Kubernetes CKS Practice Test

Answer choices

1. A. Impersonation changes only log display names and never affects authorization, for the described technical objective and its associated operational control requirements, within the described context.
2. B. Impersonation is harmless if audit logging is enabled, for the described technical objective and its associated operational control requirements, for evaluation.
3. C. The only risk is denial of service from extra API calls, within the documented operational, security, ownership, and validation requirements.
4. D. The identity may assume a more privileged user's effective permissions; scope impersonation to only the required identities or groups, for the described technical objective.

Wrong-answer review

• A. Impersonation changes only log display names and never affects authorization, for the described technical objective and its associated operational control requirements, within the described context.: Impersonation is not merely cosmetic.
• B. Impersonation is harmless if audit logging is enabled, for the described technical objective and its associated operational control requirements, for evaluation.: Auditability does not remove the privilege.
• C. The only risk is denial of service from extra API calls, within the documented operational, security, ownership, and validation requirements.: The primary concern is privilege acquisition, not request volume.

Answer choices

1. A. Base64-encode the log stream because Base64 provides confidentiality, for the described technical objective and its associated operational control requirements, within this context.
2. B. Grant the logging agent `get secrets` so it can identify and remove them later, within the minimize microservice vulnerabilities (20%) context.
3. C. Disable Secret encryption at rest so logs and etcd use the same representation, for the described technical objective and its associated operational control requirements, for evaluation.
4. D. Prevent Secret values from entering diagnostic output and logs; use safer delivery or redaction and tightly scope troubleshooting, as the primary implementation for the described business requirement.

Answer choices

1. A. Run it under a dedicated non-root identity with only the required file/socket permissions or narrowly scoped capabilities, for the stated requirement.
2. B. Run the daemon as root but disable TLS to reduce complexity, for the described technical objective and its associated operational control requirements, for evaluation.
3. C. Grant the Pod privileged mode so host permissions are simpler, under the organization’s defined implementation and exception-management process.
4. D. Keep root and rely on the daemon vendor's reputation, under the organization’s defined implementation and exception-management process.

Answer choices

1. A. Accept because signature age is more important than attestation age, for the described technical objective and its associated operational control requirements, as proposed.
2. B. Reject or quarantine until a fresh policy-compliant attestation is produced and verified for the same artifact digest, for this requirement.
3. C. Update the attestation timestamp locally without re-signing it, as the proposed design for the complete governed operational workflow.
4. D. Retag the image with today's date; the attestation becomes current, for the described technical objective and its associated operational control requirements.

Answer choices

1. A. Focus only on CPU metrics; API verbs do not help reconstruct security events, for the described technical objective and its associated operational control requirements, for the stated implementation and support requirements.
2. B. Ignore the username because audit logs cannot identify ServiceAccounts, for the described technical objective and its associated operational control requirements, as the selected approach for the stated technical and business outcome, for evaluation.
3. C. Delete the audit logs after extracting the source IP to prevent sensitive-data exposure, for the described technical objective and its associated operational control requirements, for the described technical objective.
4. D. Correlate the ServiceAccount's effective RBAC, the RoleBinding target, source/workload identity, and subsequent Pod-creation events on the same timeline to determine whether this is an authorization abuse path, within the defined security and accountability boundaries.

Answer choices

1. A. Change the policy API version to `v1beta1` so the kubelet will enforce it, under the organization’s defined implementation and exception-management process.
2. B. Verify that the cluster's CNI/network plugin actually implements NetworkPolicy enforcement, for this requirement.
3. C. Add a second identical default-deny policy because one policy is informational only, as the organization’s selected response.
4. D. Restart kube-apiserver; NetworkPolicy is enforced directly by the API server, for the stated security, delivery, and accountability requirements.

Answer choices

1. A. No. Cluster-scoped permissions let a tenant affect resources outside its namespace; restrict cluster-scoped APIs and use stronger control-plane isolation if tenants require that level of autonomy.
2. B. Yes. Namespaces automatically constrain every Kubernetes resource, including ClusterRoles and webhooks, for the described technical objective and its associated operational control requirements, as the organization’s selected response.
3. C. No, but adding ResourceQuota alone creates a hard security boundary for cluster-scoped resources, for the described technical objective and its associated operational control requirements, for the stated implementation and support requirements.
4. D. Yes, because NetworkPolicy prevents API-server privilege escalation, for the described technical objective and its associated operational control requirements, for the described technical objective and its associated operational control requirements, for this decision.

Answer choices

1. A. Install a full desktop environment so operators can inspect security settings locally, under the documented operational and governance requirements.
2. B. Use a hardened minimal node image and replace/rebuild drifted nodes from the approved baseline rather than continually hand-modifying them, as described.
3. C. Disable configuration monitoring so drift does not trigger noisy alerts, for the described technical objective and its associated operational control requirements, in context.
4. D. Permit manual changes but document them in shell history, for the described technical objective and its associated operational control requirements, for the described technical objective.

Answer choices

1. A. Set `readOnlyRootFilesystem: true`; Kubernetes rewrites the image layers at Pod start, for the described technical objective and its associated operational control requirements, within the proposed design.
2. B. Compress the final image tarball; compression removes vulnerable packages from layer history, for the described technical objective and its associated operational control requirements, when applied.
3. C. Rename the package layer so scanners ignore it, for the described technical objective and its associated operational control requirements, for the stated scenario.
4. D. Use a separate build stage and copy only required outputs into a fresh final stage so build packages are absent from final-image layers, under the organization’s defined implementation and exception-management process.

Answer choices

1. A. Only the node's CPU graph because DaemonSets are scheduler-created and have no API actor, under the stated technical, operational, and governance constraints.
2. B. Only container stdout from one replica, for the described technical objective and its associated operational control requirements, when applied.
3. C. Only the registry's image size history, as the selected approach for the stated technical and business outcome.
4. D. Kubernetes audit records for the DaemonSet create/update with runtime events from the resulting Pods and nodes, as the organization’s selected response.