mediumMultiple ChoiceObjective-mapped
CKS Practice Question: An administrator runs kube-bench on a node and…
An administrator runs kube-bench on a node and sees a warning about the kubelet anonymous authentication being enabled. Which kubelet flag should be set to disable anonymous access?
⚠ Common exam trap
A common mix-up: candidates confuse the kubelet's `--anonymous-auth` flag with similar-sounding but non-existent flags like `--enable-anonymous` or `--disable-anonymous`, or mistakenly think that setting the flag to `true` disables anonymous access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
--anonymous-auth=false
The kubelet's `--anonymous-auth` flag controls whether requests to the kubelet API that are not rejected by other authentication modules are treated as anonymous requests. Setting `--anonymous-auth=false` disables anonymous access, requiring all requests to present valid credentials. This directly addresses the kube-bench warning about anonymous authentication being enabled, which is a security concern as it allows unauthenticated access to the kubelet's API.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
--anonymous-auth=false
Why this is correct
Setting --anonymous-auth=false disables anonymous authentication for the kubelet, which is a CIS benchmark recommendation.
- ✗
--anonymous-auth=true
Why it's wrong here
Setting this to true enables anonymous authentication, which is the opposite of what is needed.
- ✗
--enable-anonymous=false
Why it's wrong here
There is no such flag; the correct flag is --anonymous-auth.
- ✗
--disable-anonymous=true
Why it's wrong here
There is no such flag; the correct flag is --anonymous-auth=false.
Go deeper
Related to this question
About these practice questions
One of 114 original CKS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CKS
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which flag on the kubelet disables anonymous access?
easy- ✓ A.--anonymous-auth=false
- B.--disable-anonymous
- C.--no-anonymous
- D.--enable-anonymous-auth=false
Why A: The `--anonymous-auth` flag on the kubelet controls whether anonymous requests are allowed. Setting `--anonymous-auth=false` explicitly disables anonymous access, requiring all requests to present valid authentication credentials. This is a critical hardening measure to prevent unauthenticated users from interacting with the kubelet API.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.