Linux Foundation / CNCF CKS: Certified Kubernetes Security Specialist

Last checked October 22, 2026 against the official Linux Foundation / CNCF exam page.

1. Question 1Monitoring, Logging and Runtime Security

   A security engineer wants an alert when a shell is started inside a running container. Which open-source runtime security tool detects this kind of behaviour?

   1. Akube-bench
   2. Betcdctl
   3. CTrivy
   4. DFalco
   Show answer and explanationHide answer

   Correct answer: D

   Falco watches system calls and Kubernetes events and raises alerts on suspicious behaviour, such as an interactive shell spawned in a container. Kube-bench checks configuration, Trivy scans images, and etcdctl is a database client.

2. Question 2Minimize Microservice Vulnerabilities

   A namespace must enforce the restricted Pod Security Standard so that non-compliant pods are rejected at creation. Which label should be applied to the namespace?

   1. Apodsecuritypolicy.kubernetes.io/enforce=restricted
   2. Bpod-security.kubernetes.io/enforce=restricted
   3. Csecurity.policy/restricted-mode=true
   4. Dpod-security.kubernetes.io/audit=restricted
   Show answer and explanationHide answer

   Correct answer: B

   The enforce mode label rejects pods that violate the chosen Pod Security Standard. The audit label only records violations, and the other two labels are not recognised by Pod Security Admission, because PodSecurityPolicy has been removed from Kubernetes.

3. Question 3Supply Chain Security

   A security team needs a software bill of materials for each container image to track which packages it contains. Which open-source tool generates this inventory?

   1. Akube-hunter
   2. BFalco
   3. Ckube-bench
   4. DSyft
   Show answer and explanationHide answer

   Correct answer: D

   Syft catalogs packages and produces SBOMs in formats such as SPDX and CycloneDX. Falco detects runtime behaviour, kube-bench checks cluster configuration against CIS benchmarks, and kube-hunter probes a cluster for weaknesses.

4. Question 4Cluster Hardening

   A service account named report-reader in the dev namespace must only list and get pods, and only inside dev. Which combination grants exactly that?

   1. AA Role in dev allowing get and list on pods, plus a RoleBinding in dev that binds it to the service account
   2. BA ClusterRoleBinding that grants the built-in cluster-admin ClusterRole to the service account
   3. CA ClusterRole with wildcard verbs on pods, bound with a ClusterRoleBinding to the whole cluster
   4. DA Role created in kube-system with get and list on pods, bound to the service account by a RoleBinding
   Show answer and explanationHide answer

   Correct answer: A

   A namespaced Role with the minimal verbs and a RoleBinding in the same namespace limits the grant to dev. A ClusterRoleBinding would grant the rights in every namespace, and a Role in kube-system does not apply to pods in dev at all.

5. Question 5System Hardening

   A team wants a container to run under an AppArmor profile that is already loaded on the worker node. In a current Kubernetes release, which securityContext field sets this on a container?

   1. Aspec.containers[].securityContext.appArmorProfile with type Localhost and the profile name
   2. BA seccomp profile of type Unconfined set in the container securityContext, disabling checks
   3. Cspec.hostPID set to true so the pod shares the node's PID namespace with host processes running
   4. DThe --enable-admission-plugins=PodSecurity flag passed to the kubelet, which enforces Pod Security Standards
   Show answer and explanationHide answer

   Correct answer: A

   The appArmorProfile field on a container security context selects the AppArmor profile, and Localhost refers to a profile loaded on the node. hostPID is a namespace setting unrelated to AppArmor, and the admission plugin enforces Pod Security Standards without choosing a profile.