create a PeerAuthentication resource with mtls.mode: STRICT. A PeerAuthentication resource with `mtls.mode: STRICT` enforces mutual TLS at the service-to-service communication level within the Istio mesh. This setting ensures that all traffic between sidecar proxies uses mTLS, rejecting any plaintext connections, which directly minimizes the risk of unauthorized access or eavesdropping.

Answer

Create a ServiceEntry for internal services

Answer

Create a VirtualService with tls termination

Answer

Set global.mtls.enabled: true in IstioConfigMap

Question 5

An administrator wants to enforce that all containers in a Kubernetes cluster run as non-root and have read-only root filesystems using OPA/Gatekeeper. Which two resources must be created?

Accepted Answer

ConstraintTemplate and Constraint. OPA/Gatekeeper enforces policies via the Constraint Framework, which requires two resources: a ConstraintTemplate (defining the policy logic in Rego) and a Constraint (applying the template to specific resources). Together, they allow you to require containers run as non-root and have read-only root filesystems by evaluating admission requests against the defined rules.

Answer

NetworkPolicy and RoleBinding

Answer

PodSecurityPolicy and ClusterRole

Answer

ValidatingWebhookConfiguration and MutatingWebhookConfiguration

Question 6

A developer wants to run a container that reads a secret from a mounted volume, not as an environment variable. Which volume type should they use?

Accepted Answer

secret. The `secret` volume type in Kubernetes is specifically designed to inject sensitive data (e.g., passwords, tokens) into pods as files mounted from a tmpfs-backed in-memory filesystem, avoiding exposure as environment variables. This ensures the secret is never written to disk on the node and is only accessible via the container's filesystem at the specified mount path, aligning with the developer's requirement to read from a mounted volume.

Answer

emptyDir

Answer

hostPath

Answer

configMap

Question 7

An admin creates the following EncryptionConfiguration to encrypt secrets at rest. After applying it, what must the admin do to ensure existing secrets are encrypted?

Accepted Answer

Re-create the existing secrets. When an EncryptionConfiguration is applied to encrypt secrets at rest, the kube-apiserver uses the configured encryption provider to encrypt new or updated secrets as they are written to etcd. However, existing secrets that were stored in plaintext before the configuration was applied remain unencrypted in etcd. To ensure these existing secrets are encrypted, the admin must re-create them (e.g., by deleting and recreating them or using `kubectl get secret -o yaml | kubectl replace -f -`), which triggers a write to etcd through the encryption provider.

Answer

Restart the kube-apiserver

Answer

Delete the existing secrets and wait for them to be recreated automatically

Answer

Nothing, the existing secrets are automatically encrypted

Question 8

In an Istio service mesh, you want to enforce mutual TLS (mTLS) between all services in the 'default' namespace. Which resource should you create?

Accepted Answer

PeerAuthentication with mTLS mode STRICT. To enforce mutual TLS (mTLS) between all services in the 'default' namespace, you create a PeerAuthentication resource with mTLS mode set to STRICT. This policy enforces that all traffic within the namespace must use mTLS, rejecting any plaintext connections. PeerAuthentication is the Istio resource specifically designed to define mTLS enforcement at the namespace or mesh level.

Answer

Sidecar resource with outboundTrafficPolicy REGISTRY_ONLY

Answer

ServiceEntry with resolution NONE

Answer

DestinationRule with trafficPolicy tls mode ISTIO_MUTUAL

Question 9

Which kubectl command creates a valid webhook configuration that validates pods against a policy?

Accepted Answer

kubectl apply -f validatingwebhookconfiguration.yaml. A ValidatingWebhookConfiguration is the Kubernetes resource that intercepts API server requests to validate resources (e.g., pods) against an external policy before they are persisted. The command `kubectl apply -f validatingwebhookconfiguration.yaml` creates this configuration, which triggers a webhook call to an admission webhook server that returns an admission review with an 'allowed' or 'denied' decision.

