Courseiva
← CKS
Full test
mediumMultiple ChoiceObjective-mapped

CKS Practice Question: Which command can be used to check if the API…

Which command can be used to check if the API server has anonymous authentication enabled?

⚠ Common exam trap

CNCF often tests the misconception that RBAC commands (like `kubectl auth can-i`) can detect server-level flags, when in fact they only test authorization after authentication has already succeeded, making them useless for checking if anonymous auth is enabled.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

kubectl describe pod kube-apiserver -n kube-system | grep anonymous-auth

The kube-apiserver pod's manifest (or its runtime configuration) contains the `--anonymous-auth` flag. By inspecting the pod's YAML with `kubectl describe pod kube-apiserver -n kube-system` and grepping for `anonymous-auth`, you can see whether the flag is set to `true` (enabled) or `false` (disabled). This is the direct way to check the API server's runtime configuration for anonymous authentication.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    kubectl get clusterrole cluster-admin -o yaml

    Why it's wrong here

    ClusterRole does not show API server configuration.

  • ✓

    kubectl describe pod kube-apiserver -n kube-system | grep anonymous-auth

    Why this is correct

    This shows the kube-apiserver's flags including anonymous-auth.

  • ✗

    kubectl get node -o yaml

    Why it's wrong here

    Node objects do not contain API server flags.

  • ✗

    kubectl auth can-i --list --as=system:anonymous

    Why it's wrong here

    This checks what anonymous user can do, but does not show the flag.

About these practice questions

One of 114 original CKS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

2 more ways this is tested on CKS

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Which command would you run to check if anonymous authentication is enabled on the API server?

medium
  • ✓ A.ps aux | grep kube-apiserver | grep anonymous-auth
  • B.kubectl get nodes -o yaml | grep anonymous
  • C.kubectl describe configmap anonymous
  • D.kubectl get clusterrolebinding anonymous

Why A: The `--anonymous-auth` flag on the kube-apiserver binary controls whether anonymous requests are allowed. Running `ps aux | grep kube-apiserver | grep anonymous-auth` directly inspects the running process arguments to see if the flag is set to `true` (enabled) or `false` (disabled). This is the most direct way to check the runtime configuration of the API server.

Variation 2. Which kubectl command can be used to determine if anonymous authentication is enabled on the API server?

easy
  • A.kubectl get --raw /api/v1
  • B.kubectl describe node | grep anonymous
  • C.kubectl cluster-info dump | grep -i anonymous
  • ✓ D.kubectl get pods -n kube-system kube-apiserver-<node> -o yaml | grep anonymous-auth

Why D: The kube-apiserver manifest file (typically located in /etc/kubernetes/manifests/kube-apiserver.yaml) contains the `--anonymous-auth` flag. By inspecting the pod definition via `kubectl get pods -n kube-system kube-apiserver-<node> -o yaml`, you can see the exact command-line arguments passed to the API server, including whether `--anonymous-auth=false` is set (disabled) or absent (enabled by default). This is the most direct and reliable method to check anonymous authentication status.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.