CKS Practice Questions

Question 1

Arrange the steps to configure and use kube-bench to audit a Kubernetes cluster's security.

Accepted Answer

Install kube-bench, then run kube-bench against the cluster, then review audit results, then apply remediation, then re-run kube-bench to verify.. kube-bench audits CIS benchmarks. After installation, run it, analyze results, remediate, and re-audit.

Answer

Run kube-bench against the cluster, then review audit results, then install kube-bench, then apply remediation, then re-run kube-bench to verify.

Answer

Install kube-bench, then review audit results, then run kube-bench against the cluster, then apply remediation, then re-run kube-bench to verify.

Answer

Install kube-bench, then run kube-bench against the cluster, then apply remediation, then review audit results, then re-run kube-bench to verify.

Question 2

Arrange the steps to create and enforce a Pod Security Policy (PSP) in a Kubernetes cluster.

Accepted Answer

Enable the PodSecurityPolicy admission controller, create a PodSecurityPolicy resource, grant RBAC access to the policy, and verify enforcement by testing a pod.. PSPs require enabling the admission controller, creating the policy, granting access via RBAC, and binding to subjects. Testing confirms enforcement.

Answer

Create a PodSecurityPolicy resource, enable the PodSecurityPolicy admission controller, grant RBAC access, and verify enforcement.

Answer

Grant RBAC access to the PodSecurityPolicy, enable the admission controller, create the policy, and verify enforcement.

Answer

Enable the PodSecurityPolicy admission controller, create a PodSecurityPolicy resource, verify enforcement, and grant RBAC access.

Question 3

Which of the following is the correct kubectl command to view the OPA Gatekeeper ConstraintTemplates in the cluster?

Accepted Answer

kubectl get constrainttemplates. OPA Gatekeeper registers its constraints as custom resources in Kubernetes, and the standard `kubectl get constrainttemplates` command retrieves all ConstraintTemplate resources from the cluster. This works because Gatekeeper uses the Kubernetes API aggregation layer, making ConstraintTemplates a top-level resource type that kubectl can query directly.

Answer

kubectl get gatekeeper-constrainttemplates

Answer

kubectl describe opa constrainttemplate

Answer

kubectl get crd -o name | grep constraint

Question 4

You are creating a ServiceAccount that should not automatically mount its token to pods. Which field should be set in the ServiceAccount manifest?

Accepted Answer

automountServiceAccountToken: false. The `automountServiceAccountToken` field in a ServiceAccount manifest, when set to `false`, prevents pods using that ServiceAccount from automatically mounting the service account token as a volume. This is a security hardening measure to reduce the attack surface in case a pod is compromised, as the token could be used to authenticate to the Kubernetes API server.

Answer

disableAutomount: true

Answer

tokenMountDisabled: true

Answer

mountToken: false

Question 5

Which THREE of the following are required to implement a secure software supply chain using Kubernetes native features?

Accepted Answer

Use vulnerability scanning tools like Trivy or Grype in the CI/CD pipeline.. Vulnerability scanning tools like Trivy or Grype are essential for identifying known CVEs in container images before deployment. Integrating these tools into the CI/CD pipeline ensures that only images with an acceptable vulnerability posture are built and pushed to the registry, forming a foundational security gate in the software supply chain.

Answer

Disable admission controllers to reduce latency in pod creation.

Answer

Run all containers as root inside the pod to avoid permission issues.

Question 6

Which TWO of the following are valid methods to secure the etcd datastore in a Kubernetes cluster?

Accepted Answer

Enable TLS encryption for client-to-server communication.. Enabling TLS encryption for client-to-server communication ensures that all data transmitted between etcd clients (such as the Kubernetes API server) and the etcd server is encrypted, preventing eavesdropping and man-in-the-middle attacks. This is a fundamental security measure for protecting sensitive cluster state and secrets stored in etcd.

Answer

Use HTTP instead of HTTPS for better performance.

Answer

Disable client authentication to simplify configuration.

Answer

Expose the etcd port (2379) on a public IP for easier monitoring.

Question 7

An admin has created an EncryptionConfiguration to encrypt secrets at rest in etcd. After applying the configuration and restarting the kube-apiserver, existing secrets are still stored in plaintext. What is the most likely reason?

Accepted Answer

Existing secrets are not automatically encrypted; they need to be rewritten by reading and writing them back. Kubernetes does not automatically encrypt existing secrets stored in etcd when an EncryptionConfiguration is applied. The encryption configuration only affects data written after the kube-apiserver is restarted; previously stored secrets remain in plaintext until they are read and rewritten (e.g., by running `kubectl get secret <name> -o yaml | kubectl replace -f -`). This behavior is by design, as the API server encrypts data on write, not retroactively.

Answer

The encryption provider is set to 'identity' which does not encrypt

Answer

The kube-apiserver was not restarted after applying the configuration

Answer

The EncryptionConfiguration has a syntax error that caused it to be ignored

Question 8

Which TWO of the following are recommendations from the CIS Kubernetes Benchmark?

