CKS practice questions and answers

Correct answer: A — Events are short-lived and incomplete, so they supplement rather than replace audit logs

Events expire after a short TTL and only cover what controllers choose to emit, so audit logging remains the authoritative record. They are neither complete, permanent, nor inclusive of request and response payloads.

Correct answer: A — An imagePullSecret scoped to the namespace, or workload identity integration with the registry

Namespaced pull secrets or federated workload identity keep registry credentials scoped and rotatable. Baking a password into node images, enabling anonymous pull, and committing credentials all leak or over-share the secret.

Correct answer: A — runAsNonRoot true, allowPrivilegeEscalation false, capabilities drop ALL, seccompProfile RuntimeDefault

That combination is exactly what the restricted profile requires: non-root, no escalation, no capabilities, and the default seccomp filter. The other options request privileged execution, host namespaces, or added capabilities, all of which the profile forbids.

Correct answer: A, B — Prefer namespaced Roles over ClusterRoles when access is confined to one namespace · Avoid granting wildcard verbs and resources

Scoping to a namespace and avoiding wildcards keep permissions close to what is actually needed. Cluster-admin for developers, broad default service accounts, and handing out escalate and bind all enable privilege escalation.

Correct answer: A — IfNotPresent combined with a mutable tag such as latest

With IfNotPresent, a node that already cached an older image for the same mutable tag will keep running it, so different nodes can serve different code. Digest pinning removes the ambiguity entirely, and Always with a versioned tag at least refetches on each start.

Correct answer: A — A policy with an empty podSelector, policyTypes Ingress, and no ingress rules

An empty podSelector selects every Pod in the namespace, and declaring Ingress in policyTypes with no rules means nothing is allowed. Allowing all sources is the opposite, deleting policies restores the permissive default, and quotas do not affect traffic.

Correct answer: A — NetworkPolicies per namespace with a default deny and explicit allows using namespace selectors

Pod-to-Pod reachability is governed by NetworkPolicies, so a default-deny baseline with explicit selectors is what isolates tenants at the network layer. Quotas and LimitRanges govern resource consumption, and registry choice does not affect traffic.

Correct answer: A — A shell process starting inside a container that normally runs a single application process

An interactive shell in a container that should only run one application process is a classic post-exploitation signal. Log writes, successful probes, and routine scaling are normal operations.

Correct answer: A — Set automountServiceAccountToken to false on the Pod or the service account

Disabling automatic token mounting removes a credential the workload does not need, shrinking what an attacker gains from a container compromise. Deleting the default service account breaks Pod admission, granting view adds unnecessary access, and host networking increases exposure.

Correct answer: A — API server audit logging with an audit policy and a durable log backend

Audit logging records the requester, verb, resource, and outcome for API requests according to the configured policy. Events are short-lived and incomplete, container logs cover application output, and metrics are aggregate numbers.

Correct answer: A — Set authentication anonymous enabled to false and authorization mode to Webhook

Disabling anonymous authentication and delegating authorisation to the API server via webhook mode is the standard kubelet hardening. Enabling the read-only port exposes data without authentication, and swap and pod limits are unrelated to access control.

Correct answer: A — Remove unnecessary packages and services from the node image and disable unused ports

A minimal node image gives an attacker fewer tools and fewer listening services to pivot through. Extra tooling, open SSH, and privileged workloads all make lateral movement easier.

Correct answer: A — Kata Containers, selected through a RuntimeClass

Kata Containers runs Pods in micro virtual machines so the kernel is not shared with the host, and Kubernetes selects it through a RuntimeClass. runc-based runtimes share the host kernel, and host networking removes network isolation rather than adding any.

Correct answer: A, B — Restrict network access to the API server endpoint to known ranges or private networks · Keep the cluster version patched and upgrade regularly

Limiting who can reach the endpoint and staying patched are two of the highest-value control plane protections. An insecure port, AlwaysAllow authorisation, and disabling TLS each remove a fundamental security control.

Correct answer: A — readOnlyRootFilesystem set to true, with writable emptyDir volumes only where needed

A read-only root filesystem prevents an attacker from dropping tools into the container, with narrowly scoped writable volumes for legitimate scratch space. Privileged mode, host mounts, and permitted escalation all increase what an attacker can do.

