CKS Practice Test

CKS practice test: what's covered

• Certified Kubernetes Security Specialist

Free CKS sample questions

1. During a CIS Benchmark assessment of a kubeadm cluster, you must audit the kubelet, API server, and etcd configuration against the documented controls and produce remediation guidance. Which tool runs these checks?

   • A. kube-bench, which maps each finding to a specific CIS Kubernetes Benchmark control and node component
   • B. Trivy, which scans container image layers for known CVEs but does not assess host config files
   • C. Falco, which streams runtime syscall events but cannot evaluate static benchmark controls
   • D. Polaris, which validates workload manifests against best practices rather than CIS node controls
   Show answer

   Correct: A. kube-bench inspects component flags and file permissions (kubelet, kube-apiserver, etcd, controller-manager) and reports PASS/FAIL/WARN per CIS control, so it is correct. Trivy is an image/filesystem vulnerability scanner, not a CIS config auditor. Falco watches runtime behavior, not static benchmark state. Polaris audits workload manifests for best practices, whereas CIS node-level controls are kube-bench's job.

2. An auditor flags that the kube-apiserver allows unauthenticated requests to be treated as the user system:anonymous. To harden the control plane and force every request through authentication, which API server flag should you set?

   • A. Set --anonymous-auth=false so the API server rejects requests that carry no valid credentials
   • B. Set --insecure-port=8080 to keep a fallback port available for cluster components
   • C. Set --authorization-mode=AlwaysAllow so RBAC never blocks legitimate controllers
   • D. Set --enable-bootstrap-token-auth=false to disable all token-based authentication paths
   Show answer

   Correct: A. --anonymous-auth=false disables the anonymous user, forcing authentication, which is the correct hardening step. --insecure-port=8080 would reopen an unauthenticated plaintext port (a serious regression and removed in newer versions). --authorization-mode=AlwaysAllow disables authorization entirely, the opposite of hardening. Disabling bootstrap-token auth does not address anonymous access and breaks node joins, so it is incorrect.

3. You are securing an Ingress resource that terminates TLS for a public service and want to follow CKS-aligned practices for certificate handling. Which configurations are appropriate? (Choose TWO)

   • A. Reference a kubernetes.io/tls Secret containing the cert and key under spec.tls in the Ingress
   • B. Use cert-manager with an ACME ClusterIssuer to automate issuance and renewal of certificates
   • C. Embed the private key directly in the Ingress annotations as a base64 plaintext string
   • D. Disable TLS and rely on the cloud load balancer's default self-signed certificate forever
   • E. Store the signing CA private key inside the same namespace ConfigMap for easy reuse
   Show answer

   Correct: A and B. Ingress TLS is configured by pointing spec.tls.secretName at a kubernetes.io/tls Secret, and cert-manager automates ACME issuance/renewal, so both are correct. Embedding a private key in annotations exposes it in plaintext and is wrong. Relying on a self-signed LB cert provides no trust and is incorrect. Storing a CA private key in a ConfigMap leaks it because ConfigMaps are not secret storage, so that option is wrong.

4. A new self-managed cluster will run on general-purpose Linux nodes. To reduce the host attack surface before joining nodes, which combination best reflects node hardening guidance from the CKS curriculum?

   • A. Disable unused services and kernel modules, enforce AppArmor or SELinux, enable host audit logging, and patch regularly
   • B. Install every available package up front so future workloads never lack a dependency at runtime
   • C. Grant all cluster users passwordless sudo so operators can troubleshoot nodes without delay
   • D. Open inbound firewall rules to 0.0.0.0/0 on all ports to avoid intermittent connectivity issues
   Show answer

   Correct: A. Minimizing services/modules, enforcing mandatory access control, auditing, and patching are the canonical node-hardening steps, so the first option is correct. Installing every package enlarges the attack surface and is wrong. Passwordless sudo for all users destroys least privilege and is incorrect. Opening all ports to the internet is the opposite of hardening, so it is wrong.

5. A namespace team's deployment pipeline was bound to a ClusterRole granting verbs * on resources * cluster-wide. Applying least-privilege RBAC, what is the most appropriate remediation?

   • A. Replace it with a namespace-scoped Role granting only the specific verbs and resources the pipeline needs, bound via a RoleBinding
   • B. Bind the pipeline ServiceAccount to the built-in cluster-admin ClusterRole to avoid permission errors
   • C. Add the ServiceAccount to the system:masters group so requests bypass RBAC evaluation entirely
   • D. Leave the wildcard ClusterRole but rename it so audits no longer flag the binding by name
   Show answer

   Correct: A. Least privilege means scoping permissions to the exact verbs/resources in one namespace via a Role + RoleBinding, so the first option is correct. Binding to cluster-admin grants full control and is the opposite of least privilege. Adding to system:masters bypasses RBAC and is dangerous, so it is wrong. Renaming the ClusterRole hides the issue without reducing privilege, which is incorrect.

Last updated: 2026-10-19

CKS practice test FAQ