CKS Quick Quiz — 10 Questions

Question 1

Match each etcd security configuration to its description.

Question 2

Match each Kubernetes security component to its description.

Question 3

Match each Kubernetes security tool or feature to its purpose.

Question 4

Match each Kubernetes certificate type to its usage.

Question 5

Arrange the steps to enable and configure audit logging in Kubernetes.

Question 6

Arrange the steps to configure and use kube-bench to audit a Kubernetes cluster's security.

Question 7

Order the steps to rotate a Kubernetes API server certificate.

Question 8

Order the steps to recover a Kubernetes cluster after a control plane failure where the API server certificate has expired.

Question 9

A cluster uses RBAC and a ServiceAccount 'monitor' in namespace 'observability'. The account needs to list pods in all namespaces. Which ClusterRole and binding should be created?

Accepted Answer

ClusterRole with 'list' on pods, ClusterRoleBinding. A ServiceAccount that needs to list pods across all namespaces requires a ClusterRole with the 'list' verb on pods, because ClusterRoles are not namespaced and can grant permissions cluster-wide. A ClusterRoleBinding is necessary to bind that ClusterRole to the ServiceAccount, as RoleBindings only apply within a single namespace and cannot grant cluster-scoped permissions.

Answer

Role with 'list' on pods, RoleBinding in observability

Answer

ClusterRole with 'get' on pods, ClusterRoleBinding

Answer

ClusterRole with 'list' on pods, RoleBinding in observability

Question 10

Which TWO of the following are best practices for securing container images?

Accepted Answer

Use minimal base images like distroless. Option B is correct because minimal base images like distroless reduce the attack surface by eliminating unnecessary packages, libraries, and shell access. This aligns with the principle of least functionality, making it harder for attackers to exploit vulnerabilities or execute arbitrary commands within the container. Distroless images typically contain only the application and its runtime dependencies, significantly lowering the risk of privilege escalation or lateral movement.

Answer

Always use the latest tag

Answer

Run containers as root

Answer

Run containers in privileged mode