Certified Kubernetes Security Specialist Practice Test

Kubernetes CKS Practice Test

Start today’s free 10-question Kubernetes CKS set with source-backed explanations, local progress, and a fresh rotation every morning.

10 Free Daily Questions Source-backed Explanations 200 Verified Questions

Questions updated at Aug 23, 2026, 1:05 AM CDT

Start Daily Practice Open Dashboard

Go Pro - One Time Unlock

Unlock the full CKS bank

200 verified questions Exam Mode Practice Mode Detailed explanations Weak-area review No subscription - one-time unlock

Get the complete source-backed bank with Interview Questions, the full Study Guide, full Course Notes, detailed explanations, weak-area review, and exam-style practice.

Interview Questions Full Study Guide Full Course Notes Exam Mode Practice Mode Guided Course Detailed explanations Weak-area review No subscription

$4.99 One-time payment

See bundle and PDF options

We will confirm your site email in one quick checkout step.

Why DotCreds?

Practice with explanations that teach.

Source links for every answer Every wrong answer explained Guided Course included Practice and Exam Mode Weak-area tracking Same verified bank across web practice

What you get with free practice

10 Free Questions Daily Fresh set every day from the live bank

Detailed Explanations Learn with clear source-backed answers

Track Your Progress Daily history and performance insights

Upgrade Anytime Unlock the full bank when you are ready

Today's 10 Kubernetes CKS questions

Use this Kubernetes CKS practice test to review Certified Kubernetes Security Specialist. Questions rotate daily and each answer links back to the source used to write it.

Today’s Set

10 questions

Rotates at 10:00 AM local time

Progress

0/10

Answered on this page

Accuracy

Loading countdown…

200 verified questions are in the live bank. Free daily questions are selected from a rotating sample set. Unlock Pro to access the full question bank.

Preparing today’s free questions... Ordering the final locked-bank set before showing the practice cards.

Question 1 of 10

Objective Secure your supply chain Supply Chain Security (20%)

A private registry is strongly authenticated and only CI can push. Security argues signatures are unnecessary because the repository is trusted. What risk remains?

Concept tested:

Source:Verifying Signatures

Question 2 of 10

Objective Using least-privilege identity and access management System Hardening (10%)

A node automation account can SSH as root to every worker, read cluster admin kubeconfigs, and restart control-plane services, though its job only collects disk metrics. What should be changed?

Concept tested:

Question 3 of 10

Objective Use CIS benchmark to review security configuration of Kubernetes components Cluster Setup (15%)

A control-plane review shows `--audit-policy-file` is not configured. The SIEM receives component logs but no Kubernetes API audit events. Which remediation best addresses the finding?

Concept tested:

Question 4 of 10

Objective Minimize base image footprint Supply Chain Security (20%)

A Go service image contains the compiler, source tree, package manager, Git, and the final binary because the Dockerfile builds and runs in one stage. Which change most directly reduces the production attack surface?

Concept tested:

Question 5 of 10

Objective Use appropriate pod security standards Minimize Microservice Vulnerabilities (20%)

A Linux Pod in a Restricted namespace declares a `hostPath` volume for `/var/run/containerd.sock` but otherwise has ideal securityContext settings. What should the reviewer expect?

Concept tested:

Question 6 of 10

Objective Upgrade Kubernetes to avoid vulnerabilities Cluster Hardening (15%)

A worker kubelet is being upgraded from v1.34 to v1.35 after kube-apiserver is already v1.35. The administrator wants Pods to remain running during the in-place package upgrade. What is the supported approach?

Concept tested:

Question 7 of 10

Objective Ensure immutability of containers at runtime Monitoring, Logging and Runtime Security (20%)

A hardened Pod uses `readOnlyRootFilesystem: true` and a writable `emptyDir` mounted at `/var/cache/app`. A reviewer argues that the presence of any writable volume violates container immutability. Which response is most accurate?

Concept tested:

Question 8 of 10

Objective Understand and implement isolation techniques Minimize Microservice Vulnerabilities (20%)

A team says 'one namespace per tenant' is a complete security boundary. Which statement best corrects that assumption?

Concept tested:

Question 9 of 10

Objective Appropriately use kernel hardening tools such as AppArmor, seccomp System Hardening (10%)

A security engineer adds a strict seccomp profile and AppArmor profile, then a developer sets `privileged: true` to fix a device-access issue. What is the most important review finding?