Correct answer: A — Trivy

Trivy scans images, filesystems, and manifests for known CVEs and misconfigurations and returns a non-zero exit code for gating. etcdctl administers etcd, kube-proxy handles Service networking, and port-forward tunnels a port.

Correct answer: A — It requires an EncryptionConfiguration on the API server, and existing Secrets must be rewritten to be encrypted

Encryption at rest is configured on the API server, and already-stored Secrets stay in their previous form until they are rewritten. It is not universally on by default, base64 is only an encoding, and the kubelet is not where this is configured.

Correct answer: A — RequestResponse

RequestResponse is the most verbose level and captures metadata, the request body, and the response body. Metadata records only who did what and when, Request adds the request body, and None omits the event entirely.

Correct answer: A — Use a minimal or distroless base image containing only the runtime dependencies

Fewer packages means fewer CVEs, which is why minimal and distroless bases dramatically reduce findings. Full distributions and extra utilities add packages, and pinning to a very old base accumulates unpatched vulnerabilities.

Correct answer: A — RBAC, optionally combined with Node and Webhook modes

RBAC grants permissions explicitly and is typically combined with the Node authorizer for kubelets and optionally a webhook. AlwaysAllow removes authorisation, AlwaysDeny alone would break the cluster, and leaving it unset is not a secure posture.

Correct answer: A — Do not create an Ingress for it and restrict access with a ClusterIP Service plus NetworkPolicies

An internal service should stay on a ClusterIP with NetworkPolicies restricting which Pods may reach it, and never be published through an ingress controller. Wildcard Ingress rules, node ports, and public load balancers all create external reachability.

Correct answer: A — A seccomp profile applied through the Pod's securityContext

seccomp filters syscalls at the kernel level, and the RuntimeDefault profile or a custom profile can be set in the security context. NetworkPolicies filter traffic, quotas cap resources, and disruption budgets limit evictions.

Correct answer: A — Reference images by immutable digest rather than by mutable tag

A digest is a content hash, so pinning to it guarantees identical bits between scan and runtime. Mutable tags, deploy-time rebuilds, and tag overwriting all break the link between what was approved and what runs.

Correct answer: A — Use short-lived projected service account tokens with an audience and expiry rather than long-lived Secret-based tokens

Projected tokens are bound to a Pod, scoped to an audience, and expire, so a leaked token has a small window and narrow use. Permanent token Secrets, shared identities, and broad roles all increase what a stolen credential is worth.

Correct answer: A, B — Egress connection records from the Pod to unexpected external destinations · Runtime alerts for unexpected process execution and file reads in the container

Outbound connection records and runtime process and file activity are what reveal data leaving the workload. Revision history, image build dates, and quota usage say nothing about exfiltration.

Correct answer: A — AppArmor

AppArmor profiles restrict file paths, capabilities, and other operations for a confined process, and Kubernetes can apply a named profile to a container. iptables filters packets, cgroups limit resources, and systemd manages services.

Correct answer: A, B — Reject manifests that request privileged containers or host namespaces · Fail the build when containers omit resource limits or run as root

Static analysis catches dangerous specifications before they reach a cluster, and privileged execution and missing limits or root users are the classic checks. Granting cluster-admin, skipping production, and disabling admission control all remove protection rather than adding it.

Correct answer: A — An audit policy with per-resource rules, such as RequestResponse for Secrets and Metadata for routine reads

A tiered policy records full detail where it matters and minimal detail elsewhere, which is how audit stays both useful and affordable. Logging everything at full detail is expensive and can capture secret material broadly, and excluding Secrets or logging nothing removes the most important signal.

Correct answer: A, B — API server audit logs showing what the Pod's service account requested · Runtime security alerts showing what processes ran inside the container

Audit logs cover what the workload asked the cluster to do and runtime alerts cover what it did inside the container, which together span both planes. Resource settings, image size, and kernel version are configuration facts rather than activity records.

Correct answer: A — Image signing and attestation verified at admission

Signatures and build attestations, checked by an admission policy, provide verifiable provenance. Labels are unverified metadata, a private registry restricts access without proving origin, and tag naming carries no cryptographic meaning.

Correct answer: A — Because newly disclosed vulnerabilities in base image packages are only fixed by rebuilding on a patched base

An unchanged image accumulates vulnerabilities as CVEs are published against its packages, so periodic rebuilds on a patched base are the remedy. Kubernetes does not expire images, digests are immutable, and the scheduler does not consider image age.

