Certified Kubernetes Security Specialist CKS (CKS) — Questions 376–450

To enable TLS for client-to-etcd communication, the etcd server must present a certificate to clients. The `--cert-file` and `--key-file` flags specify the server's TLS certificate and private key, which are required for the TLS handshake. Without these, etcd cannot serve HTTPS to clients.

Kubesec is a tool that analyzes Kubernetes YAML files and provides security scores. Option A is correct.

Option A is correct because the CIS Kubernetes Benchmark recommends setting `--authorization-mode=RBAC` to enforce role-based access control, which restricts API server access based on user roles and permissions. This ensures that only authorized users and service accounts can perform specific actions, aligning with the principle of least privilege.

Option D is correct because kube-bench checks the kubelet configuration for the `--anonymous-auth` flag, which is set in the kubelet's configuration file. By default, the kubelet reads its configuration from `/var/lib/kubelet/config.yaml` (or a path specified by `--config` in the kubelet service). Setting `anonymous-auth: false` in this file disables anonymous requests to the kubelet API, enforcing authentication.

Option D is correct because Kubernetes audit logging requires an audit policy file that defines the log level for different request stages and resources. The requirement to log all requests at the Metadata level is achieved by creating a policy file with `level: Metadata` for all resources (or a catch-all rule) and passing it to the API server via the `--audit-policy-file` flag. The audit policy file is the only mechanism to specify the log level (None, Metadata, Request, RequestResponse) per resource or stage.

Option A is correct because `kube-bench` is the official open-source tool from Aqua Security that runs CIS Kubernetes Benchmark checks against a cluster. It scans nodes by targeting specific roles (master, worker) and compares the cluster configuration against the CIS Benchmark controls, reporting pass/fail for each check.

RuntimeClass is a cluster resource that defines a container runtime configuration (e.g., gVisor, Kata). Pods specify which RuntimeClass to use via the runtimeClassName field.

Setting `securityContext.allowPrivilegeEscalation: false` directly prevents a container from gaining new privileges beyond those it was initially granted, such as through setuid binaries or the `NO_NEW_PRIVS` flag. This is the exact control needed to block privilege escalation attacks, as it forces the kernel to deny any request for elevated privileges, even if the binary has the setuid bit set.

Use the -r flag to load a custom rules file.

The annotation 'container.apparmor.security.beta.kubernetes.io/<container_name>' is the standard way to specify an AppArmor profile for a container in a pod.

Kubesec is a tool that analyzes Kubernetes manifests for security issues. Option A is correct.

Option D is correct because it enforces a two-layer defense: Harbor's content trust rejects unsigned images at the registry level, and a Kyverno admission rule verifies Cosign signatures at deploy time. This ensures that even if an unsigned image bypasses the registry, it will be blocked by Kubernetes admission control, providing defense in depth for supply chain security.

runAsNonRoot: true is the correct field to ensure containers cannot run as root. It is a Pod Security Context field that rejects pods whose container image specifies a root user or does not specify a user.

PeerAuthentication defines the mTLS mode for workloads. Setting mode to STRICT enforces that only mTLS traffic is accepted. DestinationRule can complement with client-side settings, but the primary enforcement is PeerAuthentication.

First generate the SBOM with syft, then attach it as an attestation with cosign attest.

Option B is correct because the CIS Benchmark for Kubernetes recommends disabling anonymous authentication to ensure that all requests to the API server are authenticated. By setting the `--anonymous-auth=false` flag on the kube-apiserver, unauthenticated requests are rejected, which prevents anonymous users from accessing the cluster. This is a fundamental security hardening step to enforce identity verification for every API call.

kubectl exec with -it and -- /bin/bash gives an interactive shell without modifying the container's filesystem.

The 'kubectl replace' command triggers re-encryption by rewriting the resource.

An SBOM provides a list of all components in a software artifact, enabling vulnerability tracking and license compliance.

Option C is correct because, by default, Kubernetes does not enforce any restrictions on image registries. The kubelet will attempt to pull the image from any registry, including untrusted ones, unless an admission controller like ImagePolicyWebhook or a runtime-specific policy (e.g., containerd's `untrusted_workload` mode) is explicitly configured. In this scenario, no such policy is mentioned, so the pod is created and the image is pulled.

