PRO-CKS

Final check — Certified Kubernetes Security Specialist (CKS) — Exam-Prep

Answer the 45 questions. You need 80% or more to pass. You can retry as many times as you like.

Question 1Which three CKS domains together account for roughly 60% of the exam score?Cluster Setup, Cluster Hardening, System HardeningNetworking, Storage, SchedulingMinimize Microservice Vulnerabilities, Supply Chain Security, Monitoring/Logging/Runtime SecurityInstallation, Troubleshooting, Logging

Question 2Which prerequisite certification must you hold before taking the CKS exam?CKADKCNACKA (Certified Kubernetes Administrator)AWS Security Specialty

Question 3What tool implements the CIS Kubernetes Benchmark as automated checks?kube-benchkube-proxykubeadmkubectl drain

Question 4By default, how can pods communicate in a cluster with no NetworkPolicies?Only within the same namespaceEvery pod can reach every other pod (flat, open network)No pod can reach any other podOnly via the API server

Question 5What does a 'default-deny' NetworkPolicy use to block all traffic?A wildcard IP block of 0.0.0.0/0 with allow rulesAn admission webhookA ClusterRole bound to all podsAn empty podSelector with policyTypes set and no rules

Question 6When applying a default-deny-egress policy, what must you still allow to avoid breaking name resolution?Ingress from the internetEgress to kube-dns on port 53Egress to the cloud metadata IPAll TCP on port 443

Question 7Which two keys must a kubernetes.io/tls Secret contain?tls.crt and tls.keyusername and passwordca.crt and tokencert.pem and id_rsa

Question 8Which API server flag disables unauthenticated anonymous requests?--insecure-port=0--enable-admission-plugins=NodeRestriction--anonymous-auth=false--audit-log-path=/var/log/audit.log

Question 9Where does the kube-apiserver static pod manifest live on the control plane?/var/lib/kubelet/config.yaml/etc/kubernetes/admin.conf/etc/kubernetes/manifests/kube-apiserver.yaml/opt/kubernetes/apiserver.yaml

Question 10A kubelet that returns the pod list from https://NODE:10250/pods without credentials indicates what?etcd is unencryptedThe cluster is correctly hardenedRBAC is disabled cluster-wideAnonymous authentication is enabled (a finding)

Question 11Which kubelet setting forces the API server to authorize kubelet requests?authorization.mode: AlwaysAllowauthentication.anonymous.enabled: trueauthorization.mode: WebhookreadOnlyPort: 10255

Question 12Which four RBAC objects grant and assign permissions in Kubernetes?Role, ClusterRole, RoleBinding, ClusterRoleBindingUser, Group, Policy, BindingSubject, Verb, Resource, ScopePod, ServiceAccount, Secret, ConfigMap

Question 13Which command verifies exactly what a ServiceAccount is allowed to do?kubectl describe sakubectl auth can-i --list --as=system:serviceaccount:NS:SAkubectl get rolebindings -Akubectl top sa

Question 14What does setting automountServiceAccountToken: false achieve?It deletes the ServiceAccountIt enables anonymous accessIt grants cluster-admin to the podIt prevents the SA token from being mounted into the pod

Question 15Which technique stops pods from stealing a node's cloud credentials via the metadata service?Enabling the Kubernetes DashboardRunning kube-benchMounting the SA token as a fileA NetworkPolicy blocking egress to 169.254.169.254

Question 16What does seccomp filter for a container?Network portsDisk quotasLinux system calls (syscalls)DNS queries

Question 17Which seccompProfile type applies the container runtime's curated default profile?RuntimeDefaultUnconfinedLocalhostPrivileged

Question 18AppArmor is best described as which kind of Linux control?A network firewallA Mandatory Access Control (MAC) moduleA container runtimeA package manager

Question 19Which securityContext setting prevents a process from gaining more privileges than its parent?runAsNonRoot: falsehostNetwork: trueprivileged: trueallowPrivilegeEscalation: false

Question 20What is the most hardened of the three Pod Security Standards levels?PrivilegedRestrictedBaselineDefault