Concept tested:

Question 10 of 10

Objective Exercise caution in using service accounts Cluster Hardening (15%)

A legacy integration uses a manually created `kubernetes.io/service-account-token` Secret with no expiration. It can be updated to read a projected token. Which migration improves credential security?

Concept tested:

Locked preview

You are viewing today’s free 10. Unlock 190 more questions.

Unlock full bank

Daily sample Rotating practice Free daily questions are selected from a rotating sample set.

Pro bank Full access Unlock Pro to access the full question bank, Exam Mode, Practice Mode, and random tests.

CKS Pro $4.99 one-time

Unlock all 200 Kubernetes CKS questions, explanations, review tools, and exam-style practice.

50 Exam Practice Test $1.99 one-time

A 50-question CKS PDF for short review sessions. Questions come first, then the answer review and explanations later in the file.

Linux / DevOps Access Bundle $6.99/month

Linux systems, Kubernetes, Terraform, data platform, and TensorFlow practice in one monthly unlock.

What’s includedCompTIA Linux+, CompTIA Cloud+, CompTIA CloudNetX, LFCS, CKA, Kubernetes CKS, Kubernetes CKAD, Terraform Associate, Databricks Data Engineer Associate, Databricks ML Associate, Databricks Generative AI Engineer Associate, TensorFlow Developer

Choose an unlock option to continue. We will confirm your site email in one quick checkout step.

Secure checkout powered by Stripe. Source-backed questions. Not brain dumps. Checkout stays on this page and unlocks the same Pro builder on this practice page.

Already Pro? Open dashboard

CKS Kubernetes CKS

Build your practice session

Choose how you want to study today. DotCreds will build the session from your unlocked full bank.

200verified questions Source-backedexplanations UpdatedAug 23, 2026, 1:05 AM CDT iPhonesame bank

Pass plan

Set your target once.

We will keep the next study action visible before every Pro session.

Exam date Target confidence score Daily minutes

Do this next: start Practice Mode with 20 questions to build your baseline.

Customize your session

Pick the size, question pool, mode, and timer before you start.

Question count How many questions do you want?

Question count

Question set What questions should we include?

Question set

Session mode How would you like to practice?

Session mode Practice mode Instant feedback after each answer. Exam mode No explanations until you submit.

Timer Set a time limit per question.

Timer: 1 minute per question

Extra features Choose which coaching cards appear after answers.

Why Users Miss On Interview Questions On Why This Matters On

Course Mode Course Notes Study Guide My Dashboard 10 questions · Practice mode · Untimed

Purchase options

Unlock the full CKS bank.

Get the full bank, Exam Mode, Practice Mode, question sets, random tests, readiness tracking, saved box scores, and review tools for this exam.

The PDF versions keep questions first and move the answer review, explanations, and distractor notes to the back of the file.

200 verified exam-style questions Every choice explained Exam Mode and Practice Mode Question sets and random tests Readiness score and trends Previous test box scores

You've answered 0/10 questions in today's set.

Locked: 190 more questions in the full bank.

Locked: exam simulation mode, practice mode, readiness tracking, and saved review history.

Checkout stays on this page, so you can keep practicing, unlock the full bank, and start Exam Mode or Practice Mode when you are ready.

Cheat Sheets

7-day score keeper

Answer questions today and this will become a rolling 7-day scorecard.

Local history

Optional progress sync

Keep today’s practice moving

Guest progress saves automatically on this device. Add an email later when you want a magic link that keeps your daily CKS practice in sync across browsers.

Guest progress saves on this device automatically

Source-backed answer review

The free daily Kubernetes CKS set includes crawlable question text, answer choices, correct answer labels, objective mapping, and source links. Only the first SEO card includes answer explanations and any extra learning features. Pro-only bank questions stay locked; this section mirrors only the 10 free daily questions already shown on this page.

Question 1 A private registry is strongly authenticated and only CI can push. Security argues signatures are unnecessary because the repository is trusted. What risk remains?

Answer choices

A. Signatures are useful only for public registries.
B. Registry compromise or misuse can still replace content; independent signature and identity verification can detect artifacts not produced by the authorized signer.
C. None. Registry authentication cryptographically proves build provenance for every blob.
D. Only image size; trust controls are unrelated to integrity.

Correct answer

Registry compromise or misuse can still replace content; independent signature and identity verification can detect artifacts not produced by the authorized signer.

