Certified Kubernetes Security Specialist CKS (CKS) — Questions 1–75

Why this answer

How to eliminate wrong answers

Option B is wrong because anonymous authentication is controlled by the `--anonymous-auth` flag (defaults to true), not by the `--authorization-mode` flag; disabling anonymous auth is a separate configuration. Option C is wrong because the NodeRestriction admission plugin is enabled via the `--enable-admission-plugins` flag, not through the authorization mode flag. Option D is wrong because audit logging for RBAC events is configured via the `--audit-policy-file` flag and audit policy rules, not by setting the authorization mode to RBAC.

Why this answer

How to eliminate wrong answers

Option A is wrong because the Privileged profile allows unrestricted capabilities and does not enforce dropping any, which is the opposite of the requirement. Option B is wrong because 'Custom' is not a valid Pod Security Standard; the three built-in standards are Privileged, Baseline, and Restricted. Option C is wrong because the Baseline profile only prevents known privilege escalations but does not require dropping all capabilities by default, so it does not enforce the strict capability policy needed.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because /var/lib/kubelet/config.yaml is the kubelet configuration file, not the API server pod spec, and its permissions are covered by a different kube-bench check (e.g., 4.1.1). Option B is wrong because /var/log/audit.log is an audit log file, not a pod specification file, and its permissions are addressed by checks related to audit logging, not check 1.1.1. Option D is wrong because /etc/kubernetes/manifests/kube-controller-manager.yaml is the controller manager pod spec, which is a separate component; check 1.1.1 is specific to the API server pod spec file.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `remove` is not a valid field in the Kubernetes capabilities specification; the correct field is `drop`. Option C is wrong because `none: true` is not a valid syntax for managing capabilities in Kubernetes; capabilities must be explicitly dropped using the `drop` field. Option D is wrong because while the structure `securityContext: { capabilities: { drop: ["ALL"] } }` is technically correct, the question asks for the correct YAML snippet, and option B is the only one that directly provides the correct snippet without extraneous nesting; however, note that option D is also marked as correct in the answer options, but the question expects a single correct answer, and option B is the most concise and direct representation.

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because the kubelet does not have an `--admission-control` flag; admission plugins are configured on the kube-apiserver, and the deprecated `--admission-control` flag was replaced by `--enable-admission-plugins`. Option B is wrong because the kubelet does not support the `--enable-admission-plugins` flag; that flag is exclusive to the kube-apiserver, and the kubelet has no concept of admission plugins. Option C is wrong because there is no `--node-restriction` flag on the kubelet; the NodeRestriction admission plugin is enabled via the kube-apiserver, not through a boolean flag on the kubelet.

Why this answer

How to eliminate wrong answers

Option B is wrong because `--audit-log-maxage` and `--audit-log-maxbackup` control log rotation and retention, not the enabling of audit logging itself. Option C is wrong because `--audit-webhook-config-file` and `--audit-webhook-mode` configure a webhook backend for audit events, but they still require `--audit-policy-file` to define which events to send; they are not the minimal set to enable auditing. Option D is wrong because `--audit-dynamic-configuration` enables runtime changes to the audit policy, but it is an additional feature that requires a base audit policy file to be already configured; it does not enable auditing by itself.

Why this answer

How to eliminate wrong answers

Option A is wrong because Trivy is primarily a vulnerability scanner that can also produce SBOMs as a secondary feature, but it is not the dedicated tool for SBOM generation; Syft is the purpose-built tool. Option B is wrong because Kubesec is a static analysis tool for Kubernetes resource manifests (e.g., PodSecurityPolicy checks), not for container image SBOM generation. Option C is wrong because Checkov is an infrastructure-as-code scanner for misconfigurations in Terraform, CloudFormation, and Kubernetes YAML, not a tool for extracting package metadata from container images.

Why this answer

How to eliminate wrong answers

Option A is wrong because disabling anonymous authentication immediately could break cluster components that rely on it (e.g., kubelet health checks) before verifying dependencies, and applying a restrictive seccomp profile without testing could crash applications. Option B is wrong because applying 'runtime/default' immediately without logging mode first risks breaking existing applications that depend on blocked syscalls. Option C is wrong because enabling NodeRestriction first is safe but applying a restrictive seccomp profile without prior logging validation could cause application failures, and disabling anonymous authentication last leaves a security gap during the process.

