CKS Minimize Microservice Vulnerabilities Practice Test 12 — 15 Questions

Question 1

A security engineer runs the following command to inspect a pod's security context:

kubectl get pod secure-pod -o jsonpath='{.spec.containers[0].securityContext.capabilities}'

The output is: {"drop":["ALL"]}

What does this indicate?

Accepted Answer

The container has all Linux capabilities dropped. The capabilities field with drop: ["ALL"] removes all Linux capabilities from the container, increasing security.

Answer

The output is invalid because capabilities should be in add field

Answer

The container has no capability restrictions

Answer

The container has only the NET_ADMIN capability added

Question 2

An OPA/Gatekeeper ConstraintTemplate is defined with the following Rego rule:

violation[{"msg": msg}] {
  container := input.review.object.spec.containers[_]
  container.securityContext.runAsNonRoot != true
  msg := "Container must run as non-root"
}

What happens when a pod is submitted with a container that has runAsNonRoot: true?

Accepted Answer

The pod is admitted. The rule produces a violation only when runAsNonRoot is not true. If it is true, the rule does not fire, and the pod is admitted.

Answer

The pod is admitted but an audit log is generated

Answer

The pod is denied with a message

Answer

The pod is mutated to set runAsNonRoot

Question 3

Which of the following is a MutatingAdmissionWebhook that is built into Kubernetes and can automatically inject a sidecar proxy for service mesh?

Accepted Answer

Istio sidecar injector. Istio’s sidecar injector is a mutating webhook that modifies pod specs to add the Envoy proxy sidecar.

Answer

PodSecurity admission controller

Answer

Cert-manager

Answer

Gatekeeper

Question 4

Which TWO of the following are best practices for securing secrets in Kubernetes? (Select 2)

Accepted Answer

Use external secret management systems like HashiCorp Vault. Mounting secrets as volumes and using external secret managers are recommended best practices to minimize exposure.

Answer

Enable encryption at rest for etcd

Answer

Set secrets with kubectl create secret generic --from-literal

Answer

Store secrets in ConfigMaps for easier rotation

Question 5

Which THREE of the following security context settings help mitigate container breakout attacks? (Select 3)

Accepted Answer

readOnlyRootFilesystem: true. runAsNonRoot, allowPrivilegeEscalation: false, and readOnlyRootFilesystem are standard security hardening measures that reduce the risk of container breakout.

Answer

privileged: true

Answer

capabilities: add: ['NET_ADMIN']

Question 6

Which TWO of the following are valid methods to enforce mTLS in an Istio service mesh? (Select 2)

Accepted Answer

Create a PeerAuthentication resource with mtls.mode: STRICT. PeerAuthentication enforces mTLS on the server side, and DestinationRule configures the client side. Both are used together for comprehensive mTLS enforcement.

Answer

Create a ServiceEntry for internal services

Answer

Create a VirtualService with tls termination

Answer

Set global.mtls.enabled: true in IstioConfigMap

Question 7

An administrator wants to enforce that all containers in a Kubernetes cluster run as non-root and have read-only root filesystems using OPA/Gatekeeper. Which two resources must be created?

Accepted Answer

ConstraintTemplate and Constraint. In OPA/Gatekeeper, a ConstraintTemplate defines the Rego logic (policy), and a Constraint instantiates that policy with specific parameters and scope. Pod Security Policies are deprecated; PodSecurity admission is a separate mechanism. ValidatingWebhookConfiguration is auto-managed by Gatekeeper.

Answer

NetworkPolicy and RoleBinding

Answer

PodSecurityPolicy and ClusterRole

Answer

ValidatingWebhookConfiguration and MutatingWebhookConfiguration

Question 8

A developer wants to run a container that reads a secret from a mounted volume, not as an environment variable. Which volume type should they use?

Accepted Answer

secret. The secret volume type mounts a Kubernetes Secret as files into a container. ConfigMaps are for non-sensitive data. hostPath is for host filesystem. emptyDir is ephemeral.

Answer

emptyDir

Answer

hostPath

Answer

configMap

Question 9

An admin creates the following EncryptionConfiguration to encrypt secrets at rest. After applying it, what must the admin do to ensure existing secrets are encrypted?