Correct answer: A, B — Require client certificate authentication and TLS for all etcd connections · Enable encryption at rest for Secrets in the API server's encryption configuration

Mutual TLS restricts who can talk to etcd, and API server encryption at rest means Secret values are not stored in plaintext. Public exposure and anonymous access hand the cluster's entire state to an attacker, and disabling backups trades recoverability for nothing.

Correct answer: A, B — Ship logs off the node to a central, access-controlled backend in near real time · Restrict who can modify or delete the log backend's data

Getting logs off the compromised host quickly and protecting the destination are what keep evidence intact. Local-only logs are deleted by an attacker, broad write access lets logs be tampered with, and disabling audit logging removes the record when it matters most.

Correct answer: A — kubectl auth can-i delete pods --as=system:serviceaccount:ns:sa -n ns

auth can-i with impersonation evaluates the effective permissions for that identity, which is far more reliable than reading bindings by hand. Listing bindings requires manual correlation, describing a Pod shows its status, and api-versions lists API groups.

Correct answer: A — An external secrets manager accessed through a CSI driver or an operator that injects values at runtime

An external store with a CSI driver or injecting operator keeps the authoritative secret outside the cluster and delivers it to the Pod at runtime. Committed base64 is plaintext to anyone with repository access, ConfigMaps are not for sensitive data, and command-line arguments are visible in the manifest and process list.

Correct answer: A — A webhook backend with buffering and appropriate batch settings, plus a local log backend as a durable fallback

Buffered delivery plus a durable local log means transient backend outages do not silently drop events. Disabling auditing and setting every rule to None stop recording entirely, and an emptyDir volume disappears with the Pod.

Correct answer: A — capabilities: drop [ALL], add [NET_BIND_SERVICE]

Dropping all capabilities and adding back exactly one gives the process the minimum kernel privilege it needs. Privileged mode grants everything, adding ALL is the opposite of least privilege, and running as root without capability configuration keeps the default set.

Correct answer: A — Investigate the alerting Pod and the process that performed the write before deciding to isolate or tune the rule

Triage comes first: identify the Pod and process so you can tell a genuine compromise from a legitimate but noisy behaviour that warrants a tuned rule. Mass deletion and cluster restarts destroy evidence and cause outages, and silencing the rule removes the detection.

Correct answer: A, B — A service mesh sidecar proxy that terminates and originates mTLS · A mesh policy that requires strict mTLS for the namespace

Sidecar proxies plus a strict mTLS policy give encryption and workload identity transparently to the application. A NetworkPolicy only permits or denies traffic without encrypting it, quotas govern resources, and ingress annotations concern north-south traffic.

Correct answer: A — Track supported minor versions and apply patch releases promptly, testing in a non-production cluster first

Staying within supported versions and applying patches after testing keeps known CVEs closed without surprising production. Never upgrading accumulates vulnerabilities, upgrading production first exposes users to regressions, and skipping minor versions is unsupported.

Correct answer: A — Pod Security Admission with namespace labels in enforce mode

Pod Security Admission reads namespace labels to apply the privileged, baseline, or restricted profile, and enforce mode rejects non-conforming Pods. LimitRanges and quotas govern resources, and taints influence scheduling.

Correct answer: A — A policy engine rule that rejects Pods whose image reference does not start with the approved registry prefix

Validating admission policy inspects the image reference and rejects non-approved sources before the Pod is created. Egress policy can help defence in depth but does not prevent object creation, and limits and labels do not evaluate image references.

Correct answer: A — Immutable tags enabled on the repository

Immutable tags reject a push that would overwrite an existing tag, which preserves the meaning of a tag over time. Anonymous pull affects access, untagged cleanup is garbage collection, and quota is capacity.

Correct answer: A, B — It allows the Pod to start privileged containers on the node · It effectively grants root-equivalent access to the host

Access to the runtime socket lets a container create arbitrary containers, including privileged ones with host mounts, which is equivalent to owning the node. It has no effect on logging, DNS, or scheduling.

Correct answer: A, B — Scan dependencies and the built image, failing the build above an agreed severity · Sign the built artefact and publish provenance attestations

Scanning with a failure threshold and signing with provenance are the two controls that make an artefact both assessed and attributable. Fetching arbitrary scripts, committing signing keys, and removing branch protection each open a supply chain attack path.

