Free CKS practice test: 30 questions with answers

Falco watches system calls and Kubernetes events and raises alerts on suspicious behaviour, such as an interactive shell spawned in a container. Kube-bench checks configuration, Trivy scans images, and etcdctl is a database client.

RequestResponse records the request and response bodies in addition to metadata. Metadata records only who did what and when, and Request records the request body without the response.

The audit policy file decides which requests are logged and at which level, and the stages describe points in the request lifecycle, such as RequestReceived and ResponseComplete. Metadata logging omits bodies, and audit logging needs explicit configuration rather than running in debug mode.

A Falco rule has a condition, which is a filter over system call or event fields, and an output string that is written when the condition matches. Network policies, digests and cron schedules are not part of Falco rule definitions.

Falco outputs can be sent to a file, stdout, HTTP endpoint or other channels, and Falcosidekick forwards alerts to many backends including SIEM systems. The other options are unrelated to alert delivery.

The enforce mode label rejects pods that violate the chosen Pod Security Standard. The audit label only records violations, and the other two labels are not recognised by Pod Security Admission, because PodSecurityPolicy has been removed from Kubernetes.

STRICT mode in a PeerAuthentication policy requires mutual TLS for the workloads it covers, so plaintext connections are rejected. PERMISSIVE accepts both plaintext and mTLS, which leaves the risk in place. VirtualService and ServiceEntry control routing and external hosts, not peer authentication.

The encryption provider configuration tells the API server which provider, such as aescbc, kms or secretbox, to use when writing resources such as Secrets to etcd. The audit policy records access without encrypting anything, and the other flags are not related to encryption at rest.

Base64 is an encoding, not encryption, so anyone who can read the etcd data or the object can decode the value. Encryption at rest must be configured explicitly with an encryption provider. Secrets are not memory-only, and the kubelet does not encrypt them before delivery.

runAsNonRoot true causes the kubelet to verify that the container will not run as UID 0 and to refuse the start if it would. Privileged and privilege escalation settings do the opposite, and the filesystem setting does not affect the user.

Syft catalogs packages and produces SBOMs in formats such as SPDX and CycloneDX. Falco detects runtime behaviour, kube-bench checks cluster configuration against CIS benchmarks, and kube-hunter probes a cluster for weaknesses.

Cosign signs images, and an admission controller such as Kyverno or the Sigstore policy controller verifies the signature before the pod is created. Trivy finds vulnerabilities but does not enforce signatures, and Falco observes runtime events after the fact.

A tag can be moved to a different image by whoever controls the registry, but a digest is a hash of the image manifest, so it always resolves to the same content. Digests do not make images newer or safer, and scanning is still needed.

The ImagePolicyWebhook admission controller sends image information to an external webhook that returns allow or deny decisions. PersistentVolumes, kube-proxy and LimitRange do not evaluate images at admission time.

Minimal base images and multi-stage builds keep package managers, compilers and shells out of the shipped image, so there is less code an attacker can use. Running as root, floating tags and extra debugging tools all make the image easier to exploit.

A namespaced Role with the minimal verbs and a RoleBinding in the same namespace limits the grant to dev. A ClusterRoleBinding would grant the rights in every namespace, and a Role in kube-system does not apply to pods in dev at all.

The automountServiceAccountToken field controls whether the API credential is mounted into the pod. Setting it to false on the pod or on the service account removes the token, shrinking what an attacker gets after compromising the container. The other options change networking, filesystem writes or privileges, not API credentials.

The Node authorizer and NodeRestriction limit each kubelet to the objects on its own node, and Webhook mode on the kubelet delegates authorization decisions to the API server. Anonymous access, an exposed read-only port and disabled certificate rotation all widen the attack surface or extend the life of a stolen credential.

kubeadm upgrade apply performs the control-plane upgrade on the first control-plane node, after the kubeadm binary itself has been updated. The other commands are not kubeadm upgrade operations.

A ClusterRole that grants only get, list and watch on secrets, bound cluster-wide, gives read access in every namespace without write rights. The edit role includes write permissions on secrets, and a Role in one namespace is too narrow.

The appArmorProfile field on a container security context selects the AppArmor profile, and Localhost refers to a profile loaded on the node. hostPID is a namespace setting unrelated to AppArmor, and the admission plugin enforces Pod Security Standards without choosing a profile.

RuntimeDefault applies the default syscall filter that the container runtime ships with, which blocks many dangerous calls. Unconfined disables filtering, and the Localhost type needs a named profile file on the node, so it is not the runtime default.

Dropping ALL and adding back only the single capability needed follows least privilege. Port 443 is below 1024, so NET_BIND_SERVICE is the one capability required. Keeping the default set or running privileged gives the container far more power than it needs.

The Docker socket is the control interface of the container runtime, so a process that can write to it effectively has root on the node and can launch privileged containers with host mounts. Reading logs is not what the socket grants, and mounting it does not change networking or scheduling.

A read-only root filesystem blocks tampering with binaries, while an emptyDir volume gives the application a writable location that is discarded with the pod. The other options increase privilege or expose the host filesystem.

A NetworkPolicy whose podSelector is empty selects every pod in the namespace. Listing Ingress in policyTypes with no ingress rules makes the default for inbound traffic deny. The allow-all rule is wrong because it opens traffic, and a ResourceQuota controls resource counts, not network flows.

Setting --anonymous-auth=false makes the API server reject requests with no credentials instead of processing them as the system:anonymous user. AlwaysAllow is the opposite of what is wanted, and the insecure port bypasses authentication entirely.

Setting readOnlyPort to 0 disables the unauthenticated read-only endpoint on port 10255. Port 10250 is the authenticated kubelet API, and the other two settings weaken authentication.

Requiring client certificates on etcd and accepting only the API server identity restricts who can read or write cluster state. Open networking, public exposure and disabling TLS each remove a protection that etcd depends on.

rotateCertificates enables automatic rotation of the kubelet client certificate, which limits how long a stolen credential stays useful. The other settings control a read-only endpoint, static pod location and DNS configuration.