Accepted Answer

Re-create the existing secrets. The EncryptionConfiguration only encrypts newly created secrets. Existing secrets must be re-created (e.g., by replacing them) to be encrypted. The kube-apiserver does not automatically rewrite existing resources.

Answer

Restart the kube-apiserver

Answer

Delete the existing secrets and wait for them to be recreated automatically

Answer

Nothing, the existing secrets are automatically encrypted

Question 10

In an Istio service mesh, you want to enforce mutual TLS (mTLS) between all services in the 'default' namespace. Which resource should you create?

Accepted Answer

PeerAuthentication with mTLS mode STRICT. PeerAuthentication defines mTLS mode for workloads. DestinationRule can be used for traffic policies, but PeerAuthentication is the primary resource for mTLS enforcement. ServiceEntry is for external services. Sidecar is for customizing the sidecar proxy.

Answer

Sidecar resource with outboundTrafficPolicy REGISTRY_ONLY

Answer

ServiceEntry with resolution NONE

Answer

DestinationRule with trafficPolicy tls mode ISTIO_MUTUAL

Question 11

Which kubectl command creates a valid webhook configuration that validates pods against a policy?

Accepted Answer

kubectl apply -f validatingwebhookconfiguration.yaml. ValidatingWebhookConfiguration is the correct resource for admission webhooks that validate requests. PodPreset is deprecated, and other options are not valid resources.

Answer

kubectl apply -f webhookconfiguration.yaml

Answer

kubectl apply -f podpreset.yaml

Answer

kubectl apply -f mutatingwebhookconfiguration.yaml

Question 12

A cluster administrator needs to run a workload that uses gVisor (runsc) for container sandboxing. Which Kubernetes resource is required to enable this?

Accepted Answer

RuntimeClass. RuntimeClass specifies the container runtime to use for pods. It must be defined and referenced in the pod spec. PodSecurityPolicy is deprecated. PriorityClass is for scheduling priority. NetworkPolicy is for network rules.

Answer

PriorityClass

Answer

NetworkPolicy

Answer

PodSecurityPolicy

Question 13

A pod manifests with securityContext: { runAsNonRoot: true, runAsUser: 1001 }. However, the container image expects to run as root (UID 0). What will happen when the pod is created?

Accepted Answer

The container fails to start because it cannot run as root. runAsNonRoot: true prevents the container from running as UID 0. If the image user is root, the container will not start. The pod might be rejected by admission control or fail to run. It will not run as root or switch to user 1001 automatically if the image entrypoint expects root.

Answer

The container runs as root because runAsUser overrides runAsNonRoot

Answer

The container runs as user 1001

Answer

The pod runs, but the securityContext is ignored

Question 14

You are writing a Rego policy for OPA/Gatekeeper to deny pods that do not have runAsNonRoot set to true. Which Rego statement should the ConstraintTemplate contain?

Accepted Answer

violation[msg] { not input.request.object.spec.securityContext.runAsNonRoot == true }. Deny rules in Rego return false to reject the request. A violation is typically a rule that evaluates to true when the policy is violated. The deny or violation rule must return true if the condition is not met. Option B correctly checks that runAsNonRoot is not true and returns true (violation).

Answer

deny[msg] { input.request.object.spec.securityContext.runAsNonRoot == true }

Answer

allow[msg] { input.request.object.spec.securityContext.runAsNonRoot == false }

Answer

deny[msg] { input.request.object.spec.containers[_].securityContext.runAsNonRoot == true }

Question 15

An admin runs 'kubectl get pod web -o yaml' and sees the following security context. Which setting prevents privilege escalation?

Accepted Answer

allowPrivilegeEscalation: false. allowPrivilegeEscalation: false directly prevents processes from gaining more privileges than their parent. Dropping all capabilities reduces attack surface but does not itself prevent privilege escalation. runAsNonRoot ensures the container does not run as root but does not prevent escalation if the container could still gain capabilities.

Answer

Both B and C

Answer

runAsNonRoot: true

Answer

capabilities: drop: [ALL]