CKS Minimize Microservice Vulnerabilities Practice Test 10 — 15 Questions

Question 1

An administrator wants to prevent pods from using secrets as environment variables and enforce that secrets are only mounted as volumes. Which admission controller could be used to achieve this?

Accepted Answer

MutatingWebhookConfiguration. A MutatingWebhookConfiguration can be used to modify pod specs at admission time, for example to remove environment variable references to secrets and replace them with volume mounts. Alternatively, a ValidatingWebhookConfiguration could deny pods that use secrets as env vars. Both are valid, but a mutating webhook can automatically fix the issue.

Answer

NetworkPolicy

Answer

PodSecurityPolicy (deprecated)

Answer

ValidatingWebhookConfiguration

Question 2

Which kubectl command creates a validating webhook configuration that calls an external HTTPS endpoint for pod validation?

Accepted Answer

kubectl apply -f webhook.yaml. The correct way is to create a YAML file for a ValidatingWebhookConfiguration resource and apply it with kubectl apply. There is no kubectl create command for webhook configurations directly; you must use a manifest.

Answer

kubectl create admission webhook --validate

Answer

kubectl run webhook --image=...

Answer

kubectl create validatingwebhookconfiguration --url=https://...

Question 3

You are using External Secrets Operator to sync secrets from HashiCorp Vault. The operator is deployed but secrets are not being created. Which resource defines the mapping between Vault secrets and Kubernetes secrets?

Accepted Answer

ExternalSecret. External Secrets Operator uses a custom resource called ExternalSecret (or sometimes SecretStore depending on the version) to define the mapping. The ExternalSecret resource specifies the backend (Vault) and the secret keys to sync.

Answer

ClusterSecretStore

Answer

VaultSecret

Answer

SecretStore

Question 4

Which TWO of the following are valid methods to securely manage secrets in Kubernetes? (Select 2)

Accepted Answer

Use an external secrets manager like HashiCorp Vault with a CSI driver or operator. Mounting secrets as volumes (option A) is secure because the secret is not exposed in environment variables or command arguments. Using external secret managers like Vault (option C) is a best practice for centralized secret management. Option B (env vars) is insecure as secrets can be leaked in process listings. Option D (hardcoded in images) is insecure. Option E (ConfigMaps) is for non-sensitive data.

Answer

Store secrets directly in container images as files

Answer

Store secrets in ConfigMaps

Answer

Pass secrets as environment variables from a Secret resource

Question 5

Which TWO of the following are valid Pod Security Context settings to harden a container? (Select 2)

Accepted Answer

runAsNonRoot: true. runAsNonRoot: true (option A) ensures the container does not run as root. readOnlyRootFilesystem: true (option C) prevents writes to the root filesystem. Option B (privileged: true) is insecure. Option D (runAsUser: 0) runs as root. Option E (allowPrivilegeEscalation: true) allows privilege escalation.

Answer

privileged: true

Answer

runAsUser: 0

Answer

allowPrivilegeEscalation: true

Question 6

Which THREE of the following are valid ways to enforce mTLS in an Istio service mesh? (Select 3)

Accepted Answer

DestinationRule with trafficPolicy.tls.mode set to ISTIO_MUTUAL. PeerAuthentication with mTLS mode (option A) enforces mTLS per namespace or workload. DestinationRule with tls settings (option B) configures client-side TLS settings. ServiceEntry can enable mTLS for external services (option D). Option C (NetworkPolicy) is for Kubernetes network policies, not TLS. Option E (AuthorizationPolicy) is for access control, not TLS configuration.

Answer

AuthorizationPolicy with deny rules for non-mTLS traffic

Answer

NetworkPolicy with ingress rules to allow only TLS traffic

Question 7

Which field in a PodSecurityContext ensures that the container cannot gain privileges beyond its parent process?

Accepted Answer

allowPrivilegeEscalation

Answer

privileged

Answer

readOnlyRootFilesystem

Answer

runAsNonRoot

Question 8

You need to enforce that all containers in a namespace run with a read-only root filesystem. Which OPA Gatekeeper resource would you use to define the policy?

Accepted Answer

ConstraintTemplate

Answer

Constraint

Answer

ValidatingWebhookConfiguration

Answer

ConfigMap

Question 9

An administrator creates a Pod with the following securityContext:
securityContext:
  runAsUser: 1000
  runAsGroup: 3000
  fsGroup: 2000
The container image has a binary that requires read/write access to /data, which is an emptyDir volume mounted by the Pod. The container fails to start with 'Permission denied' when writing to /data. What is the most likely cause?

Answer

The container's base image has a restrictive umask that overrides the pod's security context.