The `aa-status` command is a standard Linux utility that displays the status of AppArmor, including whether it is enabled and which profiles are loaded. Since AppArmor is a Linux Security Module (LSM) enforced at the node level, not a Kubernetes resource, you must use a node-level command like `aa-status` to check its status. This command directly queries the AppArmor module in the kernel and lists all loaded profiles.

Cosign verify and cosign verify-attestation are the correct commands. The other options are incorrect commands.

The kubelet can have its authentication settings configured either via command-line arguments or via a KubeletConfiguration file. If the kubelet configuration file does not explicitly set `authentication.anonymous.enabled` to `false`, the kubelet may still allow anonymous access even if the `--anonymous-auth=false` argument is passed on the command line, because the configuration file takes precedence over command-line flags. kube-bench checks the effective configuration, so if the file overrides the flag, the check fails.

Distroless images reduce attack surface and image size by including only necessary libraries.

The correct command is kubectl exec -it <pod> -- /bin/sh, which starts an interactive shell in the container.

The `--authorization-mode=Webhook` flag configures the kubelet to use an external authorization webhook (e.g., via the SubjectAccessReview API) for all requests, including those to modify node status and pods. This restricts the kubelet's ability to autonomously update its own node status or pod resources, as every such request must be approved by the external authorizer, enforcing a least-privilege model.

PodSecurity is a built-in admission controller that enforces Pod Security Standards (restricted, baseline, privileged). The restricted profile includes 'runAsNonRoot: true' and 'readOnlyRootFilesystem: true'.

This setting prevents processes in the container from gaining more privileges than their parent, such as via setuid binaries.

Setting resource limits (CPU/memory) on a container is correct because it prevents a compromised microservice from consuming excessive cluster resources, which could lead to a denial-of-service (DoS) attack against other workloads. By enforcing limits via the container's cgroup constraints, the kernel throttles or OOM-kills the container if it exceeds its allocated resources, containing the blast radius of the compromise.

Falco uses the 'evt.type' field to match system call events, and 'fd.name' to match the file descriptor name. Option A correctly checks for openat or open syscalls with target file name containing /etc/shadow.

PodSecurityPolicy is deprecated. The modern approach is to use a ValidatingAdmissionPolicy or an OPA/Gatekeeper policy. Among the options, only 'ValidatingAdmissionPolicy' is a built-in admission controller that can enforce such policies.

Option C is correct because the kube-apiserver uses the `--anonymous-auth` flag to control anonymous requests. Setting `--anonymous-auth=false` explicitly disables anonymous authentication, meaning unauthenticated requests (those without a valid bearer token or client certificate) will be rejected with a 401 Unauthorized response. This is a critical hardening step to prevent unauthorized access to the Kubernetes API server.

The 'cluster-admin' ClusterRole grants super-user permissions across the entire cluster, including access to all namespaces and all resources. Binding this role to a service account via a ClusterRoleBinding gives that service account unrestricted cluster-wide privileges, which violates the principle of least privilege. This is a significant security concern because if the service account is compromised, an attacker gains full control over the cluster.

The `--protect-kernel-defaults` flag ensures that the kubelet enforces kernel parameter protections, preventing containers from modifying sensitive kernel parameters (e.g., via sysctl). This is a critical security hardening measure to maintain node stability and prevent container breakout through kernel tuning.

The clientConfig for a service-based webhook must reference the namespace, service name, and path. Option A uses the service reference correctly.

The apparmor_parser command is used to load AppArmor profiles into the kernel.

To preserve evidence, you should not delete the pod immediately. Instead, use kubectl cp or a sidecar to copy files, or create a snapshot. But the simplest non-destructive step is to copy files from the container using 'kubectl cp' before deletion.

The recommended approach is to drop ALL capabilities using 'ALL' and then add only the needed capabilities.

Using the image pull policy 'IfNotPresent' does not enforce digest usage; the image field must specify a digest.

'crictl logs <container-id>' retrieves the logs of a container. Option A lists pods, option B lists containers, option D executes a command in a container.

Request level logs only the request metadata and request object, not the response.

ValidatingWebhookConfiguration is the correct resource for admission webhooks that validate requests. PodPreset is deprecated, and other options are not valid resources.