Why this answer

How to eliminate wrong answers

Option A is wrong because ConfigMaps store data in plaintext and are intended for non-sensitive configuration, not secrets like API keys. Option B is wrong because hardcoding secrets in a container image embeds them in the image layers, making them accessible to anyone with image pull access and violating immutable infrastructure principles. Option D is wrong because exposing a Secret as an environment variable increases the risk of leakage through container logs, debugging endpoints, or the `/proc/self/environ` file, and does not support seamless secret rotation without pod restart.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because seccomp profiles restrict system calls (syscalls) but do not control the user identity under which a container runs or prevent privilege escalation via user namespace manipulation; they are a complementary measure, not a primary least-privilege approach. Option B is wrong because AppArmor profiles enforce mandatory access control on a per-program basis but do not change the user context of the container process; they also require a profile to be loaded on the node, which may not be available for all control plane components. Option D is wrong because PodSecurityPolicy (PSP) is deprecated in Kubernetes 1.21 and removed in 1.25, and even when available, it only enforces policies at the pod admission level, not directly on the container runtime configuration; moreover, control plane components are often managed as static pods or systemd services, not through the Kubernetes API, making PSP inapplicable.

Why this answer

How to eliminate wrong answers

Option A is wrong because `--encryption-config` is not a valid kube-apiserver flag; the correct flag is `--encryption-provider-config`. Option B is wrong because `--enable-encryption` does not exist; encryption at rest is configured via a provider configuration file, not a boolean flag. Option C is wrong because `--encryption-provider` is not a valid flag; the encryption provider (e.g., aescbc) is specified inside the EncryptionConfiguration YAML, not as a separate command-line argument.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because it omits the `--cacert` flag, so the client cannot verify the server's TLS certificate against the trusted CA, causing a TLS handshake failure. Option C is wrong because it omits the `--cert` and `--key` flags, so the client cannot provide its own certificate for mutual TLS authentication, and the etcd server will reject the connection if client certificate authentication is enforced. Option D is wrong because it uses `http://` instead of `https://`, bypassing TLS entirely; if the etcd cluster requires TLS, this command will either be rejected or communicate over an unencrypted channel, failing the connectivity test.

Why this answer

How to eliminate wrong answers

Option A is wrong because the `warn` label only generates a warning message when a non-compliant pod is created, but does not block the pod. Option B is wrong because the `audit` label adds an audit event to the audit log for non-compliant pods, but does not enforce or block them. Option D is wrong because it uses an incorrect annotation key (`security.kubernetes.io/pod-security`) and the `annotate` command instead of `label`; the correct mechanism uses labels with the `pod-security.kubernetes.io/enforce` key.

Why this answer

How to eliminate wrong answers

Option A is wrong because a Role is namespaced and cannot grant permissions across all namespaces; also, a RoleBinding only applies within its namespace. Option B is wrong because the verb 'get' only allows retrieving a specific pod, not listing pods; the required verb is 'list'. Option C is wrong because a RoleBinding cannot bind a ClusterRole to grant cluster-wide access; it would only apply the ClusterRole's permissions within the 'observability' namespace, not across all namespaces.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `EncryptionProvider` is not a valid Kubernetes resource; the correct term is `EncryptionConfiguration`, which references provider types like `aescbc` or `kms` within its `resources` array. Option B is wrong because `SecretEncryptionConfig` is a fictional resource name; Kubernetes does not have a dedicated resource for secret-only encryption, and the `EncryptionConfiguration` object applies to any resource type listed in its `resources` field. Option C is wrong because `KMSProvider` is not a standalone resource; it is a provider type (e.g., `kms` or `kmstool`) that can be used inside an `EncryptionConfiguration` to delegate encryption to an external Key Management Service like AWS KMS or GCP Cloud KMS.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because `cosign generate-key-pair` creates a new public/private key pair for signing, not for verifying an existing signature. Option C is wrong because `cosign sign` applies a signature to an image, which is the opposite of verification. Option D is wrong because `cosign attest` creates an in-toto attestation (a signed metadata statement about the image), but it does not directly verify the image's signature; verification of attestations requires a separate command like `cosign verify-attestation`.