Question 21How is a Pod Security Standard enforced per namespace?A ClusterRole bindingA label such as pod-security.kubernetes.io/enforce: restrictedAn etcd snapshotA kube-bench profile

Question 22Which Pod Security Admission mode logs/warns about violations without blocking pods?enforcedenyprivilegedaudit or warn

Question 23By default, how are Kubernetes Secrets stored in etcd?AES-256 encryptedOnly base64-encoded (not encrypted)Hashed with bcryptIn plaintext but signed

Question 24How do you protect Secrets stored in etcd from disk-level disclosure?Enable encryption at rest via an EncryptionConfigurationBase64-encode them twiceMount them as environment variablesGrant get/list to all users

Question 25Which is generally safer for exposing secrets to a container?Environment variablesMounted secret files (volumes)Command-line argumentsConfigMap data

Question 26Which sandboxed runtime intercepts syscalls in a userspace kernel?containerdCRI-ODockergVisor (runsc)

Question 27How does a pod select a sandboxed runtime such as gVisor?Setting hostPID: trueSetting runtimeClassName referencing a RuntimeClassAdding a NetworkPolicyLabelling the namespace privileged

Question 28Which tool is commonly used in the CKS to scan container images for known CVEs?TrivyHelmkubectl proxyPrometheus

Question 29Which base-image choice reduces an image's vulnerable package count the most?A full Ubuntu imageAn image with build tools includedThe latest tag of any imageA minimal/distroless base image

Question 30What is a Software Bill of Materials (SBOM)?A machine-readable inventory of all components/versions in an artifactA signed admission policyA network packet captureAn RBAC role definition

Question 31Which tool cryptographically signs and verifies container images?kube-proxyCosign (Sigstore)etcdctlcalicoctl

Question 32Where in the request lifecycle do admission controllers act?Before authenticationAfter authN/authZ but before the object is persistedOnly at pod deletionInside the kubelet

Question 33Which policy engines are commonly used to restrict allowed image registries?Flannel or Calicokube-proxy or CoreDNSOPA Gatekeeper or KyvernoPrometheus or Grafana

Question 34Which tool scores a Kubernetes manifest and flags insecure fields?etcdctlkubectl logskubeseccrictl

Question 35What is the CNCF project for runtime threat detection via syscall analysis?FalcoFluentdFluxFlannel

Question 36A Falco alert about a shell spawned inside a container is an example of detecting what?A normal scheduled jobA successful image scanSuspicious runtime behaviour (possible compromise)A passing CIS benchmark

Question 37Which two flags enable API server audit logging?--audit-policy-file and --audit-log-path--anonymous-auth and --insecure-port--cert-dir and --key-file--enable-falco and --log-level

Question 38Which audit level records request and response bodies for an event?NoneMetadataRequestResponseRequest

Question 39In what order are audit policy rules evaluated?Random orderAlphabetically by resourceBottom-up, last match winsTop-down, first match wins

Question 40Which securityContext field makes a container's root filesystem immutable?privileged: truehostIPC: truereadOnlyRootFilesystem: truerunAsUser: 0

Question 41With a read-only root filesystem, how do you allow an app to write to /tmp?Mount a writable emptyDir volume at /tmpSet privileged: trueDisable seccompGrant cluster-admin

Question 42What does mTLS provide between two services?Faster networking without TLSOnly server-side encryptionPlaintext but signed messagesMutual certificate authentication and encrypted traffic

Question 43Which command creates a backup snapshot of etcd?etcdctl snapshot savekubectl drain etcdkube-bench backupcrictl save

Question 44Which flags does etcdctl need to talk to a TLS-secured etcd?--cacert, --cert and --key (with --endpoints)--user and --password--insecure-skip-tls-verify only--token

Question 45During the exam, what should you do before starting each task?Reboot the nodeRun kube-bench on every nodeDelete all NetworkPoliciesSwitch to the correct kubectl context for that task

Final check — Certified Kubernetes Security Specialist (CKS) — Exam-Prep

Already paid?