PRO-CKS

الاختبار النهائي — أخصائي معتمد في أمن Kubernetes (CKS) — تحضير الامتحان

أجب عن الأسئلة الـ45. تحتاج إلى 80% أو أكثر للنجاح. يمكنك إعادة المحاولة كلما أردت.

هذا الاختبار النهائي متاح بـالإنجليزية.

السؤال 1Which three CKS domains together account for roughly 60% of the exam score?Cluster Setup, Cluster Hardening, System HardeningNetworking, Storage, SchedulingMinimize Microservice Vulnerabilities, Supply Chain Security, Monitoring/Logging/Runtime SecurityInstallation, Troubleshooting, Logging

السؤال 2Which prerequisite certification must you hold before taking the CKS exam?CKADKCNACKA (Certified Kubernetes Administrator)AWS Security Specialty

السؤال 3What tool implements the CIS Kubernetes Benchmark as automated checks?kube-benchkube-proxykubeadmkubectl drain

السؤال 4By default, how can pods communicate in a cluster with no NetworkPolicies?Only within the same namespaceEvery pod can reach every other pod (flat, open network)No pod can reach any other podOnly via the API server

السؤال 5What does a 'default-deny' NetworkPolicy use to block all traffic?A wildcard IP block of 0.0.0.0/0 with allow rulesAn admission webhookA ClusterRole bound to all podsAn empty podSelector with policyTypes set and no rules

السؤال 6When applying a default-deny-egress policy, what must you still allow to avoid breaking name resolution?Ingress from the internetEgress to kube-dns on port 53Egress to the cloud metadata IPAll TCP on port 443

السؤال 7Which two keys must a kubernetes.io/tls Secret contain?tls.crt and tls.keyusername and passwordca.crt and tokencert.pem and id_rsa

السؤال 8Which API server flag disables unauthenticated anonymous requests?--insecure-port=0--enable-admission-plugins=NodeRestriction--anonymous-auth=false--audit-log-path=/var/log/audit.log

السؤال 9Where does the kube-apiserver static pod manifest live on the control plane?/var/lib/kubelet/config.yaml/etc/kubernetes/admin.conf/etc/kubernetes/manifests/kube-apiserver.yaml/opt/kubernetes/apiserver.yaml

السؤال 10A kubelet that returns the pod list from https://NODE:10250/pods without credentials indicates what?etcd is unencryptedThe cluster is correctly hardenedRBAC is disabled cluster-wideAnonymous authentication is enabled (a finding)

السؤال 11Which kubelet setting forces the API server to authorize kubelet requests?authorization.mode: AlwaysAllowauthentication.anonymous.enabled: trueauthorization.mode: WebhookreadOnlyPort: 10255

السؤال 12Which four RBAC objects grant and assign permissions in Kubernetes?Role, ClusterRole, RoleBinding, ClusterRoleBindingUser, Group, Policy, BindingSubject, Verb, Resource, ScopePod, ServiceAccount, Secret, ConfigMap

السؤال 13Which command verifies exactly what a ServiceAccount is allowed to do?kubectl describe sakubectl auth can-i --list --as=system:serviceaccount:NS:SAkubectl get rolebindings -Akubectl top sa

السؤال 14What does setting automountServiceAccountToken: false achieve?It deletes the ServiceAccountIt enables anonymous accessIt grants cluster-admin to the podIt prevents the SA token from being mounted into the pod

السؤال 15Which technique stops pods from stealing a node's cloud credentials via the metadata service?Enabling the Kubernetes DashboardRunning kube-benchMounting the SA token as a fileA NetworkPolicy blocking egress to 169.254.169.254

السؤال 16What does seccomp filter for a container?Network portsDisk quotasLinux system calls (syscalls)DNS queries

السؤال 17Which seccompProfile type applies the container runtime's curated default profile?RuntimeDefaultUnconfinedLocalhostPrivileged

السؤال 18AppArmor is best described as which kind of Linux control?A network firewallA Mandatory Access Control (MAC) moduleA container runtimeA package manager

السؤال 19Which securityContext setting prevents a process from gaining more privileges than its parent?runAsNonRoot: falsehostNetwork: trueprivileged: trueallowPrivilegeEscalation: false