Why this answer

How to eliminate wrong answers

Option A is wrong because labeling a node does not trigger any reload of the API server's encryption configuration; labels are metadata used for scheduling or node selection, not for configuration reload. Option C is wrong because `kubectl apply -f encryption-config.yaml` only creates or updates the EncryptionConfiguration resource in the cluster, but the API server does not automatically reload its encryption configuration from the resource; it must be restarted or the Pod recreated to pick up changes. Option D is wrong because while deleting the kube-apiserver Pod will cause the kubelet to recreate it (applying the new config), this is a less controlled method than a rollout restart and may not work if the API server is managed as a Deployment; the correct command for a Deployment-managed API server is `kubectl rollout restart`.

Why this answer

How to eliminate wrong answers

Option A is wrong because deleting the API server manifest file would remove the static pod definition, causing the API server to stop and the cluster to become unavailable. Option B is wrong because 'chmod 755' sets permissions to rwxr-xr-x, which is less restrictive than 644 (it grants execute permissions to all), failing the CIS check. Option C is wrong because restarting the kubelet service is unnecessary; the kubelet watches the manifest directory for changes and automatically reloads the static pod when the file permissions are updated.

Why this answer

How to eliminate wrong answers

Option A is wrong because `crictl logs` retrieves only the container's stdout/stderr logs, not the filesystem. Option C is wrong because `crictl inspect` returns metadata and configuration details (e.g., image, mounts) in JSON format, not the actual filesystem data. Option D is wrong because `crictl exec` runs a command inside the container, which would modify the container's state and potentially compromise the forensic evidence; `tar cvf /tmp/fs.tar /` would create an archive inside the container, not export it to the host.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `imagePullPolicy: Always` does not cause Kyverno to ignore registry validation; Kyverno evaluates the image reference regardless of the pull policy. Option C is wrong because Kyverno can validate images with tags; it parses the full image reference including tag and digest. Option D is wrong because the question states the policy 'validates images', implying a `validate` rule is present; a missing `validate` rule would prevent any validation, not cause a specific block.

Why this answer

How to eliminate wrong answers

Option A is wrong because MutatingAdmissionWebhook is a generic admission controller that can mutate any resource type, but it is not specifically responsible for image validation and modification based on an external webhook; that role is fulfilled by ImagePolicyWebhook. Option C is wrong because PodSecurity is a built-in admission controller that enforces Pod Security Standards (e.g., privileged, baseline, restricted) and does not interact with external webhooks for image validation. Option D is wrong because ValidatingAdmissionWebhook is a generic admission controller for validating any resource via an external webhook, but it does not have the specific purpose of validating and modifying images; ImagePolicyWebhook is the dedicated controller for that task.

Why this answer

How to eliminate wrong answers

Option A is wrong because `privileged` is a container-level flag that grants the container full host privileges, but it does not specifically control whether the container can gain privileges beyond its parent process; it is a broader, more permissive setting. Option B is wrong because `readOnlyRootFilesystem` only makes the container's root filesystem read-only to prevent writes, which does not address privilege escalation mechanisms. Option C is wrong because `runAsNonRoot` ensures the container runs as a non-root user but does not prevent the process from using setuid binaries or capabilities to escalate privileges beyond its parent process.

Why this answer

How to eliminate wrong answers

Option A is wrong because `--pod-manifest-path` is used by the kubelet to load static Pods from a local directory, not to enforce registry whitelisting; it has no mechanism to validate image sources. Option B is wrong because PodSecurity (formerly PodSecurityPolicy) restricts Pod security contexts (e.g., privileged containers, host namespaces), not the registry from which images are pulled. Option C is wrong because NetworkPolicy controls network traffic at the IP/port level (Layer 3/4) and cannot inspect or block the source registry of container images; it cannot prevent a Pod from pulling an image from an untrusted registry.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because dropping ALL and then adding NET_BIND_SERVICE does not leave all capabilities except NET_BIND_SERVICE; the drop operation removes everything, and the add operation only restores the specified capability, so the container ends up with only NET_BIND_SERVICE. Option C is wrong because the add directive explicitly grants NET_BIND_SERVICE, so the container does have that capability, not none. Option D is wrong because the default capabilities are not present; the `drop: ["ALL"]` overrides any defaults, leaving only the explicitly added capability.