Repository access control and artifact authenticity are complementary controls. Source basis: Cosign verification validates artifact signatures against a key or trusted certificate chain. Keyless verification can constrain the certificate identity and OIDC issuer; attestations are verified separately with verify-attestation.

Wrong-answer review

A. Signatures are useful only for public registries.: Private distribution does not eliminate insider or repository compromise.
C. None. Registry authentication cryptographically proves build provenance for every blob.: Registry authorization proves who accessed the repository, not necessarily the artifact's approved build identity.
D. Only image size; trust controls are unrelated to integrity.: Supply-chain integrity is the relevant remaining risk.

Extra learning features

Why candidates miss this

Candidates commonly miss this by assuming registry authentication proves artifact provenance. The decisive clue is that a trusted repository controls who can push but does not independently prove which identity built or signed a particular blob; signature and identity verification add that assurance. Likely wrong answer: None. Registry authentication cryptographically proves build provenance for every blob. Review focus: Verifying Signatures

Why this matters

Registry authentication tells you who is allowed to push to a repository; it does not independently prove who produced or approved each artifact. Signature and identity verification add a separate trust decision, which still matters if CI credentials, registry permissions, or the repository itself are compromised.

Objective/domain: Supply Chain Security (20%)

Source: Verifying Signatures

Question 2 A node automation account can SSH as root to every worker, read cluster admin kubeconfigs, and restart control-plane services, though its job only collects disk metrics. What should be changed?

Answer choices

A. Move the shared root private key into a Secret and keep its permissions.
B. Create a dedicated identity limited to the minimum host commands and nodes required for metric collection, with no cluster-admin kubeconfig access.
C. Grant the account cluster-admin so host and Kubernetes permissions are consistent.
D. Keep root privileges but restrict the account name to eight characters.

Correct answer

Create a dedicated identity limited to the minimum host commands and nodes required for metric collection, with no cluster-admin kubeconfig access.

Objective/domain: System Hardening (10%)

Source: Kubernetes Hardening Guide

Question 3 A control-plane review shows `--audit-policy-file` is not configured. The SIEM receives component logs but no Kubernetes API audit events. Which remediation best addresses the finding?

Answer choices

A. Increase kubelet verbosity to 10 because kubelet logs are equivalent to API audit events.
B. Enable RequestResponse for every Secret request with no exclusions to maximize evidence.
C. Create an audit policy with scoped rules and configure kube-apiserver with `--audit-policy-file` plus an audit backend.
D. Create a ConfigMap named `audit-policy`; kube-apiserver discovers it automatically.

Correct answer

Create an audit policy with scoped rules and configure kube-apiserver with `--audit-policy-file` plus an audit backend.

Objective/domain: Cluster Setup (15%)

Source: Auditing

Question 4 A Go service image contains the compiler, source tree, package manager, Git, and the final binary because the Dockerfile builds and runs in one stage. Which change most directly reduces the production attack surface?

Answer choices

A. Use a multi-stage build and copy only the compiled runtime artifact and required runtime files into a minimal final stage.
B. Add a vulnerability scanner binary to the image and leave all build tools present.
C. Run the existing image with `imagePullPolicy: Always`; pull policy removes unused packages at startup.
D. Keep one stage and hide the compiler under `/opt/.hidden`.

Correct answer

Use a multi-stage build and copy only the compiled runtime artifact and required runtime files into a minimal final stage.

Objective/domain: Supply Chain Security (20%)

Source: Multi-stage builds

Question 5 A Linux Pod in a Restricted namespace declares a `hostPath` volume for `/var/run/containerd.sock` but otherwise has ideal securityContext settings. What should the reviewer expect?

Answer choices

A. The Pod should be rejected; Restricted limits allowed volume types and hostPath creates direct host filesystem exposure.
B. The Pod is allowed because readOnlyRootFilesystem protects the hostPath.
C. The Pod is allowed because containerd sockets are not files.
D. The Pod is allowed if the hostPath mount is read-only; Restricted ignores volume source types.

Correct answer

The Pod should be rejected; Restricted limits allowed volume types and hostPath creates direct host filesystem exposure.

Objective/domain: Minimize Microservice Vulnerabilities (20%)

Source: Pod Security Standards

Question 6 A worker kubelet is being upgraded from v1.34 to v1.35 after kube-apiserver is already v1.35. The administrator wants Pods to remain running during the in-place package upgrade. What is the supported approach?

