CKS Timed Practice Test 2 — 10 Questions

Question 1

An admin runs 'kubectl auth reconcile -f rbac.yaml' and gets an error that the user does not have permission to create ClusterRoleBindings. What is the most likely cause?

Accepted Answer

The user's kubeconfig context does not have RBAC permissions to create ClusterRoleBindings.. The error indicates that the user's current kubeconfig context lacks RBAC permissions to create ClusterRoleBindings. The `kubectl auth reconcile` command attempts to apply the RBAC resources defined in the YAML file, and if the user's credentials (typically from a certificate or token) do not include the `create` verb on `clusterrolebindings` in the RBAC authorization layer, the API server will reject the request with a 403 Forbidden error. This is a direct permission issue, not a connectivity or syntax problem.

Answer

The ClusterRoleBinding already exists.

Answer

The YAML file has a syntax error.

Answer

The Kubernetes API server is not reachable.

Question 2

Which of the following is correct about dropping the 'NET_RAW' capability?

Accepted Answer

It prevents the container from creating raw sockets, which can be used for packet crafting attacks. The `NET_RAW` capability controls access to raw and packet sockets (AF_PACKET, SOCK_RAW). Dropping it prevents the container from creating raw sockets, which are often used for crafting custom packets, performing ARP spoofing, or launching other network-layer attacks. This is a key hardening measure to reduce the container's ability to manipulate network traffic at the low level.

Answer

It prevents the container from binding to a privileged port (<1024)

Answer

It prevents the container from using the 'ping' command

Answer

It prevents the container from making any network connections

Question 3

You need to use gVisor as a container runtime for a set of workloads in the cluster. Which Kubernetes resource must be created to reference the runtime class?

Accepted Answer

Create a RuntimeClass resource with handler: runsc. In Kubernetes, a RuntimeClass resource is used to select a container runtime configuration, such as gVisor. The RuntimeClass must specify the handler field set to 'runsc', which is the gVisor runtime binary. This resource is then referenced by pods via the `runtimeClassName` field to enforce sandboxed isolation.

Answer

Set the kubelet runtime flag --runtime-class=gvisor

Answer

Install a CRD for gVisor

Answer

Create a Pod with spec.runtimeClassName set to "gvisor"

Question 4

A DevOps engineer wants to ensure that all pods in a namespace have seccomp set to RuntimeDefault unless explicitly overridden. Which approach should be used to enforce this?

Accepted Answer

Configure the namespace with the label 'pod-security.kubernetes.io/enforce: restricted'. The 'restricted' Pod Security Standard enforces seccomp to RuntimeDefault as a baseline requirement. By labeling the namespace with 'pod-security.kubernetes.io/enforce: restricted', the built-in Pod Security Admission controller automatically rejects any pod that does not set seccomp to RuntimeDefault (or a custom profile), without needing a separate policy or manual auditing.

Answer

Add a PodSecurityPolicy that sets seccomp to RuntimeDefault

Answer

Use a cronjob to audit and modify pods that do not have seccomp set

Answer

Add a seccomp profile to the kubelet configuration

Question 5

An administrator wants to ensure that a service account used by a deployment cannot automatically mount its token. Which field should be set to `false` in the Pod spec?

Accepted Answer

automountServiceAccountToken. The `automountServiceAccountToken` field in the Pod spec controls whether the service account token is automatically mounted into the container. Setting this field to `false` prevents the automatic mounting of the token, which is a security best practice to reduce the attack surface for compromised pods. This field can be set at the Pod level or overridden at the ServiceAccount level.

Answer

mountServiceAccountToken

Answer

disableTokenMount

Answer

automountToken

Question 6

An administrator wants to enforce that all pods in a namespace use the restricted Pod Security Standard. Which of the following commands correctly enables this enforcement?

Accepted Answer

kubectl label namespace myns pod-security.kubernetes.io/enforce=restricted. The Pod Security Standards are enforced via labels on the namespace, and the `pod-security.kubernetes.io/enforce` label with value `restricted` tells the Pod Security Admission controller to reject any pod that violates the restricted policy. This is the only way to actively block non-compliant pods from being created in the namespace.

Answer

kubectl label namespace myns pod-security.kubernetes.io/audit=restricted

Answer

kubectl annotate namespace myns pod-security.kubernetes.io/enforce=restricted

Answer

kubectl label namespace myns pod-security.kubernetes.io/warn=restricted

Question 7

What is the purpose of the 'automountServiceAccountToken: false' setting in a Pod spec?

Accepted Answer

It prevents the automatic mounting of the service account token into the pod. Setting `automountServiceAccountToken: false` in a Pod spec prevents the automatic mounting of the Kubernetes service account token (a JWT) into the Pod's filesystem at `/var/run/secrets/kubernetes.io/serviceaccount/token`. This is a security hardening measure to reduce the attack surface for compromised containers, as the token can be used to authenticate to the Kubernetes API server. By default, Kubernetes mounts this token into every Pod, so explicitly disabling it is necessary when the Pod does not require API access.

Answer

It disables the service account controller

Answer

It deletes the service account after the pod starts

Answer

It prevents the pod from using any service account

Question 8

You suspect a pod is making unexpected outbound connections. Which tool can you use to inspect network connections from within the container?

Accepted Answer

crictl exec. `crictl exec` allows you to run commands inside a container managed by CRI-compatible runtimes (like containerd), enabling you to inspect network connections from within the container using tools like `ss`, `netstat`, or `ip`. This is the direct method to check outbound connections from the container's network namespace, which is isolated from the host.

Answer

kubectl port-forward

Answer

falco

Answer

kubectl logs

Question 9

A pod is stuck in Pending state. 'kubectl describe pod' shows the event: '0/4 nodes are available: 1 node had taint {node-role.kubernetes.io/control-plane: }, that the pod didn't tolerate, 3 Insufficient memory.' The pod YAML does not specify any tolerations. Which command would allow the pod to schedule on the control-plane node?

Accepted Answer

Edit the pod YAML to add tolerations for node-role.kubernetes.io/control-plane. The pod is failing to schedule on the control-plane node due to the `node-role.kubernetes.io/control-plane` taint, which by default prevents pods without a matching toleration from being scheduled. Since the pod YAML does not specify any tolerations, editing it to add a toleration for that taint (e.g., `tolerations: - key: node-role.kubernetes.io/control-plane operator: Exists`) explicitly allows the pod to run on the control-plane node, resolving the Pending state.

Answer

kubectl taint nodes control-plane node-role.kubernetes.io/control-plane-

Answer

kubectl cordon control-plane

Answer

kubectl delete pod --all

Question 10

During a security audit, it was found that some pods have access to the host network. How can an administrator restrict host network access for all pods in the cluster?

Accepted Answer

Enable PodSecurity admission controller with baseline or restricted profile. The PodSecurity admission controller (GA in Kubernetes v1.25+) enforces predefined security standards (baseline or restricted) that, among other restrictions, prevent pods from using `hostNetwork: true`. This is the recommended replacement for the deprecated PodSecurityPolicy and provides a built-in, cluster-wide mechanism to restrict host network access without requiring external tools.

Answer

Set --allow-privileged=false in kubelet configuration

Answer

Enable PodSecurityPolicy with 'hostNetwork: false'

Answer

Create NetworkPolicies that deny traffic to host network