CKS Minimize Microservice Vulnerabilities Practice Test 11 — 15 Questions

Question 1

You have a Pod that uses a ServiceAccount token mounted via a projected volume. You want to ensure that the token has an expiration time and that the pod is not using a long-lived token. What is the most secure way to mount the token?

Accepted Answer

Use a projected volume with 'serviceAccountToken' and set 'expirationSeconds'

Answer

Mount the default service account token at /var/run/secrets/kubernetes.io/serviceaccount

Answer

Set automountServiceAccountToken: false and manually mount a Secret containing a token

Answer

Use a ConfigMap to inject the token

Question 2

You need to create a NetworkPolicy that denies all ingress traffic to pods with label 'app: web' in the 'frontend' namespace, except for traffic from pods with label 'app: ingress' in the 'ingress' namespace. Which NetworkPolicy spec correctly achieves this?

Accepted Answer

ingress:
- from:
  - namespaceSelector:
      matchLabels:
        kubernetes.io/metadata.name: ingress
    podSelector:
      matchLabels:
        app: ingress

Answer

ingress:
- from:
  - namespaceSelector:
      matchLabels:
        name: ingress
    podSelector:
      matchLabels:
        app: ingress

Answer

ingress:
- from:
  - namespaceSelector:
      matchLabels:
        app: ingress
    podSelector: {}

Answer

ingress:
- from:
  - podSelector:
      matchLabels:
        app: ingress
  - namespaceSelector:
      matchLabels:
        kubernetes.io/metadata.name: ingress

Question 3

Which kubectl command would you use to create a Secret from a file named 'db-password.txt'?

Accepted Answer

kubectl create secret generic db-password --from-file=db-password.txt

Answer

kubectl apply -f db-password.txt

Answer

kubectl create configmap db-password --from-file=db-password.txt

Answer

kubectl create secret tls db-password --cert=db-password.txt

Question 4

Which TWO of the following are valid ways to enforce that a container runs as a non-root user?

Accepted Answer

Set runAsNonRoot: true in the pod securityContext

Answer

Set the container image to use a root user

Answer

Use a PodSecurityPolicy (PSP)

Answer

Set runAsUser: 0 in the container securityContext

Question 5

Which THREE of the following are capabilities that should typically be dropped from a container to minimize vulnerabilities?

Accepted Answer

NET_ADMIN

Answer

CHOWN

Answer

KILL

Question 6

You want to use an external secret management system like HashiCorp Vault to manage database credentials for your application. Which of the following are valid approaches to integrate Vault with Kubernetes?

Accepted Answer

Store Vault tokens in a Kubernetes Secret and mount them

Answer

Use environment variables from Vault with a script

Answer

Store Vault tokens in a ConfigMap and mount them into pods

Question 7

A security engineer needs to ensure that all containers in a cluster run as non-root users. Which Pod Security Context field should be set to enforce this requirement?

Accepted Answer

runAsNonRoot: true. runAsNonRoot: true is the correct field to ensure containers cannot run as root. It is a Pod Security Context field that rejects pods whose container image specifies a root user or does not specify a user.

Answer

runAsUser: 1000

Answer

privileged: false

Answer

allowPrivilegeEscalation: false

Question 8

You are tasked with creating a ConstraintTemplate in OPA/Gatekeeper that denies pods running with the 'latest' image tag. Which Rego rule should the ConstraintTemplate include?

Accepted Answer

violation[{"msg": msg}] { ... }. Gatekeeper ConstraintTemplates use a Rego rule named 'violation' to define admission violations. When the rule evaluates to true, the request is denied.

Answer

admit[{"msg": msg}] { ... }

Answer

reject[{"msg": msg}] { ... }

Answer

deny[{"msg": msg}] { ... }

Question 9

An administrator deploys a Pod with the following security context:

securityContext:
  runAsNonRoot: true
  runAsUser: 1000

However, the Pod fails to start with an error: 'container has runAsNonRoot and image will run as root'. What is the most likely cause?