Correct answer: A — --anonymous-auth=false on kube-apiserver

Disabling anonymous authentication ensures unauthenticated requests are not mapped to the system anonymous user. Allowing privileged containers weakens workload isolation, an insecure port would bypass authentication entirely, and AlwaysAllow disables authorisation.

Correct answer: A — RBAC that grants Secret access only within the workload's own namespace

Secret access is an API authorisation question, so namespaced RBAC is what enforces the boundary. NetworkPolicies control Pod-to-Pod traffic rather than API reads, and LimitRanges and taints govern resources and scheduling.

Correct answer: A — A Secret of type kubernetes.io/tls

TLS Secrets are the designated object for certificate and key material and are referenced by the Ingress tls section. ConfigMaps are for non-sensitive data, annotations are metadata, and PersistentVolumes are storage.

Correct answer: A — A validating admission webhook or a policy engine such as OPA Gatekeeper or Kyverno

Validating admission control rejects non-compliant objects at creation time, which is prevention rather than cleanup. A CronJob deleting Pods afterwards means the workload ran, and LimitRanges and disruption budgets govern resources and evictions.

Correct answer: A, B — Require authentication and bind it to a minimally privileged service account · Keep it off the public internet, reachable only through port-forward or an internal path

Authentication with least privilege and no public exposure are the two controls that matter for an admin UI. Cluster-admin turns a UI compromise into a cluster compromise, public exposure invites it, and disabling audit logs removes the evidence.

Correct answer: A — restricted

The restricted profile is the hardened standard and enforces non-root execution, no privilege escalation, dropped capabilities, and a limited set of volume types. Baseline blocks only known privilege escalations, privileged is unrestricted, and there is no profile named default.

Correct answer: A — Runtime monitoring that alerts when new executables appear or are run inside a container

Drift detection needs a runtime view of what is actually executing, which is what behavioural monitoring provides. Manifests, selectors, and labels describe intended configuration rather than what is running inside the container.

Correct answer: A — Apply a NetworkPolicy isolating the Pod, then capture logs and a filesystem snapshot before deleting it

Isolating first stops further damage while the container is still available for evidence collection. Deleting, rebooting, and scaling all destroy the running state before anything has been captured.

Correct answer: A — Schedule those Pods to a sandboxed runtime such as gVisor or Kata through a dedicated RuntimeClass

A sandboxed runtime interposes an extra isolation boundary between untrusted code and the host kernel, which is the point of RuntimeClass here. Privileged execution, node credentials, and disabled seccomp all weaken the boundary instead.

Correct answer: A, B — It lists the components and versions the image contains · It enables rapid impact assessment when a new CVE is published

An SBOM is an inventory that makes it possible to answer whether a newly disclosed vulnerability affects an image. It does not certify that an image is vulnerability free, it does not replace runtime controls, and modern SBOM formats cover application dependencies as well as OS packages.

Correct answer: A — Block egress to the metadata IP with a NetworkPolicy and use per-workload identity instead of node credentials

Blocking the metadata address and issuing workload-scoped identities removes the path by which a container inherits the node's cloud permissions. Sharing the node role, host networking, and removing policies all make the exposure worse.

Correct answer: A — escalate and bind on roles and rolebindings

escalate lets a principal create a role with permissions beyond its own, and bind lets it attach an existing powerful role, so both are privilege escalation paths. Reading Pods, watching ConfigMaps, and patching events are comparatively low risk.

Correct answer: A — type: RuntimeDefault in seccompProfile

RuntimeDefault applies the runtime's curated syscall allowlist, which blocks many dangerous calls with little compatibility risk. Unconfined disables filtering, and the other two settings expand privilege rather than restricting syscalls.

Correct answer: A, B — Drop all capabilities and add back only the ones required · Set readOnlyRootFilesystem to true

A minimal capability set and an immutable root filesystem both constrain what a compromised process can do. Sharing the host PID namespace, mounting the container runtime socket, and running as root each provide a direct path to host compromise.

Correct answer: A — kube-bench

kube-bench runs the CIS Benchmark checks against control plane and node configuration and reports pass, fail, and warn results. kube-proxy programs Service networking, kubeadm bootstraps clusters, and kubectl top shows resource usage.