CKS Multiple Select — 10 Questions

Question 1

Which TWO of the following are valid arguments for the kubectl command to create a secret from a file? (Select TWO)

Accepted Answer

--from-file. Options D and E are correct because both --from-file and --from-env-file are valid arguments for the kubectl create secret command when creating a secret from a file. --from-file reads the entire file content and uses the filename as the key. --from-env-file reads a file containing key=value lines, which is suitable for environment variable-style secrets. Option B (--from-literal) is incorrect because it specifies key-value pairs directly on the command line, not from a file. Option A (--dry-run) is a flag, not an argument for specifying secret data. Option C (--from-yaml) is not a valid argument for kubectl create secret.

Answer

--dry-run

Answer

--from-literal

Answer

--from-yaml

Question 2

Which TWO AppArmor modes are available? (Select 2)

Accepted Answer

enforce. AppArmor has two operational modes: 'enforce' and 'complain'. In 'enforce' mode, AppArmor actively enforces the security policy, blocking actions that violate the profile and logging the denial. In 'complain' mode, AppArmor logs policy violations but does not block them, allowing administrators to test profiles before enforcing them.

Answer

audit

Answer

allow

Answer

unconfined

Question 3

An auditor requires that all audit logs from the Kubernetes API server be stored for 90 days and be tamper-proof. Which TWO measures should be implemented?

Accepted Answer

Configure the audit log backend to write to an immutable object store like S3 with Object Lock. Storing audit logs in an immutable object store like S3 with Object Lock ensures tamper-proof retention by preventing any object from being overwritten or deleted for a specified retention period. This directly satisfies the auditor's requirement for logs that cannot be altered or destroyed, regardless of the Kubernetes cluster state.

Answer

Enable the AuditDynamicConfiguration feature gate

Answer

Deploy Fluentd to forward logs to a central Elasticsearch cluster

Answer

Set --audit-log-maxbackup=10 and --audit-log-maxsize=100

Question 4

Which TWO of the following are valid audit stages in Kubernetes audit logging?

Accepted Answer

ResponseStarted. The Kubernetes audit stages include RequestReceived, ResponseStarted, ResponseComplete, and Panic. In the given options, ResponseStarted (A) and RequestReceived (E) are valid stages and are the two correct answers according to the question. Option C (ResponseComplete) is also a valid stage, but since the question explicitly asks for two, it is not selected as a correct answer here. Options B (ResponseDelay) and D (RequestProcessing) are not valid audit stages.

Answer

ResponseDelay

Answer

ResponseComplete

Answer

RequestProcessing

Question 5

Which TWO of the following are valid audit stages in Kubernetes audit logging?

Accepted Answer

ResponseComplete. Valid Kubernetes audit stages include RequestReceived, ResponseStarted, ResponseComplete, and Panic. All three options B (ResponseComplete), D (RequestReceived), and E (ResponseStarted) are valid audit stages. The question asks for two, but there are three valid options; thus, the correct set includes B, D, and E.

Answer

Authentication

Answer

Authorization

Question 6

Which TWO of the following are valid audit stages in Kubernetes?

Accepted Answer

Panic. Kubernetes audit stages include RequestReceived, ResponseStarted, ResponseComplete, and Panic. Among the given options, RequestReceived (D), ResponseStarted (C), and Panic (B) are all valid stages. Options A (ResponseReceived) and E (RequestSent) are not standard stages.

Answer

ResponseReceived

Answer

RequestSent

Question 7

Which TWO of the following are valid audit stages in Kubernetes audit logging?

Accepted Answer

ResponseStarted. Kubernetes audit logging defines four stages: RequestReceived, ResponseStarted, ResponseComplete, and Panic. Among the options, valid stages are A (ResponseStarted), B (Panic), and E (RequestReceived). Since the question asks for exactly two, the selected correct answers are A and E. Both are valid. Option B (Panic) is also a valid stage but is not included as a correct answer for this specific question.

Answer

Panic

Answer

ResponseFinished

Answer

RequestProcessing

Question 8

Which TWO of the following tools can generate an SBOM (Software Bill of Materials) for a container image?

Accepted Answer

syft. Syft (A) is a CLI tool specifically designed to generate a Software Bill of Materials (SBOM) from container images and filesystems. Cosign attest (B) can also generate an SBOM for a container image using the `--type sbom` flag and attach it as an in-toto attestation. Both tools are capable of producing SBOMs.

Answer

Clair

Answer

kubesec

Answer

Snyk

Question 9

Which TWO of the following are correct about container sandboxing technologies? (Select TWO)

Accepted Answer

Kata Containers run containers in lightweight VMs, providing hardware-level isolation.. Kata Containers provide hardware-level isolation by running each container or pod in a lightweight VM with its own guest kernel using KVM. Option B is correct because gVisor implements a user-space kernel (called Sentry) that intercepts system calls, providing a kernel-level sandbox without dedicated VMs. Option C is incorrect because Kata Containers use a guest kernel, not the host kernel. Option D is incorrect because gVisor does not run containers in separate VMs; it runs as a kernel within the user space. Option E is incorrect because although RuntimeClass is commonly used to select non-default runtimes in Kubernetes, the statement is not universally required; it is a mechanism but not a strict requirement for using these technologies, making the claim that both 'require' RuntimeClass too absolute and thus false.

Answer

Kata Containers use the host kernel for system calls.

Answer

gVisor runs containers in separate VMs for each pod.

Answer

Both gVisor and Kata Containers require RuntimeClass to be used in Kubernetes.

Question 10

Which ONE of the following is a valid Rego policy construct used in OPA Gatekeeper ConstraintTemplates to enforce security policies?

Accepted Answer

violation[{"msg": msg}] { condition }. In OPA Gatekeeper ConstraintTemplates, the only Rego construct that directly triggers a constraint violation is `violation[{"msg": msg}] { condition }`. When the condition evaluates to true, Gatekeeper generates a violation message. The `allow` and `deny` rules are not standard constructs for enforcing constraints in Gatekeeper; they are general Rego rules used in other OPA contexts but not within ConstraintTemplates to report violations. Options D (`audit`) and E (`warn`) are also not valid Rego constructs for Gatekeeper constraints.

Answer

allow { condition }

Answer

deny[{"msg": msg}] { condition }

Answer

audit { condition }

Answer

warn[{"msg": msg}] { condition }