CKS Minimize Microservice Vulnerabilities Practice Test 5 — 15 Questions

Question 1

A pod is running with the following security context:

```yaml
securityContext:
  allowPrivilegeEscalation: false
  runAsNonRoot: true
  seccompProfile:
    type: RuntimeDefault
```

The pod is in a CrashLoopBackOff. The logs show: "exec user process caused: operation not permitted". What is the most likely cause?

Accepted Answer

The container image is set to run as root, which conflicts with runAsNonRoot.

Answer

The container is missing the CAP_SYS_ADMIN capability.

Answer

The allowPrivilegeEscalation: false prevents the container from starting.

Answer

The seccomp profile is blocking necessary system calls.

Question 2

Which of the following commands creates a ValidatingWebhookConfiguration that uses an OPA Gatekeeper webhook?

Accepted Answer

kubectl apply -f validatingwebhook.yaml where the webhook's service reference points to the gatekeeper-validating-webhook service.

Answer

kubectl apply -f constraint.yaml with a ConstraintTemplate.

Answer

kubectl create validatingwebhook gatekeeper --from-file=webhook.yaml

Answer

kubectl run gatekeeper-webhook --image=openpolicyagent/gatekeeper:v3.14.0

Question 3

What is the primary purpose of using a service mesh like Istio for microservices security?

Accepted Answer

To provide mTLS communication between services for encrypted and authenticated traffic.

Answer

To replace Kubernetes NetworkPolicies for network segmentation.

Answer

To provide a centralized logging solution.

Answer

To automatically scale pods based on CPU usage.

Question 4

Which TWO of the following are valid Rego keywords used in OPA policies for Gatekeeper? (Select TWO)

Accepted Answer

input

Answer

violation

Answer

allow

Answer

data

Question 5

Which THREE of the following are valid ways to manage secrets in a Kubernetes environment? (Select THREE)

Accepted Answer

Use an external secret manager like HashiCorp Vault and inject secrets via sidecar or CSI driver.

Answer

Store secrets in environment variables directly in the Deployment YAML.

Answer

Store secrets in ConfigMaps and reference them in pods.

Question 6

Which TWO of the following are correct about container sandboxing technologies? (Select TWO)

Accepted Answer

Kata Containers run containers in lightweight VMs, providing hardware-level isolation.

Answer

Kata Containers use the host kernel for system calls.

Answer

gVisor runs containers in separate VMs for each pod.

Answer

Both gVisor and Kata Containers require RuntimeClass to be used in Kubernetes.

Question 7

You need to ensure that all containers in a pod run as non-root. Which security context field should you set to enforce this?

Accepted Answer

runAsNonRoot: true. Setting runAsNonRoot: true in the security context enforces that the container runs as a non-root user; if the container attempts to run as root, it will be denied.

Answer

privileged: false

Answer

readOnlyRootFilesystem: true

Answer

allowPrivilegeEscalation: false

Question 8

A security policy requires that all pods drop ALL Linux capabilities and disable privilege escalation. Which YAML snippet correctly implements this in the pod's security context?

Accepted Answer

securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop: ["ALL"]. The securityContext must include capabilities.drop with ALL and allowPrivilegeEscalation set to false. Option B has both.

Answer

securityContext:
  privileged: false
  capabilities:
    drop: ["ALL"]

Answer

securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    add: ["NET_ADMIN"]

Answer

securityContext:
  capabilities:
    drop: ["ALL"]

Question 9

You are using Open Policy Agent (OPA) Gatekeeper to enforce pod security. You want to create a constraint that denies pods unless they have readOnlyRootFilesystem set to true. Which Rego rule in a ConstraintTemplate correctly implements this?

Accepted Answer

violation[{"msg": msg}] {
  container := input.review.object.spec.containers[_]
  not container.securityContext.readOnlyRootFilesystem
  msg := "readOnlyRootFilesystem must be true"
}. The Rego rule should deny when the violation condition holds: the pod spec contains a container without readOnlyRootFilesystem set to true. Option C uses 'not input.review.object.spec.containers[_].securityContext.readOnlyRootFilesystem' to detect missing true.