Why this answer

How to eliminate wrong answers

Option A (CAP_NET_RAW) is wrong because it controls the ability to use raw and packet sockets (e.g., for crafting custom packets or performing ARP spoofing), not privilege escalation via setuid binaries. Option B (CAP_DAC_OVERRIDE) is wrong because it allows bypassing discretionary access control (file permission checks), which could enable reading/writing arbitrary files but does not directly control the ability to execute setuid binaries to gain new privileges. Option D (CAP_SYS_ADMIN) is wrong because it is a broad capability that grants many system administration operations (e.g., mount, namespace manipulation), but it does not specifically govern the setuid mechanism; dropping it would not prevent a container from using setuid binaries to escalate privileges.

Why this answer

How to eliminate wrong answers

Option A is wrong because binding to a privileged port (<1024) is controlled by the `CAP_NET_BIND_SERVICE` capability, not `NET_RAW`. Option B is wrong because the `ping` command typically uses ICMP echo requests, which can be sent via a datagram socket (SOCK_DGRAM) or raw socket; on many systems, ping falls back to a privileged datagram socket, so dropping `NET_RAW` does not necessarily prevent ping from working. Option D is wrong because dropping `NET_RAW` does not affect standard TCP/UDP connections; those use socket types (SOCK_STREAM, SOCK_DGRAM) that are governed by other capabilities like `CAP_NET_ADMIN` or `CAP_NET_RAW` only for raw sockets.

Why this answer

How to eliminate wrong answers

Option A is wrong because the container is explicitly configured with all capabilities enabled, not running without any capabilities (which would be the case with `--cap-drop=ALL`). Option C is wrong because the configuration grants all capabilities, not a minimal set like only `NET_BIND_SERVICE`; dropping all but one capability would be a secure practice, not a vulnerability. Option D is wrong because default Docker capabilities (a restricted set like `CHOWN`, `DAC_OVERRIDE`, `FSETID`, `FOWNER`, `MKNOD`, `NET_RAW`, `SETGID`, `SETUID`, `SETFCAP`, `SETPCAP`, `NET_BIND_SERVICE`, `SYS_CHROOT`, `KILL`, `AUDIT_WRITE`) are considered secure for most workloads, but this configuration explicitly grants all capabilities, which is far less restrictive and insecure.

Why this answer

How to eliminate wrong answers

Option A is wrong because a low timeout would cause the webhook to fail or return an error, potentially blocking deployments rather than allowing unauthorized images; it would not silently admit them. Option B is wrong because if the registry is allowlisted in the webhook configuration, then deployments from that registry are expected to be admitted, not blocked — this describes correct behavior, not a cause of unauthorized images being admitted. Option C is wrong because if the admission controller were disabled, the ImagePolicyWebhook would not run at all, and all deployments (including those from unauthorized registries) would be admitted; however, the question states that deployments from unauthorized registries are blocked, so the controller is active.

Why this answer

How to eliminate wrong answers

Option A is wrong because the annotation prefix is `container.apparmor.security.beta.kubernetes.io/`, not `container.apparmor.kubernetes.io/` — the latter is not a valid Kubernetes annotation key for AppArmor. Option B is wrong because the annotation key is missing the `container.` prefix and the value is missing the `localhost/` prefix; the correct value must be `localhost/my-custom-profile`, not just `my-custom-profile`. Option D is wrong because the annotation key incorrectly places the profile name in the key itself and uses `enforce` as the value; the correct format uses the container name in the key and `localhost/<profile_name>` as the value.

Why this answer

How to eliminate wrong answers

Option A is wrong because `--authorization-mode=AlwaysAllow` bypasses all authorization checks, allowing any authenticated request to proceed, which violates the requirement to serve only authorized requests. Option B is wrong because `--anonymous-auth=true` allows unauthenticated requests, which directly contradicts the need to serve only authenticated requests. Option C is wrong because `--authenticated` is not a valid kubelet flag; the correct flag is `--anonymous-auth`, and `--authorization=RBAC` is not a valid flag (the correct flag is `--authorization-mode` and RBAC is not a supported mode for the kubelet; the kubelet supports `AlwaysAllow`, `Webhook`, and `AlwaysDeny`).