Answer

The fsGroup is set but the volume's fsGroupChangePolicy is missing.

Answer

The emptyDir volume is not writable by default; it needs to be explicitly configured.

Answer

The container is running as user 1000, but the volume is owned by root (uid 0) and the fsGroup 2000 does not give write permission.

Question 10

You are deploying an application that needs to access a database password stored in a Kubernetes Secret. To minimize risk, you should mount the Secret as a volume rather than using environment variables. Which of the following is the primary security benefit of using mounted volumes over environment variables?

Accepted Answer

Environment variables can be leaked through commands like 'env' or 'cat /proc/1/environ', while mounted files are only accessible if the container has a shell and reads the file.

Answer

Mounted volumes are not visible in /proc, making them inaccessible to other processes.

Answer

Environment variables are stored in etcd in plaintext, while volumes are encrypted at rest.

Answer

Mounted volumes automatically rotate the secret when the Secret object is updated.

Question 11

In an Istio service mesh, you want to enforce mutual TLS (mTLS) between services in a specific namespace. Which resource should you create to set the default mTLS mode to STRICT for all workloads in that namespace?

Accepted Answer

PeerAuthentication

Answer

VirtualService

Answer

ServiceEntry

Answer

DestinationRule

Question 12

You have enabled encryption at rest for Kubernetes Secrets by configuring an EncryptionConfiguration object and restarting the API server. After the configuration, you create a new Secret. However, when you retrieve the Secret using 'kubectl get secret mysecret -o yaml', the 'data' field still shows base64-encoded plaintext. Is the Secret encrypted at rest?

Accepted Answer

Yes, because encryption at rest applies to the storage layer (etcd), not the API response.

Answer

No, because only Secrets in namespaces with a specific annotation are encrypted.

Answer

Yes, but only if the Secret was created after the API server restart.

Answer

No, because the data is still visible in the API response.

Question 13

You need to set up a ValidatingWebhookConfiguration to deny pods that run as root. The webhook server is deployed in the 'webhook' namespace with service 'webhook-svc' on port 443. Which of the following is a correct snippet for the webhook configuration?

Accepted Answer

clientConfig:
  service:
    name: webhook-svc
    namespace: webhook
    path: /validate
    port: 443

Answer

clientConfig:
  url: https://10.96.0.1:443/validate

Answer

clientConfig:
  url: https://webhook-svc.webhook.svc:443/validate

Answer

clientConfig:
  service:
    name: webhook-svc
    namespace: webhook
    path: /validate
  caBundle: <base64>

Question 14

You want to run a workload in a sandboxed container using gVisor. You have created a RuntimeClass named 'gvisor' that references the 'runsc' handler. Which of the following Pod specs correctly uses this RuntimeClass?

Accepted Answer

apiVersion: v1
kind: Pod
metadata:
  name: sandbox-pod
spec:
  runtimeClassName: gvisor
  containers:
  - name: app
    image: nginx

Answer

apiVersion: v1
kind: Pod
metadata:
  name: sandbox-pod
  annotations:
    runtimeClass: gvisor
spec:
  containers:
  - name: app
    image: nginx

Answer

apiVersion: v1
kind: Pod
metadata:
  name: sandbox-pod
spec:
  nodeSelector:
    runtime: gvisor
  containers:
  - name: app
    image: nginx

Answer

apiVersion: v1
kind: Pod
metadata:
  name: sandbox-pod
spec:
  runtimeClass:
    name: gvisor
  containers:
  - name: app
    image: nginx

Question 15

You are writing a Rego policy for OPA Gatekeeper to deny pods that do not have 'runAsNonRoot: true' set in their security context. The ConstraintTemplate expects an input parameter 'runAsNonRoot' that is a boolean. Which Rego rule correctly denies such pods?

Answer

violation[{"msg": msg}] {
  container := input.review.object.spec.containers[_]
  not container.securityContext.runAsNonRoot
  msg := "Container must run as non-root"
}

violation[{"msg": msg}] {
  pod := input.review.object
  not pod.spec.securityContext.runAsNonRoot
  msg := "Pod must run as non-root"
}

Answer

violation[{"msg": msg}] {
  container := input.review.object.spec.containers[_]
  not has_field(container, "securityContext") or not container.securityContext.runAsNonRoot
  msg := "Container must set runAsNonRoot: true"
}

Answer

violation[{"msg": msg}] {
  container := input.review.object.spec.containers[_]
  not container.securityContext.runAsNonRoot
  msg := "Container must run as non-root"
}

Answer

violation[{"msg": msg}] {
  pod := input.review.object
  not pod.spec.securityContext.runAsNonRoot
  msg := "Pod must run as non-root"
}