Answer choices

A. Delete the Node object instead of draining it.
B. Drain the node before the minor-version kubelet upgrade, then upgrade/restart kubelet and return the node after validation.
C. Do not drain; minor kubelet upgrades are explicitly supported while Pods continue running.
D. Upgrade kubelet to v1.36 first, then downgrade to v1.35.

Correct answer

Drain the node before the minor-version kubelet upgrade, then upgrade/restart kubelet and return the node after validation.

Objective/domain: Cluster Hardening (15%)

Source: Upgrading kubeadm clusters

Question 7 A hardened Pod uses `readOnlyRootFilesystem: true` and a writable `emptyDir` mounted at `/var/cache/app`. A reviewer argues that the presence of any writable volume violates container immutability. Which response is most accurate?

Answer choices

A. The reviewer is correct only when the image is signed.
B. Remove the read-only root setting and rely on Pod restart for immutability.
C. The reviewer is correct: Kubernetes requires every mounted filesystem to be read-only for an immutable workload.
D. A narrowly scoped writable volume for required transient state can coexist with an immutable application root; the security goal is to prevent uncontrolled mutation of executable/configuration content and minimize writable paths.

Correct answer

A narrowly scoped writable volume for required transient state can coexist with an immutable application root; the security goal is to prevent uncontrolled mutation of executable/configuration content and minimize writable paths.

Objective/domain: Monitoring, Logging and Runtime Security (20%)

Source: Application Security Checklist

Question 8 A team says 'one namespace per tenant' is a complete security boundary. Which statement best corrects that assumption?

Answer choices

A. Namespaces make service-account tokens valid only inside that namespace, regardless of RBAC.
B. Namespaces are a useful logical boundary, but secure multi-tenancy also requires authorization, network isolation, workload hardening, resource controls, and sometimes node or control-plane isolation.
C. Namespaces are only naming prefixes and cannot participate in security policy at all.
D. Namespaces cryptographically isolate memory, networks, storage, and cluster-scoped APIs without additional controls.

Correct answer

Namespaces are a useful logical boundary, but secure multi-tenancy also requires authorization, network isolation, workload hardening, resource controls, and sometimes node or control-plane isolation.

Objective/domain: Minimize Microservice Vulnerabilities (20%)

Source: Multi-tenancy

Question 9 A security engineer adds a strict seccomp profile and AppArmor profile, then a developer sets `privileged: true` to fix a device-access issue. What is the most important review finding?

Answer choices

A. Only NetworkPolicy is affected; kernel confinement remains unchanged.
B. The seccomp and AppArmor profiles become stronger when privileged mode is enabled.
C. Privileged mode overrides or bypasses major kernel confinement controls; remove privileged mode and grant only the specific capability/device access actually required.
D. Privileged mode is safe if `runAsNonRoot: true` is also set.

Correct answer

Privileged mode overrides or bypasses major kernel confinement controls; remove privileged mode and grant only the specific capability/device access actually required.

Objective/domain: System Hardening (10%)

Source: Linux kernel security constraints for Pods and containers

Question 10 A legacy integration uses a manually created `kubernetes.io/service-account-token` Secret with no expiration. It can be updated to read a projected token. Which migration improves credential security?

Answer choices

A. Keep the legacy Secret but Base64-encode it twice.
B. Use one long-lived token shared by every replica and namespace.
C. Copy the long-lived token into a ConfigMap so rotation is easier.
D. Use a TokenRequest or projected service-account token with a bounded lifetime and appropriate audience.

Correct answer

Use a TokenRequest or projected service-account token with a bounded lifetime and appropriate audience.

Objective/domain: Cluster Hardening (15%)

Source: Managing Service Accounts

Where to go after the daily web set

How are Kubernetes CKS questions generated?

dotCreds builds Kubernetes CKS practice questions from public exam objectives and Linux Foundation exam and documentation references. The questions are written for realistic study practice, not copied from exam dumps.

How are explanations sourced?

Each question includes an explanation and, when available, a source link back to the provider documentation or reference used to validate the answer. That keeps the practice tied to study material you can actually review.

What score do I get?

The page tracks today's answered count and accuracy for the 10-question daily set, then saves a 7-day score history on this device so you can see your recent practice trend.

Why use this site?

The site is the fastest way to start Kubernetes CKS practice without installing anything. It is built for daily recall, quick weak-topic discovery, and source-backed explanations you can review immediately.