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because restricting file system access is achieved via read-only root filesystems, securityContext with readOnlyRootFilesystem, or AppArmor/SELinux profiles, not seccomp. Option C is wrong because restricting Linux capabilities is done via the 'capabilities' field in securityContext (e.g., drop: ALL), while seccomp filters syscalls at a lower level. Option D is wrong because restricting network access is managed by NetworkPolicies, not seccomp.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the hostPath volume is relevant: it must be allowed by the cluster's security policies (e.g., PodSecurityPolicy, OPA), but NodeRestriction does not block it. Option B is wrong because NodeRestriction does not restrict hostPath volumes; it only restricts node label modifications and kubelet self-approval of certificates. Option D is wrong because nodeSelector does not conflict with NodeRestriction; NodeRestriction does not evaluate nodeSelector values for conflicts.

Why this answer

How to eliminate wrong answers

Option A is wrong because the EncryptionConfiguration applies only to the resources listed in its `resources` field, not to all resources by default. Option B is wrong because etcd encryption is not retroactive; existing Secrets are not automatically re-encrypted when the configuration is applied. Option D is wrong because aescbc is a valid provider in Kubernetes (AES-CBC with PKCS#7 padding) and is commonly used for encryption at rest.

Why this answer

How to eliminate wrong answers

Option A is wrong because `--anonymous-auth-enabled=false` is not a valid kube-apiserver flag; the correct flag name is `--anonymous-auth`, not `--anonymous-auth-enabled`. Option B is wrong because `--disable-anonymous-auth` is not a recognized kube-apiserver flag; the kube-apiserver uses a boolean flag `--anonymous-auth` rather than a disable prefix. Option C is wrong because `--enable-anonymous-auth=false` is also not a valid flag; the kube-apiserver does not use an `--enable-` prefix for this setting, and the correct flag is simply `--anonymous-auth`.

Why this answer

How to eliminate wrong answers

Option A is wrong because `kubectl benchmark` is not a valid kubectl command; kubectl has no built-in benchmark subcommand. Option C is wrong because `kube-bench scan` is not a valid subcommand; kube-bench uses `run` to execute the benchmark, not `scan`. Option D is wrong because `kubectl run kube-bench` would attempt to run a pod named 'kube-bench' using a container image, not execute the kube-bench binary directly against the host's configuration files.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because it checks for `capabilities.drop == "ALL"`, which is unrelated to `runAsUser: 0`; this would deny pods that drop all capabilities, not pods running as root. Option B is wrong because it checks `spec.securityContext.runAsUser` at the pod level, but `runAsUser` is a container-level field and is not set in the pod-level `securityContext`; this path would never match. Option D is wrong because it checks `runAsNonRoot == true`, which enforces that the container must not run as root, but it does not deny the specific setting `runAsUser: 0`; a pod could still set `runAsUser: 0` and also set `runAsNonRoot: true` (which would be contradictory but not caught by this rule).

Why this answer

How to eliminate wrong answers

Option A is wrong because running a container with `privileged: true` grants all capabilities and disables all security restrictions, which is excessive and insecure for modifying only kernel parameters. Option B is wrong because adding `SYS_ADMIN` capability grants broad administrative privileges (e.g., namespace manipulation, filesystem operations) beyond just modifying sysctls, violating the principle of least privilege. Option D is wrong because modifying the kubelet's `--sysctl-whitelist` is a deprecated and insecure approach; it applies globally to all pods on the node and does not provide per-pod granular control, unlike the Pod-level `allowedUnsafeSysctls` field.

Why this answer

How to eliminate wrong answers

Option A is wrong because the command-line interface for cluster management is provided by kubectl, not the Dashboard. Option C is wrong because while the Dashboard can display some basic metrics (like CPU/memory usage) via integrations like metrics-server, its primary purpose is not performance monitoring; dedicated tools like Prometheus and Grafana are used for comprehensive cluster monitoring. Option D is wrong because security policies (e.g., Pod Security Standards, RBAC, NetworkPolicies) are enforced by the Kubernetes API server and admission controllers, not by the Dashboard; the Dashboard itself is subject to those policies.