السؤال 20What is the most hardened of the three Pod Security Standards levels?PrivilegedRestrictedBaselineDefault

السؤال 21How is a Pod Security Standard enforced per namespace?A ClusterRole bindingA label such as pod-security.kubernetes.io/enforce: restrictedAn etcd snapshotA kube-bench profile

السؤال 22Which Pod Security Admission mode logs/warns about violations without blocking pods?enforcedenyprivilegedaudit or warn

السؤال 23By default, how are Kubernetes Secrets stored in etcd?AES-256 encryptedOnly base64-encoded (not encrypted)Hashed with bcryptIn plaintext but signed

السؤال 24How do you protect Secrets stored in etcd from disk-level disclosure?Enable encryption at rest via an EncryptionConfigurationBase64-encode them twiceMount them as environment variablesGrant get/list to all users

السؤال 25Which is generally safer for exposing secrets to a container?Environment variablesMounted secret files (volumes)Command-line argumentsConfigMap data

السؤال 26Which sandboxed runtime intercepts syscalls in a userspace kernel?containerdCRI-ODockergVisor (runsc)

السؤال 27How does a pod select a sandboxed runtime such as gVisor?Setting hostPID: trueSetting runtimeClassName referencing a RuntimeClassAdding a NetworkPolicyLabelling the namespace privileged

السؤال 28Which tool is commonly used in the CKS to scan container images for known CVEs?TrivyHelmkubectl proxyPrometheus

السؤال 29Which base-image choice reduces an image's vulnerable package count the most?A full Ubuntu imageAn image with build tools includedThe latest tag of any imageA minimal/distroless base image

السؤال 30What is a Software Bill of Materials (SBOM)?A machine-readable inventory of all components/versions in an artifactA signed admission policyA network packet captureAn RBAC role definition

السؤال 31Which tool cryptographically signs and verifies container images?kube-proxyCosign (Sigstore)etcdctlcalicoctl

السؤال 32Where in the request lifecycle do admission controllers act?Before authenticationAfter authN/authZ but before the object is persistedOnly at pod deletionInside the kubelet

السؤال 33Which policy engines are commonly used to restrict allowed image registries?Flannel or Calicokube-proxy or CoreDNSOPA Gatekeeper or KyvernoPrometheus or Grafana

السؤال 34Which tool scores a Kubernetes manifest and flags insecure fields?etcdctlkubectl logskubeseccrictl

السؤال 35What is the CNCF project for runtime threat detection via syscall analysis?FalcoFluentdFluxFlannel

السؤال 36A Falco alert about a shell spawned inside a container is an example of detecting what?A normal scheduled jobA successful image scanSuspicious runtime behaviour (possible compromise)A passing CIS benchmark

السؤال 37Which two flags enable API server audit logging?--audit-policy-file and --audit-log-path--anonymous-auth and --insecure-port--cert-dir and --key-file--enable-falco and --log-level

السؤال 38Which audit level records request and response bodies for an event?NoneMetadataRequestResponseRequest

السؤال 39In what order are audit policy rules evaluated?Random orderAlphabetically by resourceBottom-up, last match winsTop-down, first match wins

السؤال 40Which securityContext field makes a container's root filesystem immutable?privileged: truehostIPC: truereadOnlyRootFilesystem: truerunAsUser: 0

السؤال 41With a read-only root filesystem, how do you allow an app to write to /tmp?Mount a writable emptyDir volume at /tmpSet privileged: trueDisable seccompGrant cluster-admin

السؤال 42What does mTLS provide between two services?Faster networking without TLSOnly server-side encryptionPlaintext but signed messagesMutual certificate authentication and encrypted traffic

السؤال 43Which command creates a backup snapshot of etcd?etcdctl snapshot savekubectl drain etcdkube-bench backupcrictl save

السؤال 44Which flags does etcdctl need to talk to a TLS-secured etcd?--cacert, --cert and --key (with --endpoints)--user and --password--insecure-skip-tls-verify only--token

السؤال 45During the exam, what should you do before starting each task?Reboot the nodeRun kube-bench on every nodeDelete all NetworkPoliciesSwitch to the correct kubectl context for that task

الاختبار النهائي — أخصائي معتمد في أمن Kubernetes (CKS) — تحضير الامتحان

هل دفعت بالفعل؟