CKS Minimize Microservice Vulnerabilities Practice Test 2 — 15 Questions

Question 1

Arrange the steps to configure and use Trivy to scan container images for vulnerabilities in a CI/CD pipeline.

Question 2

Match each Kubernetes object or feature to its primary security purpose.

Question 3

Match each Kubernetes network security concept to its definition.

Question 4

Which of the following OPA Gatekeeper Rego policies would deny a pod that sets `securityContext.runAsUser: 0`?

Accepted Answer

violation[{"msg": "Running as root is not allowed"}] { input.review.object.spec.containers[_].securityContext.runAsUser == 0 }. The correct Rego policy denies pods with `runAsUser: 0` because that runs as root. Option A correctly checks for the field and denies if it is 0.

Answer

violation[{"msg": "Running as root is not allowed"}] { input.review.object.spec.containers[_].securityContext.capabilities.drop == "ALL" }

Answer

violation[{"msg": "Running as root is not allowed"}] { input.review.object.spec.securityContext.runAsUser == 0 }

Answer

violation[{"msg": "Running as root is not allowed"}] { input.review.object.spec.containers[_].securityContext.runAsNonRoot == true }

Question 5

A developer wants to ensure that all containers in a pod run with a read-only root filesystem except for a specific volume mounted for writing logs. Which container-level security context field should be set to true?

Accepted Answer

readOnlyRootFilesystem. The field `readOnlyRootFilesystem: true` makes the container's root filesystem read-only, which forces all writes to go to mounted volumes.

Answer

allowPrivilegeEscalation

Answer

privileged

Answer

runAsNonRoot

Question 6

Which Istio resource is used to enforce mutual TLS (mTLS) for all services in a namespace, ensuring that traffic between services is encrypted?

Accepted Answer

PeerAuthentication. PeerAuthentication defines the traffic policy for mTLS within a namespace. Setting `mode: STRICT` enforces mTLS for all services in the namespace.

Answer

DestinationRule

Answer

ServiceEntry

Answer

VirtualService

Question 7

Which kubectl command would you use to create a ValidatingWebhookConfiguration from a YAML file?

Accepted Answer

kubectl apply -f webhook.yaml. The correct command is `kubectl apply -f webhook.yaml` to create or update the resource from a file.

Answer

kubectl run webhook --image=webhook --restart=Never

Answer

kubectl create -f webhook.yaml

Answer

kubectl expose deployment webhook --port=443

Question 8

A cluster administrator has configured EncryptionConfiguration to encrypt secrets at rest using a local key. After applying the configuration, the administrator creates a new secret. How can they verify that the secret is encrypted at rest?

Accepted Answer

Use etcdctl to read the secret directly from etcd and verify it is encrypted.. The encryption is transparent to clients; you can verify by reading the raw data from etcd or enabling audit logging. Option A is correct: direct etcd access shows encrypted data.

Answer

Run kubectl get secret -o yaml and check for an encryption annotation.

Answer

Use kubectl describe secret and look for 'Encrypted: true'.

Answer

Check the apiserver logs for encryption status messages.

Question 9

A pod is using a RuntimeClass that specifies gVisor (runsc). Which of the following scenarios is most likely to cause the pod to fail?

Accepted Answer

The pod attempts to mount a hostPath directory with privileged access.. gVisor intercepts system calls and may not support all of them, especially ones that require direct hardware access. Option C is most likely to fail.

Answer

The pod runs a web server listening on port 8080.

Answer

The pod mounts a ConfigMap as a volume.

Answer

The pod uses a PersistentVolumeClaim for storage.

Question 10

Which of the following is the best practice for providing sensitive data like passwords to a pod?

Accepted Answer

Mount secrets as volumes into the pod.. Mounting secrets as volumes is more secure than environment variables because volumes do not expose secrets in process listings or logs.

Answer

Use environment variables to inject secrets directly.

Answer

Pass secrets via command-line arguments.

Answer

Hardcode the secret in the container image.

Question 11

Which Kubernetes admission controller is responsible for mutating and validating pod requests based on policies defined by OPA Gatekeeper?

Accepted Answer

ValidatingAdmissionWebhook. Gatekeeper uses the `ValidatingAdmissionWebhook` and `MutatingAdmissionWebhook` admission controllers. The question asks for the admission controller itself, which is `ValidatingAdmissionWebhook` for validation and `MutatingAdmissionWebhook` for mutation. Since OPA Gatekeeper primarily validates (though it can also mutate), the most directly involved admission controller for policy enforcement is ValidatingAdmissionWebhook.

Answer

PodSecurityPolicy

Answer

ServiceAccount

Answer

NodeRestriction

Question 12

A cluster administrator wants to ensure that all pods in a namespace run with the `seccomp` profile set to `RuntimeDefault`. Which OPA Gatekeeper ConstraintTemplate would achieve this?

Accepted Answer

violation[{"msg": "Seccomp profile must be RuntimeDefault"}] { input.review.object.spec.containers[_].securityContext.seccompProfile.type != "RuntimeDefault" }. The correct Rego policy checks that the container's securityContext has `seccompProfile.type: RuntimeDefault`. Option A does this correctly.

Answer

violation[{"msg": "Seccomp profile must be RuntimeDefault"}] { input.review.object.spec.containers[_].securityContext.seccompProfile.type == "Unconfined" }

Answer

violation[{"msg": "Seccomp profile must be RuntimeDefault"}] { input.review.object.spec.containers[_].securityContext.seccompProfile == "RuntimeDefault" }

Answer

violation[{"msg": "Seccomp profile must be RuntimeDefault"}] { input.review.object.spec.securityContext.seccompProfile.type != "RuntimeDefault" }

Question 13

A pod fails to start with the error 'Container runtime network not ready', and the node uses Kata Containers (RuntimeClass: kata). What is the most likely cause?

Accepted Answer

The CNI plugin is not configured correctly for the kata RuntimeClass. Kata Containers run inside a lightweight VM with its own kernel. Network configuration can be complex, and if the CNI plugin is not properly configured for Kata, the network may not be ready.

Answer

The node has insufficient memory

Answer

The pod is trying to mount a hostPath volume

Answer

The pod's securityContext sets runAsNonRoot: true

Question 14

Which of the following is the correct way to drop all capabilities in a container's security context?

Accepted Answer

securityContext: capabilities: drop: ['ALL']. The correct YAML is `capabilities: drop: ['ALL']` under securityContext.

Answer

securityContext: capabilities: remove: ['ALL']

Answer

securityContext: capabilities: []

Answer

securityContext: capabilities: add: []

Question 15

What is the purpose of the `allowPrivilegeEscalation: false` setting in a container's security context?

Accepted Answer

It prevents processes from gaining additional privileges (e.g., via setuid).. This setting prevents processes in the container from gaining more privileges than their parent, such as via setuid binaries.

Answer

It prevents the container from running as root.

Answer

It prevents the container from using host networking.

Answer

It prevents the container from accessing host devices.