Why this answer

How to eliminate wrong answers

Option A is wrong because `kubectl get clusterrolebinding` uses the singular form, which is not a valid kubectl resource name; kubectl requires the plural form to list resources. Option D is wrong because `--all-namespaces` is redundant for ClusterRoleBindings, as they are cluster-scoped resources and not bound to any namespace; the flag has no effect and is misleading. Option C is also marked as correct in the question, but the prompt asks for the single correct answer; however, `kubectl get clusterrolebindings.rbac.authorization.k8s.io` is technically valid as it uses the fully qualified resource name, but the simpler plural form is the standard and expected answer.

Why this answer

How to eliminate wrong answers

Option A is wrong because while a sidecar container can watch for changes and reload the application, it is not the default or automatic mechanism; the question asks how the pod can consume updated values without restarting, and the built-in volume update handles that without requiring a sidecar. Option B is wrong because Kubernetes Secrets do not have versioning; you cannot reference a 'new Secret version' in the pod spec — you must update the same Secret object or create a new one and update the pod spec to reference the new name, which would require a pod restart. Option D is wrong because deleting and recreating the pod is unnecessary; the mounted volume is automatically updated by the kubelet, so restarting is not required.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because the failure policy (Ignore or Fail) only determines behavior when the webhook itself is unreachable or returns an error, not when the webhook is not triggered by the request. Option C is wrong because the question states the pod was created successfully, implying no namespace restriction was in effect; even if a namespaceSelector existed, the pod would have been denied if the webhook matched. Option D is wrong because service account filtering is configured via `matchConditions` or `objectSelector`, not by default, and the question provides no evidence of such a filter.

Why this answer

How to eliminate wrong answers

Option A is wrong because a NetworkPolicy controls network traffic to and from pods, not filesystem access; it cannot enforce a read-only root filesystem. Option C is wrong because `securityContext.runAsNonRoot: true` ensures the container runs as a non-root user but does not restrict writes to the root filesystem; a non-root user can still modify writable directories. Option D is wrong because `securityContext.allowPrivilegeEscalation: false` prevents privilege escalation (e.g., via setuid binaries) but does not make the root filesystem read-only; it addresses a different security concern.

Why this answer

How to eliminate wrong answers

Option A is wrong because `kubectl create clusterrole` creates a ClusterRole, which is cluster-scoped, not namespaced; it would grant permissions across all namespaces, not just 'ns1'. Option C is wrong because `--verb=*` grants all verbs (including create, update, delete, etc.), not just 'get', 'list', and 'watch'. Option D is wrong because `kubectl create rolebinding` creates a RoleBinding (binding a role to a subject), not a Role; it also references a role named 'pod-reader' that does not exist yet, and the command does not create the Role itself.

Why this answer

How to eliminate wrong answers

Option A is wrong because Syft is a software bill of materials (SBOM) generator that analyzes container images and filesystems to list packages and dependencies, not a static analyzer of Kubernetes manifests. Option B is wrong because Cosign is a tool for signing and verifying container image signatures and attestations, not for scanning Kubernetes manifest files for security misconfigurations. Option D is wrong because Trivy is a comprehensive vulnerability scanner that primarily scans container images, filesystems, and Git repositories for known CVEs, and while it can scan IaC files including Kubernetes manifests, its core focus is vulnerability detection rather than dedicated static analysis of Kubernetes security configurations; Kubesec is the more specialized and direct tool for this purpose.

Why this answer

How to eliminate wrong answers

Option A is wrong because a ConfigMap is used to store non-confidential configuration data as key-value pairs, not to define encryption providers or settings for etcd encryption at rest. Option B is wrong because a ClusterRole defines permissions for RBAC (Role-Based Access Control) and has no relation to configuring encryption providers for etcd. Option D is wrong because a Secret is used to store sensitive data like passwords or tokens, but it is not the resource that configures how etcd data is encrypted; the EncryptionConfiguration resource defines the encryption providers and keys.

Why this answer

How to eliminate wrong answers

Option A is wrong because the namespace does not affect image pull behavior; 'kubectl run' defaults to the 'default' namespace, and the error is from the registry, not from Kubernetes RBAC or namespace isolation. Option B is wrong because the error message 'manifest unknown' is distinct from authentication errors (which would show 'unauthorized' or 'denied'); the registry requires authentication would produce a 401 or 403 HTTP response, not a manifest lookup failure. Option D is wrong because multi-architecture images are handled by the container runtime (e.g., containerd) which selects the appropriate architecture manifest; if the node architecture is unsupported, the error would be 'exec format error' or 'not found' for the specific architecture, not 'manifest unknown' for the tag.