Accepted Answer

The container image specifies USER root in its Dockerfile. runAsNonRoot: true requires that the image's default user is not root (UID 0). Even though runAsUser overrides the user, the validation checks the image's USER directive first.

Answer

The container runtime does not support runAsNonRoot

Answer

The pod is missing a seccomp profile

Answer

The runAsUser field is set to 1000, which is a non-root user

Question 10

A security best practice is to avoid storing sensitive data in environment variables. Instead, secrets should be mounted as volumes. Which of the following YAML snippets correctly mounts a Kubernetes Secret named 'db-secret' as a volume at /etc/secrets?

Accepted Answer

volumes:
- name: secret-volume
  secret:
    secretName: db-secret
containers:
- name: app
  volumeMounts:
  - name: secret-volume
    mountPath: /etc/secrets. Option A shows the correct syntax for mounting a secret as a volume. Option B uses ConfigMap, C has wrong field name, D uses env var.

Answer

volumes:
- name: secret-volume
  secret:
    name: db-secret
containers:
- name: app
  volumeMounts:
  - name: secret-volume
    mountPath: /etc/secrets

Answer

volumes:
- name: secret-volume
  configMap:
    name: db-secret
containers:
- name: app
  volumeMounts:
  - name: secret-volume
    mountPath: /etc/secrets

Answer

containers:
- name: app
  env:
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: db-secret
        key: password

Question 11

An administrator wants to enforce mTLS between all services in the 'mesh' namespace using Istio. Which resource should be applied to require mutual TLS for all workloads in that namespace?

Accepted Answer

PeerAuthentication with mtls.mode: STRICT in the namespace. PeerAuthentication is the Istio resource that defines how traffic is handled at the sidecar proxy level. Setting mode: STRICT requires mTLS for all traffic in the namespace.

Answer

VirtualService with tls mode

Answer

DestinationRule with trafficPolicy.tls.mode: ISTIO_MUTUAL

Answer

ServiceEntry for external services

Question 12

To encrypt secrets at rest in Kubernetes, an administrator configures an EncryptionConfiguration. What is the correct flag to pass to the kube-apiserver to use this configuration?

Accepted Answer

--encryption-provider-config=/path/to/config.yaml. The kube-apiserver uses --encryption-provider-config to load the EncryptionConfiguration YAML file that defines how etcd data is encrypted.

Answer

--feature-gates=EncryptionAtRest=true

Answer

--encryption-key=/path/to/config.yaml

Answer

--encryption-config=/path/to/config.yaml

Question 13

A cluster administrator wants to audit all pod creations and modifications using an admission webhook. Which resource type should be created to register the webhook?

Accepted Answer

ValidatingWebhookConfiguration. ValidatingWebhookConfiguration is used for admission webhooks that validate (allow/deny) requests without modifying them.

Answer

WebhookConfiguration

Answer

MutatingWebhookConfiguration

Answer

AdmissionWebhook

Question 14

Which of the following is a valid approach to enforce that containers cannot escalate privileges?

Accepted Answer

Set securityContext.allowPrivilegeEscalation: false. allowPrivilegeEscalation controls whether a process can gain more privileges than its parent. Setting it to false is the direct way to prevent privilege escalation.

Answer

Set securityContext.readOnlyRootFilesystem: true

Answer

Set securityContext.privileged: false

Answer

Set securityContext.capabilities.drop: ["ALL"]

Question 15

An administrator wants to use gVisor as the container runtime for specific high-security workloads. After installing gVisor, what Kubernetes resource must be created to allow pods to request gVisor?

Accepted Answer

RuntimeClass with handler: runsc. RuntimeClass is the standard Kubernetes way to select a container runtime. For gVisor, the handler is 'runsc'.

Answer

CustomResourceDefinition for gVisor

Answer

PodSecurityPolicy with runtimeClass: gvisor

Answer

ConfigMap with runtime handler mapping