Answer

kubectl apply -f webhookconfiguration.yaml

Answer

kubectl apply -f podpreset.yaml

Answer

kubectl apply -f mutatingwebhookconfiguration.yaml

Question 10

A cluster administrator needs to run a workload that uses gVisor (runsc) for container sandboxing. Which Kubernetes resource is required to enable this?

Accepted Answer

RuntimeClass [CORRECT]. A RuntimeClass resource is required to enable gVisor (runsc) because it defines the container runtime configuration that should be used for pods. By creating a RuntimeClass with the handler set to 'runsc', the cluster administrator can instruct the kubelet to use gVisor as the OCI-compatible runtime for sandboxing, providing an additional security layer through a user-space kernel.

Answer

PriorityClass [wrong]

Answer

NetworkPolicy [wrong]

Answer

PodSecurityPolicy [wrong]

Question 11

You are writing a Rego policy for OPA/Gatekeeper to deny pods that do not have runAsNonRoot set to true. Which Rego statement should the ConstraintTemplate contain?

Accepted Answer

violation[msg] { not input.request.object.spec.securityContext.runAsNonRoot == true }. The Rego rule `violation[msg]` is the standard pattern for Gatekeeper ConstraintTemplates to deny a resource. The condition `not input.request.object.spec.securityContext.runAsNonRoot == true` triggers a violation when the field is missing or set to false, ensuring pods do not have `runAsNonRoot` set to true. This directly enforces the requirement to deny pods without the security context.

Answer

deny[msg] { input.request.object.spec.securityContext.runAsNonRoot == true }

Answer

allow[msg] { input.request.object.spec.securityContext.runAsNonRoot == false }

Answer

deny[msg] { input.request.object.spec.containers[_].securityContext.runAsNonRoot == true }

Question 12

An admin runs 'kubectl get pod web -o yaml' and sees the following security context. Which setting prevents privilege escalation?

Accepted Answer

allowPrivilegeEscalation: false. `allowPrivilegeEscalation: false` directly prevents a process from gaining more privileges than its parent process, such as through setuid binaries or gaining root capabilities. This setting is enforced by the kernel via the `no_new_privs` flag, which blocks privilege escalation attempts regardless of other security context settings.

Answer

Both B and C

Answer

runAsNonRoot: true

Answer

capabilities: drop: [ALL]

Question 13

A cluster has a ValidatingWebhookConfiguration that intercepts Pod CREATE requests. The webhook server is unavailable. What happens when a user tries to create a pod?

Accepted Answer

The pod creation is rejected until the webhook becomes available. When a ValidatingWebhookConfiguration is defined and the webhook server is unavailable, the default failure policy is `Fail`, which causes the API server to reject the Pod CREATE request. This ensures that security validation is not bypassed due to webhook downtime, maintaining the cluster's security posture. The pod creation is blocked until the webhook becomes available again, as specified by the `failurePolicy` field in the webhook configuration.

Answer

The webhook is automatically disabled

Answer

The API server crashes

Answer

The pod is created without webhook validation

Question 14

Which TWO of the following are required to enable encryption of Kubernetes Secrets at rest?

Accepted Answer

Create an EncryptionConfiguration resource. Kubernetes requires an EncryptionConfiguration resource to define which resources (e.g., secrets) should be encrypted and with which provider (e.g., AES-CBC, secretbox, or KMS). This configuration is a YAML file that specifies encryption keys and providers, and it is mandatory for enabling encryption at rest. Without this resource, the API server has no encryption policy to apply.

Answer

Configure etcd encryption via etcdctl

Answer

Enable the --feature-gates=EncryptionAtRest=true flag on the API server

Question 15

Which THREE of the following are valid capabilities that should be dropped for a container running a typical non-privileged application to adhere to the principle of least privilege?

Accepted Answer

SYS_ADMIN. The SYS_ADMIN capability is a highly privileged capability that grants access to a wide range of system administration operations, such as mounting filesystems, namespace manipulation, and kernel settings. For a typical non-privileged application, dropping SYS_ADMIN is essential to adhere to the principle of least privilege, as it prevents the container from performing host-level administrative actions that could compromise isolation.

Answer

CHOWN

Answer

SETUID