CKS Timed Practice Test 3 — 10 Questions

Question 1

A security team wants to detect anomalous process executions in containers without modifying the container images or requiring agents inside containers. Which approach is most suitable?

Accepted Answer

Deploy Falco as a DaemonSet using eBPF probe to monitor system calls.. Falco, deployed as a DaemonSet with an eBPF probe, can monitor system calls at the kernel level without modifying container images or requiring agents inside containers. This allows it to detect anomalous process executions in real time by analyzing syscall events from the host, which is the most suitable approach for runtime security monitoring in Kubernetes.

Answer

Configure CRI-O to log all container process starts to syslog.

Answer

Enable Kubernetes audit logging and parse the logs for process events.

Answer

Use OPA Gatekeeper to enforce allowed process lists in pod specs.

Question 2

A security auditor requires that all container images used in the cluster are scanned for vulnerabilities before deployment. The team uses a private registry with image signing. Which solution enforces that only signed and scanned images are deployed?

Accepted Answer

Use Cosign to sign images and deploy a webhook that verifies signatures.. Cosign is a tool for signing container images, and deploying a validating webhook (e.g., the cosigned admission controller) enforces that only images with valid signatures are admitted. This directly meets the requirement to deploy only signed and scanned images, as the webhook verifies the signature before the pod is created.

Answer

Run Trivy in a CronJob to scan images and update a ConfigMap with allowed images.

Answer

Use OPA Gatekeeper to verify that the image comes from the private registry.

Answer

Enable Binary Authorization on the cluster to enforce image attestation.

Question 3

A cluster administrator wants to monitor network traffic between pods for security analysis. Which tool is designed specifically for this purpose and integrates with Kubernetes?

Accepted Answer

Deploy Cilium with Hubble for network flow visibility.. D is correct because Cilium, combined with Hubble, is specifically designed to provide deep network flow visibility and monitoring for Kubernetes pods. Hubble leverages eBPF to capture and report network traffic at the kernel level, offering granular observability into pod-to-pod communications, which directly meets the requirement for security analysis of network traffic between pods.

Answer

Configure Fluentd to collect network logs from each node.

Answer

Use Prometheus to scrape network metrics from kube-proxy.

Answer

Run kube-bench to audit network policies.

Question 4

Which TWO actions are effective for detecting and preventing container breakout attempts using runtime security tools?

Accepted Answer

Deploy Falco with rules that alert on 'syscall' events like 'clone' or 'unshare'.. Option D is correct because Falco is a CNCF runtime security tool that uses eBPF or kernel modules to intercept system calls. By alerting on sensitive syscalls like 'clone' (used to spawn new processes) or 'unshare' (used to create new namespaces), Falco can detect container breakout attempts where an attacker tries to escape the container's isolation. This provides real-time detection of anomalous behavior indicative of a breakout.

Answer

Set 'securityContext.seccompProfile.type: Unconfined' to allow all syscalls.

Answer

Enable Kubernetes audit logging to capture exec commands.

Answer

Use PodSecurityPolicy to deny privileged containers.

Question 5

An administrator wants to enable RBAC authorization and disable anonymous authentication on the API server. Which set of flags should be added to the kube-apiserver configuration?

Accepted Answer

--authorization-mode=RBAC --anonymous-auth=false. Option C is correct because to enable RBAC authorization on the API server, you must set `--authorization-mode=RBAC`. Disabling anonymous authentication is achieved with `--anonymous-auth=false`, which prevents unauthenticated requests from being processed. Together, these flags enforce role-based access control and block anonymous access, meeting the administrator's requirements.

Answer

--enable-admission-plugins=NodeRestriction --anonymous-auth=false

Answer

--authorization-mode=AlwaysAllow --anonymous-auth=false

Answer

--authorization-mode=Node --anonymous-auth=true

Question 6

An administrator runs 'kubectl get pods' and sees that a pod is in 'Pending' state. What is the most likely reason for this state?

Accepted Answer

The pod is waiting to be scheduled to a node. A pod enters the 'Pending' state when it has been accepted by the API server but is not yet running. The most common reason is that the scheduler has not yet assigned the pod to a node, often due to insufficient resources (CPU/memory), node selector mismatches, taints/tolerations, or a failed scheduler itself. This is the initial phase before the pod transitions to 'Running' or 'ContainerCreating'.

Answer

The pod has been deleted

Answer

The container inside the pod is crashing

Answer

The pod has completed its execution

Question 7

You need to encrypt etcd data at rest using AES-CBC. Which encryption provider should you specify in the EncryptionConfiguration?

Accepted Answer

aescbc. Option B (aescbc) is correct because Kubernetes supports AES-CBC encryption via the 'aescbc' provider in the EncryptionConfiguration. This provider uses AES in Cipher Block Chaining mode with a 32-byte key for encryption at rest, as specified in the Kubernetes documentation for encrypting etcd data.

Answer

aesgcm

Answer

aes-256-cbc

Answer

secretbox

Question 8

Which kubelet flag should be set to ensure the kubelet does not allow anonymous requests?

Accepted Answer

--anonymous-auth=false. Option C is correct because setting `--anonymous-auth=false` explicitly disables anonymous requests to the kubelet. By default, anonymous authentication is enabled, which allows unauthenticated users to access the kubelet API. Disabling this flag ensures that only authenticated requests are processed, aligning with the principle of least privilege and hardening the cluster.

Answer

--authentication-token-webhook=true

Answer

--read-only-port=0

Answer

--protect-kernel-defaults=true

Question 9

What is the purpose of the CIS Kubernetes Benchmark?

Accepted Answer

To provide a set of security best practices for Kubernetes. The CIS Kubernetes Benchmark is a set of security best practices developed by the Center for Internet Security (CIS) specifically for hardening Kubernetes clusters. It provides prescriptive guidance on configuring cluster components (e.g., kube-apiserver, kubelet, etcd) to reduce the attack surface and meet compliance standards. Option A correctly identifies this purpose, as the benchmark is not about performance, networking, or automation.

Answer

To benchmark performance of Kubernetes clusters

Answer

To test network policies

Answer

To automate deployment of Kubernetes clusters

Question 10

You run 'kubectl auth can-i --list --as=admin' and see that the admin user has full cluster-admin access. Which command would create a ClusterRoleBinding for a user named 'viewer' with read-only access to all resources?

Accepted Answer

kubectl create clusterrolebinding viewer-binding --clusterrole=view --user=viewer. Option D is correct because it uses `kubectl create clusterrolebinding` to bind the built-in `view` ClusterRole (which grants read-only access: get, list, watch) to the user `viewer` at the cluster scope. A ClusterRoleBinding is required to grant permissions across all namespaces, and the `--clusterrole` flag correctly references the ClusterRole, not a Role.

Answer

kubectl create rolebinding viewer-binding --clusterrole=view --user=viewer

Answer

kubectl create clusterrole viewer --verb=get,list,watch --resource=*

Answer

kubectl create clusterrolebinding viewer-binding --role=view --user=viewer