ImagePolicyWebhook validates images, and NodeRestriction is not supply-chain related. AlwaysPullImages ensures image pull always happens but does not enforce security policies.

Setting 'hostPID: true' in a pod's spec allows the container to share the host node's PID namespace, meaning the container can see and interact with all processes running on the host, not just those within its own PID namespace. This is a privileged-level setting that bypasses the default process isolation provided by Kubernetes and Linux namespaces.

Option C is correct because the error 'seccomp profile not found' indicates that the Kubernetes kubelet cannot locate the specified profile file on the node's filesystem. When using `type: Localhost`, the `localhostProfile` value is resolved relative to the kubelet's seccomp profile root directory (default `/var/lib/kubelet/seccomp`). If the file `custom-profile.json` does not exist at that path on the node, the pod will fail to start.

Setting `automountServiceAccountToken: false` in the ServiceAccount definition applies the setting to all pods that use that ServiceAccount, effectively enforcing the policy at the namespace level when the default or all ServiceAccounts are configured this way. This is the correct approach because the ServiceAccount's `automountServiceAccountToken` field controls token mounting for pods referencing it, overriding any pod-level setting unless explicitly set in the pod spec.

kubectl create quota is the imperative command to create a ResourceQuota. It requires a name and optionally the --namespace flag.

These flags are essential for hardening the API server.

PeerAuthentication defines the mTLS mode for workloads within a namespace.

crictl logs is the equivalent of 'kubectl logs' but uses the container ID. It outputs the container's stdout/stderr.

Pod Security Admission (PSA), OPA/Gatekeeper, and Kyverno are all valid tools to enforce security policies. Seccomp profiles restrict system calls but do not prevent running as root.

A RuntimeClass resource defines a runtime handler (e.g., runsc) and is referenced in a pod's spec.runtimeClassName to select that runtime.

Using a SHA digest ensures immutability and is often required by security policies. Updating the image reference to use the SHA digest allows the image to pass policy.

Kyverno is a Kubernetes-native policy engine that can enforce pod security standards by validating, mutating, and generating resources based on policies written as Kubernetes custom resources. It integrates with the Kubernetes API server via dynamic admission webhooks, allowing it to reject non-compliant pod specs before they are persisted.

Setting `podPidsLimit` to `-1` in Kubernetes disables PID limiting for pods, meaning a single pod can create an unlimited number of processes. This poses a security risk because a compromised or malicious pod could launch a fork bomb, exhausting all available PIDs on the node and causing a denial of service (DoS) for other workloads. The correct answer is C.

A Kyverno rule that validates image registries would deny images from registries not in the allowed list. Option D is correct.

Running as non-root and using a read-only root filesystem are key security best practices. Scanning for vulnerabilities is also important but not listed as an option here. The correct answers are B and D.

Option C is correct because Kyverno can enforce policies that require images to have specific annotations, such as one indicating a passed security scan. This ensures only images that have been verified by your security pipeline are allowed to run, directly preventing unapproved or tampered images from being deployed.

Isolating the pod via NetworkPolicy, preserving evidence by copying the filesystem, and capturing logs are key steps. Terminating the pod immediately may lose evidence, and ignoring is not recommended.

The 'aa-status' command shows the status of AppArmor profiles, including which profiles are loaded and in what mode. Option A is correct. The other options are not standard AppArmor commands.

Pod isolation is achieved by applying a NetworkPolicy that denies ingress/egress traffic. 'kubectl apply -f networkpolicy.yaml' applies the policy. The policy must be written to deny all traffic.

The `--protect-kernel-defaults` flag is used to secure the kubelet by ensuring that kernel tunable parameters (e.g., `vm.overcommit_memory`, `kernel.panic`) are set to safe values. If the kernel defaults are not properly configured, the kubelet will fail to start, preventing insecure kernel settings from being used. This flag is part of the kubelet's security hardening measures, as recommended by the CIS Kubernetes Benchmark.

The 'restricted' Pod Security Standard prohibits the use of hostNetwork, hostPID, and hostIPC, among other restrictions. 'Baseline' allows these with some restrictions, while 'privileged' allows all. Option C is correct.