CKS Exam Simulation — 100 Questions

Question 1

Match each etcd security configuration to its description.

Question 2

Match each Kubernetes security component to its description.

Question 3

Match each Kubernetes security tool or feature to its purpose.

Question 4

Match each Kubernetes certificate type to its usage.

Question 5

Arrange the steps to enable and configure audit logging in Kubernetes.

Question 6

Arrange the steps to configure and use kube-bench to audit a Kubernetes cluster's security.

Question 7

Order the steps to rotate a Kubernetes API server certificate.

Question 8

Order the steps to recover a Kubernetes cluster after a control plane failure where the API server certificate has expired.

Question 9

A cluster uses RBAC and a ServiceAccount 'monitor' in namespace 'observability'. The account needs to list pods in all namespaces. Which ClusterRole and binding should be created?

Accepted Answer

ClusterRole with 'list' on pods, ClusterRoleBinding. A ServiceAccount that needs to list pods across all namespaces requires a ClusterRole with the 'list' verb on pods, because ClusterRoles are not namespaced and can grant permissions cluster-wide. A ClusterRoleBinding is necessary to bind that ClusterRole to the ServiceAccount, as RoleBindings only apply within a single namespace and cannot grant cluster-scoped permissions.

Answer

Role with 'list' on pods, RoleBinding in observability

Answer

ClusterRole with 'get' on pods, ClusterRoleBinding

Answer

ClusterRole with 'list' on pods, RoleBinding in observability

Question 10

Which TWO of the following are best practices for securing container images?

Accepted Answer

Use minimal base images like distroless. Option B is correct because minimal base images like distroless reduce the attack surface by eliminating unnecessary packages, libraries, and shell access. This aligns with the principle of least functionality, making it harder for attackers to exploit vulnerabilities or execute arbitrary commands within the container. Distroless images typically contain only the application and its runtime dependencies, significantly lowering the risk of privilege escalation or lateral movement.

Answer

Always use the latest tag

Answer

Run containers as root

Answer

Run containers in privileged mode

Question 11

A company uses kube-bench to scan their cluster. The report shows a warning: 'Ensure that the --authorization-mode argument is set to Node,RBAC'. What is the best way to fix this?

Accepted Answer

Edit the kube-apiserver manifest to add --authorization-mode=Node,RBAC. Option D is correct because kube-bench checks that the API server's `--authorization-mode` includes both `Node` and `RBAC` in that order. The `Node` authorizer must come first to handle node-specific requests efficiently, followed by `RBAC` for user and service account authorization. Editing the kube-apiserver manifest (typically `/etc/kubernetes/manifests/kube-apiserver.yaml`) to add `--authorization-mode=Node,RBAC` ensures the static pod is automatically restarted by the kubelet with the correct configuration.

Answer

Add --authorization-mode=AlwaysDeny to the API server

Answer

Restart the API server with --authorization-webhook-config-file

Answer

Set --authorization-mode=RBAC only

Question 12

A security engineer runs kube-hunter against a production cluster and receives the above output. The cluster uses kubeadm with default settings. Which two actions should the engineer take to remediate the vulnerabilities?

Accepted Answer

Upgrade the cluster to Kubernetes 1.14 or later to fix CVE-2019-11245. Option A is correct because CVE-2019-11245 affects kubelet container runtime exec probes in Kubernetes versions prior to 1.14, where containers could restart unexpectedly due to a race condition. Upgrading to 1.14 or later patches this vulnerability. Option C is correct because setting --anonymous-auth=false on the kubelet disables unauthenticated access to the kubelet API, which is a common finding from kube-hunter when default kubeadm settings leave anonymous authentication enabled.

Answer

Set the kubelet flag --authentication-token-webhook=true

Answer

Enable the NodeRestriction admission controller

Answer

Modify the kube-apiserver manifest to set --anonymous-auth=false

Question 13

Match each Kubernetes admission controller to its role in security.

Question 14

Match each Kubernetes command to its function related to security.

