easyMultiple Choice
CKS Practice Question: Which kubelet flag should be set to ensure the…
Which kubelet flag should be set to ensure the kubelet does not allow anonymous requests?
⚠ Common exam trap
Watch out — candidates often confuse `--anonymous-auth=false` with `--authentication-token-webhook=true`, thinking token webhook alone blocks anonymous requests, but anonymous auth must be explicitly disabled as a separate step.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
--anonymous-auth=false
Setting `--anonymous-auth=false` explicitly disables anonymous requests to the kubelet. By default, anonymous authentication is enabled, which allows unauthenticated users to access the kubelet API. Disabling this flag ensures that only authenticated requests are processed, aligning with the principle of least privilege and hardening the cluster.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
--authentication-token-webhook=true
Why it's wrong here
This flag configures the kubelet to validate ServiceAccount tokens via the TokenReview API, but it is only one piece of the authentication flow. It does not affect the anonymous authentication mode, which remains enabled unless explicitly disabled with --anonymous-auth=false. Therefore, unauthenticated requests can still reach the kubelet's HTTPS endpoint, so this flag alone does not satisfy the requirement.
- ✗
--read-only-port=0
Why it's wrong here
Setting this to 0 disables the legacy read-only port (10255) that served unauthenticated metrics and health endpoints. However, the main kubelet API on port 10250 still accepts requests, and anonymous authentication is controlled separately by --anonymous-auth. Disabling the read-only port reduces exposure but leaves the authenticated and anonymous access paths intact, so it doesn't secure the kubelet against anonymous requests.
- ✓
--anonymous-auth=false
Why this is correct
This is the correct flag because it explicitly disables anonymous authentication in the kubelet's authentication layer. When set to false, any request that does not present valid client certificates, bearer tokens, or other configured credentials is rejected with 401 Unauthorized before reaching kubelet handlers. This directly prevents unauthenticated access to the kubelet's API and is a required hardening step in the CIS Kubernetes Benchmark.
- ✗
--protect-kernel-defaults=true
Why it's wrong here
This flag makes the kubelet fail if kernel tunables like vm.overcommit_memory or kernel.panic are not set appropriately, which is a security hardening measure for the node. It checks sysctl settings and protects against dangerous defaults, but it operates at the kernel level and has no bearing on the HTTP authentication layer. Therefore, it does not disable anonymous access to the kubelet API.
Go deeper
Related to this question
About these practice questions
This CKS question is part of Courseiva's 845-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.