Why this answer

How to eliminate wrong answers

Option A is wrong because Pod Security Admission (PSA) with the 'baseline' policy does not enforce readOnlyRootFilesystem or allow fine-grained capability control like only NET_BIND_SERVICE; it only restricts privileged containers and host namespaces, and a mutating webhook would be an additional, non-standard workaround. Option C is wrong because the 'privileged' policy in PSA allows all capabilities and privilege escalation, directly violating the requirement to prevent privilege escalation and enforce a read-only root filesystem. Option D is wrong because PodSecurityPolicy (PSP) is deprecated in Kubernetes v1.24 and will be removed in v1.25, making it a non-compliant choice for new configurations; additionally, PSPs are cluster-scoped and binding them via RoleBinding to a namespace is not the intended mechanism (they require PSP-specific RBAC bindings).

Why this answer

How to eliminate wrong answers

Option A is wrong because `privileged: false` only disables privileged mode (which grants all capabilities), but does not enforce a read-only root filesystem; a non-privileged container can still write to its filesystem. Option C is wrong because `readOnly: true` is not a valid field in the Kubernetes security context; the correct field is `readOnlyRootFilesystem`. Option D is wrong because `allowPrivilegeEscalation: false` prevents processes from gaining more privileges than their parent, but does not restrict filesystem writes.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because if the image tag did not exist, the error would typically be 'manifest unknown' or a 404 from the registry, not 'No signatures found'. Option C is wrong because if a different private key was used, the verification would fail with a signature mismatch error (e.g., 'invalid signature') rather than a missing signature error. Option D is wrong because 'cosign verify' expects a public key (--key cosign.pub) to verify the signature; using a private key would be a command syntax error, not a 'No signatures found' error.

Why this answer

How to eliminate wrong answers

Option A is wrong because PodSecurityPolicy (deprecated in v1.21 and removed in v1.25) controls security context constraints, not runtime selection; it cannot specify which container runtime to use. Option B is wrong because a custom resource definition (CRD) is used to extend the Kubernetes API with new resource types, but RuntimeClass is a built-in API resource (node.k8s.io/v1) that does not require a CRD. Option D is wrong because the `runtimeClass` field in the pod spec is a reference to an existing RuntimeClass object; the RuntimeClass resource must be created first before any pod can use it.

Why this answer

How to eliminate wrong answers

Option A is wrong because a privileged container would bypass AppArmor entirely, but the question states the profile is loaded and the annotation is set, so the issue is about enforcement mode, not privilege. Option C is wrong because `allowPrivilegeEscalation` controls whether processes can gain more privileges than their parent, but it does not affect AppArmor profile enforcement; AppArmor enforces regardless of privilege escalation settings. Option D is wrong because the annotation 'container.apparmor.security.beta.kubernetes.io/nginx: localhost/deny-write' is correctly formatted per Kubernetes conventions, using the profile name prefixed with 'localhost/'.

Why this answer

How to eliminate wrong answers

Option A is wrong because deleting and recreating the service account does not remove the existing ClusterRoleBinding; the new service account would still be bound to the same ClusterRoleBinding and retain cluster-admin access. Option C is wrong because creating a new RoleBinding with fewer privileges in the kube-system namespace does not revoke the existing ClusterRoleBinding; the service account would still have cluster-admin access from the binding, and RoleBindings are namespace-scoped and cannot override a ClusterRoleBinding. Option D is wrong because modifying the 'cluster-admin' ClusterRole would affect all subjects bound to it, including other service accounts and users, potentially breaking critical system components that rely on its permissions.

Why this answer

How to eliminate wrong answers

Option B is wrong because `serviceAccountToken` is not a valid field in the Pod spec; the correct field is `automountServiceAccountToken`. Option C is wrong because `automountToken` is not a recognized Kubernetes field; the exact API field name is `automountServiceAccountToken`. Option D is wrong because `enableServiceAccountToken` does not exist in the Pod spec; the field to disable automount is `automountServiceAccountToken`, not an enable/disable toggle.