mediumMultiple Choice
CKS Practice Question: Which command would you run to check if anonymous…
Which command would you run to check if anonymous authentication is enabled on the API server?
⚠ Common exam trap
CNCF often tests the ability to distinguish between runtime process inspection and Kubernetes API resource queries, leading candidates to mistakenly use `kubectl` commands that query non-existent or irrelevant resources instead of checking the actual process arguments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ps aux | grep kube-apiserver | grep anonymous-auth
The `--anonymous-auth` flag on the kube-apiserver binary controls whether anonymous requests are allowed. Running `ps aux | grep kube-apiserver | grep anonymous-auth` directly inspects the running process arguments to see if the flag is set to `true` (enabled) or `false` (disabled). This is the most direct way to check the runtime configuration of the API server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ps aux | grep kube-apiserver | grep anonymous-auth
Why this is correct
It directly examines the kube-apiserver process arguments, where anonymous authentication is controlled by the --anonymous-auth flag (default true). Running this command shows whether the flag is explicitly set to false (disabling anonymous auth) or left unset (enabling it). This is the authoritative way to audit a running API server, because the effective configuration comes from the process launch parameters rather than cluster objects.
- ✗
kubectl get nodes -o yaml | grep anonymous
Why it's wrong here
Node objects do not contain API server flags. Nodes represent worker machines and include status, addresses, and kubelet info, but never expose the API server's authentication settings. This command would only match if a node's YAML included the word anonymous (e.g., in a name or annotation), which is not a reliable or factual check.
- ✗
kubectl describe configmap anonymous
Why it's wrong here
Anonymous authentication is not configured via ConfigMap. There is no such ConfigMap by default, and even if created, the API server does not read anonymous auth settings from ConfigMaps. The API server uses flags, not configmaps, for this behavior, so this command would return a NotFound error or describe an irrelevant resource.
- ✗
kubectl get clusterrolebinding anonymous
Why it's wrong here
There is no default clusterrolebinding named anonymous. Anonymous requests are handled by system:anonymous user, but no binding with that exact name exists by default. ClusterRoleBindings grant permissions to users/groups; to control anonymous access you'd inspect bindings for system:authenticated or system:anonymous group, not one named 'anonymous'.
Go deeper
Related to this question
About these practice questions
This CKS question is part of Courseiva's 845-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.