mediumMultiple ChoiceObjective-mapped
CKS Practice Question: You run kube-bench on a node and it reports a…
You run kube-bench on a node and it reports a failure for 'Ensure that the --anonymous-auth argument is set to false' for the kubelet service. Which file must you modify to fix this?
⚠ Common exam trap
It's easy for candidates to confuse the kubelet's configuration file with the kubelet's kubeconfig file (`kubelet.conf`) or the API server manifest, because all three are involved in authentication but serve different roles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
/var/lib/kubelet/config.yaml
Kube-bench checks the kubelet configuration for the `--anonymous-auth` flag, which is set in the kubelet's configuration file. By default, the kubelet reads its configuration from `/var/lib/kubelet/config.yaml` (or a path specified by `--config` in the kubelet service). Setting `anonymous-auth: false` in this file disables anonymous requests to the kubelet API, enforcing authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
/etc/kubernetes/manifests/kube-apiserver.yaml
Why it's wrong here
This static pod manifest configures the kube-apiserver container, not the kubelet service. kube-bench's failing check pertains to the kubelet's own web server and its allowance of anonymous HTTP requests, which is controlled by the kubelet's configuration file or command-line flags. Editing the API server manifest would only affect API server authentication and would not disable anonymous access to the kubelet's /pods or /metrics endpoints.
- ✗
/etc/kubernetes/pki/ca.crt
Why it's wrong here
The CA certificate at this path is a PEM file used to validate TLS certificates, not a configuration file for service behavior. Whether anonymous authentication is enabled on the kubelet is a runtime setting that the kubelet reads from its config file or flags. Replacing or editing the CA certificate would not alter any authentication mode and could instead break TLS verification across the cluster, making it both ineffective and highly disruptive.
- ✗
/etc/kubernetes/kubelet.conf
Why it's wrong here
This kubeconfig file defines how the kubelet authenticates as a client to the API server, containing its client certificate, key, and server endpoint. It does not govern how the kubelet authenticates inbound requests to its own HTTP (kubelet) API. The anonymous-auth setting for the kubelet is separate and is found in the kubelet's own configuration structure (e.g., authentication.anonymous.enabled), not in any kubeconfig file.
- ✓
/var/lib/kubelet/config.yaml
Why this is correct
This is the kubelet's primary configuration file, where API server client settings, TLS options, and authentication policies are defined under well-known keys. To fix the kube-bench failure, the setting 'authentication.anonymous.enabled' must be set to 'false' in this YAML file, which disables anonymous access to the kubelet's web endpoints. This file is loaded via the kubelet's --config flag and is the standard, sources-of-truth location for kubelet behavior in modern Kubernetes distributions.
Go deeper
Related to this question
About these practice questions
This CKS question is part of Courseiva's 114-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.