CKS Matching — 10 Questions

Question 1

Match each container security context setting to its effect.

Accepted Answer

runAsNonRoot: Prevents the container from running as root. Correct matches: runAsNonRoot forces non-root execution; runAsUser sets a specific UID. Common confusion is swapping these effects. Other settings like privileged and readOnlyRootFilesystem also enforce least privilege.

Answer

runAsNonRoot: Specifies the user ID (UID) to run the container

Answer

runAsUser: Prevents the container from running as root

Question 2

Match each Kubernetes security tool or feature to its purpose.

Accepted Answer

Pod Security Admission: Enforces pod security standards at admission time. Correct matches: Pod Security Admission enforces pod security standards; Network Policies control traffic; RBAC governs API access; kube-bench performs CIS checks. Common confusion arises from swapping definitions between PSA and Network Policies.

Answer

Pod Security Admission: Controls network traffic between pods

Answer

Network Policies: Enforces pod security standards

Question 3

Match each Kubernetes certificate type to its usage.

Accepted Answer

API server serving certificate: Encrypts communication between clients and the API server. Two common certificate types in Kubernetes are the API server serving certificate (used for HTTPS encryption) and the kubelet client certificate (used for kubelet authentication to the API server). A common confusion is swapping their purposes: the API server serving certificate does not authenticate the API server to the kubelet, and the kubelet client certificate does not encrypt inter-node communication.

Answer

API server serving certificate: Authenticates the API server to the kubelet

Answer

Kubelet client certificate: Encrypts communication between nodes

Question 4

Match each Kubernetes command to its function related to security.

Accepted Answer

kubectl auth can-i: Check if a user can perform a specific action. The correct matches are: 'kubectl auth can-i' checks permissions, 'kubectl certificate approve' handles CSRs, 'kubectl describe clusterrole' shows role details, and 'kubectl create serviceaccount' creates service accounts. Common confusions include mixing the functions of permission checking and resource creation.

Answer

kubectl auth can-i: Create a new service account

Answer

kubectl certificate approve: Display details of a ClusterRole

Question 5

Match each Kubernetes admission controller to its role in security.

Accepted Answer

NodeRestriction: Limits the permissions of kubelet nodes to prevent unauthorized operations.. Admission controllers intercept requests to the API server and can enforce security policies.

Answer

NodeRestriction: Controls automounting of service account tokens to pods.

Answer

PodSecurity: Limits the permissions of kubelet nodes.

Question 6

Match each etcd security configuration to its description.

Accepted Answer

Client certificate authentication: Requires clients to present a valid certificate signed by a trusted CA.. In this matching exercise, each etcd security configuration should be paired with its correct description. Common confusions arise between client-to-server TLS and peer-to-peer TLS due to similar wording. Client-to-server TLS secures communication between clients and the cluster, while peer-to-peer TLS secures inter-member communication. Client certificate authentication and RBAC are distinct security features.

Answer

Client-to-server TLS: Encrypts communication between etcd members.

Answer

Peer-to-peer TLS: Encrypts communication between etcd clients and the cluster.

Question 7

Match each Kubernetes security component to its description.

Accepted Answer

RBAC: Role-based access control for managing permissions.. RBAC controls permissions, Pod Security Admission enforces pod security, Network Policies manage traffic, and ServiceAccounts provide identity. Distractors confuse these functions.

Answer

RBAC: Encrypts data at rest.

Answer

ServiceAccount: Manages network rules.

Question 8

Match each Kubernetes network security concept to its definition.

Accepted Answer

NetworkPolicy: A Kubernetes resource that defines rules for ingress and egress traffic to and from pods.. Correct matches: NetworkPolicy defines ingress/egress rules; Calico network policy extends with advanced features; Ingress rule controls inbound traffic; Egress rule controls outbound traffic; Default deny blocks all unless allowed. Common confusions include swapping ingress and egress definitions and mistaking non-native policies as native.

Answer

Egress rule: In a NetworkPolicy, specifies which incoming traffic is allowed to reach pods.

Answer

Calico network policy: A Kubernetes native resource for network segmentation.

Question 9

Match each Kubernetes object or feature to its primary security purpose.

Accepted Answer

NetworkPolicy: Controls network traffic to and from pods. Correct matches: NetworkPolicy controls network traffic; RBAC controls permissions; SecurityContext defines security settings. Common confusions: ServiceAccount is for identity, not encryption; PodSecurityPolicy is for security constraints, not resource limits.

Answer

ServiceAccount: Encrypts secrets at rest

Answer

PodSecurityPolicy: Defines CPU and memory limits for pods

Question 10

Match each Kubernetes API server flag to its security function.

Accepted Answer

--authorization-mode=RBAC: Enables RBAC authorization. Correct matches: --authorization-mode=RBAC enables RBAC; --anonymous-auth=false disables anonymous auth; --profiling=false disables profiling. Common confusions involve mixing authorization and authentication flags.

Answer

--authorization-mode=RBAC: Enables anonymous authentication

Answer

--anonymous-auth=false: Enables RBAC

Answer

--profiling=false: Enables audit logging