Answer

violation[{"msg": msg}] {
  container := input.review.object.spec.containers[_]
  container.securityContext.readOnlyRootFilesystem == true
  msg := "readOnlyRootFilesystem must be true"
}

Answer

violation[{"msg": msg}] {
  container := input.review.object.spec.containers[_]
  not container.securityContext.readOnlyRootFilesystem == false
  msg := "readOnlyRootFilesystem must be true"
}

Answer

violation[{"msg": msg}] {
  container := input.review.object.spec.containers[_]
  container.securityContext.readOnlyRootFilesystem == false
  msg := "readOnlyRootFilesystem must be true"
}

Question 10

A security best practice is to avoid storing secrets in environment variables. Which is a secure alternative for injecting secrets into a pod?

Accepted Answer

Mount the Secret as a volume. Mounting secrets as volumes is more secure than environment variables because it reduces exposure in process listings and other system introspection.

Answer

Use the Kubernetes Secret Store CSI driver to mount from external store

Answer

Store secrets in ConfigMap and reference them in the pod

Answer

Embed the secret directly in the pod definition YAML

Question 11

You want to enable mutual TLS (mTLS) between services in a namespace using Istio. Which custom resource should you configure to enforce STRICT mTLS for all workloads in the namespace?

Accepted Answer

PeerAuthentication with mtls.mode: STRICT. PeerAuthentication with mTLS mode STRICT enforces that all incoming traffic to the namespace uses mutual TLS. DestinationRule is for traffic policies including TLS settings for the destination, but PeerAuthentication is the correct resource to enforce mTLS mode.

Answer

DestinationRule with trafficPolicy.tls.mode: ISTIO_MUTUAL

Answer

VirtualService with tls.mode: SIMPLE

Answer

ServiceEntry with resolution: NONE

Question 12

You are configuring encryption at rest for Kubernetes secrets. After creating an EncryptionConfiguration with aescbc provider, which additional step is required to enable encryption?

Accepted Answer

Restart the kube-apiserver with --encryption-provider-config flag. The kube-apiserver must be restarted to reload the encryption configuration, and the --encryption-provider-config flag must point to the configuration file.

Answer

Apply the EncryptionConfiguration as a ConfigMap

Answer

Restart the kube-scheduler

Answer

Recreate all secrets in the cluster

Question 13

Which admission controller is responsible for validating and mutating requests based on webhooks?

Accepted Answer

ValidatingAdmissionWebhook and MutatingAdmissionWebhook. ValidatingAdmissionWebhook and MutatingAdmissionWebhook are the admission controllers that call external webhooks. The question asks which controller handles both; the webhook infrastructure is managed by these controllers.

Answer

ServiceAccount

Answer

PodSecurityPolicy

Answer

NodeRestriction

Question 14

You need to use gVisor as a container runtime for a set of workloads in the cluster. Which Kubernetes resource must be created to reference the runtime class?

Accepted Answer

Create a RuntimeClass resource with handler: runsc. A RuntimeClass resource defines a runtime handler (e.g., runsc) and is referenced in a pod's spec.runtimeClassName to select that runtime.

Answer

Set the kubelet runtime flag --runtime-class=gvisor

Answer

Install a CRD for gVisor

Answer

Create a Pod with spec.runtimeClassName set to "gvisor"

Question 15

You are deploying a ValidatingWebhookConfiguration. The webhook server is running in the 'webhook' namespace, service name 'svc', port 443. Which clientConfig should you specify?

Accepted Answer

clientConfig:
  service:
    namespace: webhook
    name: svc
    path: /validate. The clientConfig for a service-based webhook must reference the namespace, service name, and path. Option A uses the service reference correctly.

Answer

clientConfig:
  url: https://webhook.svc.cluster.local:443/validate

Answer

clientConfig:
  service:
    namespace: webhook
    name: webhook
    path: /validate

Answer

clientConfig:
  service:
    namespace: default
    name: svc
    path: /validate