Accepted Answer

Enable audit logging. The CIS Kubernetes Benchmark recommends enabling audit logging to record all API server requests, which is essential for security monitoring and forensic analysis. It also recommends disabling anonymous authentication to ensure that all requests are authenticated, preventing unauthenticated access to the cluster.

Answer

Use TokenReview API for authentication

Answer

Set --protect-kernel-defaults=false on kubelet

Answer

Enable the insecure port for kubelet

Question 9

Which THREE of the following are valid flags for enabling admission plugins on the API server?

Accepted Answer

--enable-admission-plugins=AlwaysPullImages. `--enable-admission-plugins=AlwaysPullImages` is the valid flag to enable the AlwaysPullImages admission plugin on the kube-apiserver. This flag accepts a comma-separated list of plugin names, and AlwaysPullImages is a built-in admission controller that forces every new Pod to pull images again, even if they already exist on the node, enhancing security by ensuring only authorized images are used.

Answer

--plugin-dir=/admission

Answer

--admission-control=NodeRestriction

Question 10

You are using `crictl` to debug a container that is not responding. Which command should you use to get the list of running containers?

Accepted Answer

crictl ps. `crictl ps` is the correct command because it lists running containers managed by the CRI-compatible runtime (e.g., containerd, CRI-O). This is analogous to `docker ps` but for the Kubernetes container runtime interface, allowing you to see container IDs, names, and statuses for debugging.

Answer

crictl pods

Answer

crictl images

Answer

crictl stats

Question 11

You are securing etcd. Which of the following is required to enable TLS client authentication for etcd?

Accepted Answer

Set --client-cert-auth to true and provide --trusted-ca-file. Etcd requires `--client-cert-auth=true` to enforce TLS client certificate authentication for incoming client requests, and `--trusted-ca-file` must be provided to specify the CA certificate used to validate client certificates. Without both, client certificate authentication is not enabled.

Answer

Set --auto-tls to true

Answer

Set --peer-client-cert-auth to true

Answer

Use --cert-file and --key-file only

Question 12

A security team wants to ensure that all API requests to the cluster are authenticated and uses RBAC for authorization. Which two flags must be set on the kube-apiserver?

Accepted Answer

--anonymous-auth=false --authorization-mode=RBAC. Setting --anonymous-auth=false disables unauthenticated requests, ensuring all API calls require authentication, and --authorization-mode=RBAC enforces Role-Based Access Control for authorization. This combination aligns with the security team's requirement for authenticated and RBAC-authorized API requests, as RBAC is the standard Kubernetes authorization mode for fine-grained access control.

Answer

--anonymous-auth=false --authorization-mode=Webhook

Answer

--enable-admission-plugins=NodeRestriction --authorization-mode=AlwaysAllow

Answer

--anonymous-auth=true --authorization-mode=ABAC

Question 13

Which command loads an AppArmor profile from a file into the kernel?

Accepted Answer

apparmor_parser -r /path/to/profile. The `apparmor_parser` command loads AppArmor profiles into the kernel. The `-r` flag replaces an existing profile with the one from the specified file, ensuring the kernel enforces the updated rules. This is the standard method to load or reload AppArmor profiles from a profile file.

Answer

aa-enforce /path/to/profile

Answer

aa-status

Answer

modprobe apparmor

Question 14

You need to enable audit logging for the Kubernetes API server to capture all requests at the RequestResponse level. Which flag should you add to the kube-apiserver configuration?

Accepted Answer

--audit-policy-file=/etc/kubernetes/audit-policy.yaml. Audit-policy-file. This flag specifies the path to the audit policy file, which defines the rules for auditing. The other options are incorrect: --audit-log-path only sets the log file location, not the audit level; --audit-webhook-config-file is for sending audit events to a webhook; and --authorization-mode controls RBAC, not audit logging. To capture requests at RequestResponse level, the audit policy must specify that level, and the --audit-policy-file flag is required.

Answer

--audit-webhook-config-file=/etc/kubernetes/audit-webhook.yaml

Answer

--audit-log-path=/var/log/audit.log

Answer

--authorization-mode=RBAC

Question 15

Which THREE of the following are recommended actions to secure the Kubernetes Dashboard? (Choose three.)

Accepted Answer

Use RBAC to create a dedicated service account with minimal permissions. The Kubernetes Dashboard should be accessed using a dedicated service account with minimal permissions via RBAC. This follows the principle of least privilege, ensuring the dashboard only has the permissions necessary for its function, reducing the attack surface. By default, the dashboard's service account has minimal permissions, but binding it to a role with excessive privileges (like cluster-admin) would be a security risk.

Answer

Expose the Dashboard via an Ingress with a public domain

Answer

Enable HTTPS for Dashboard communications

Certified Kubernetes Security Specialist CKS practice test

Three ways to study

Study CKS by domain

Study CKS by topic

System Hardening practice questions

Minimize Microservice Vulnerabilities practice questions

Supply Chain Security practice questions

Monitoring, Logging and Runtime Security practice questions

Cluster Setup practice questions

Cluster Hardening practice questions

CKS fundamentals practice questions

CKS scenario practice questions

CKS troubleshooting practice questions

Top CKS questions

Certified Kubernetes Security Specialist CKS practice questions

How to use these CKS questions

Quick answer