Question 15

A cluster is using kubeadm and the control plane components are running as static pods. Where are the static pod manifests for the API server located by default?

Accepted Answer

/etc/kubernetes/manifests/. In a kubeadm-deployed cluster, the control plane components (API server, controller manager, scheduler) run as static pods. The kubelet watches a specific directory for pod manifests to create these static pods. By default, kubeadm places the manifests for the API server (and other control plane components) in /etc/kubernetes/manifests/. This directory is specified via the --pod-manifest-path or staticPodPath in the kubelet configuration.

Answer

/var/lib/kubelet/

Answer

/etc/kubernetes/admin.conf

Answer

/etc/kubernetes/

Question 16

A security team wants to ensure that all communication between the kubelet and the API server is encrypted. Which flag must be set on the kubelet to enforce this?

Accepted Answer

--kubeconfig. Option C is correct because the `--kubeconfig` flag on the kubelet specifies the path to a kubeconfig file that contains the credentials and server address for the API server. When this flag is set, the kubelet uses TLS to authenticate and encrypt all communication with the API server, as the kubeconfig file typically references an HTTPS endpoint and includes client certificates or tokens. Without this flag, the kubelet may fall back to insecure or unencrypted connections, violating the requirement for encrypted communication.

Answer

--tls-cert-file

Answer

--node-status-update-frequency

Answer

--require-kubeconfig

Question 17

A developer created a ClusterRole 'pod-reader' with rules to get, list, and watch pods. They bound it to a user via ClusterRoleBinding. The user reports they cannot list pods in namespace 'test'. What is the most likely cause?

Accepted Answer

The ClusterRoleBinding might have a namespace set. Option C is correct because a ClusterRoleBinding is cluster-scoped and does not have a namespace field, but if a RoleBinding is used instead, it can restrict permissions to a specific namespace. The most likely cause is that the user inadvertently created a RoleBinding in the 'test' namespace (or the ClusterRoleBinding was misconfigured with a namespace selector), which would limit the binding's effect to that namespace. Since the user cannot list pods in 'test', the binding likely has a namespace constraint, preventing the cluster-wide permissions from applying.

Answer

The ClusterRole must be bound with a RoleBinding

Answer

The user needs a ServiceAccount

Answer

The pod-reader ClusterRole is missing 'list' verb

Question 18

An administrator wants to prevent pods from running as root. Which SecurityContext field should be set at the pod level?

Accepted Answer

runAsNonRoot: true. Option D is correct because setting `runAsNonRoot: true` at the pod-level SecurityContext enforces that all containers in the pod must run with a non-root user (UID > 0). If a container image specifies a user with UID 0 (root) or does not specify a user, the container will fail to start, preventing privilege escalation from root access.

Answer

fsGroup: 2000

Answer

runAsGroup: 3000

Answer

runAsUser: 1000

Question 19

Which Kubernetes resource should be used to restrict egress traffic from pods?

Accepted Answer

NetworkPolicy with egress rules. NetworkPolicy with egress rules is the correct Kubernetes-native resource to restrict outbound traffic from pods. It uses label selectors, IP blocks, and port specifications to define which external destinations pods can reach, enforcing zero-trust network segmentation at the pod level.

Answer

PodSecurityPolicy

Answer

iptables rules on nodes

Answer

NetworkPolicy with ingress rules

Question 20

Which THREE practices help ensure the integrity and confidentiality of container logs in a Kubernetes cluster?

Accepted Answer

Configure the log collector to use TLS when shipping logs to a central system.. Option A is correct because configuring the log collector to use TLS (e.g., Fluentd with TLS output plugin or Filebeat with SSL/TLS) encrypts log data in transit, preventing eavesdropping or tampering during shipping to a central system like Elasticsearch or Splunk. This directly protects confidentiality and integrity against man-in-the-middle attacks on the network path.

Answer

Set container 'stdout' logging only, avoiding file-based logs.

Answer

Disable log rotation to prevent log tampering during rotation.