Certified Kubernetes Security Specialist practice questions

Question 1

An administrator is building a tenant namespace and wants to combine PSA enforce with audit and warn so violations are surfaced in logs and to the user even when they are admitted. Per the namespace-label task, is this possible?

Accepted Answer

Multiple modes can be applied to the same namespace simultaneously to combine enforcement with audit-log and user-facing-warning effects on a per-namespace basis.

Answer

Combining modes is allowed but only in the kube-system namespace; tenant namespaces are limited to enforce-only mode in production clusters by upstream policy in any release of v1.30+.

Answer

Only one mode at a time can be applied; setting two pod-security.kubernetes.io labels causes the apiserver to reject the namespace until one of them is removed by hand by an admin.

Answer

Combining modes requires a feature gate PodSecurityAdmissionMultiMode=true; without it, a single mode label is allowed per namespace per cluster in upstream Kubernetes for v1.28+ today.

Question 2

A platform team is integrating Falco alerts into an existing off-host SIEM and asks which mechanism lets a single alert fan out to more than 50 third-party systems without writing custom glue code per destination. Which approach fits?

Accepted Answer

Forward alerts via Falcosidekick, the forwarder proxy created to integrate Falco with more than 50 different systems.

Answer

Enable the syscall event source so each raw kernel event is delivered straight to the SIEM as its own output channel.

Answer

Replace the Falco rules engine with Prometheus recording rules so PromQL scrapes each alert into the SIEM directly.

Answer

Point the kubelet at the metrics.k8s.io API so it streams container audit events directly into the destination SIEM.

Question 3

A platform team is reviewing the architectural target of NIST SP 800-204D for cloud-native applications and must understand the predominant architecture the document assumes. Per the document, what is the predominant architecture?

Accepted Answer

The predominant application architecture for cloud-native applications consists of multiple microservices, accompanied in some instances by a centralized infrastructure such as a service mesh.

Answer

The predominant cloud-native architecture is a single-tenant VM cluster with a flat L2 network; SP 800-204D treats microservices as legacy and inadequate for federal information-system deployments today.

Answer

The predominant cloud-native architecture is a monolithic Java application packaged as a single container running on a privileged kubelet; SP 800-204D recommends migrating to that posture for security.

Answer

The predominant cloud-native architecture is a serverless function chain on a single proprietary runtime; SP 800-204D explicitly forbids container-based deployment for any federal CI/CD pipeline.

Question 4

A platform team is rolling out a 5-member etcd cluster behind a Kubernetes control plane and must lock down peer (server-to-server) traffic. Per the etcd transport security guide, which approach is the recommended baseline for production?

Accepted Answer

Create and sign a new key pair for every member in the cluster and configure CA-signed server, peer, and optionally client certificates per member.

Answer

Use a single shared key pair for every member to simplify peer authentication, accepting that key reuse is acceptable in a closed cluster environment overall.

Answer

Disable TLS on the peer port and rely on a network firewall around the etcd subnet, because peer traffic is internal to the cluster and not exposed.

Answer

Switch peer transport to plain HTTP/2 with token-based authentication only, since etcd's gRPC stack provides equivalent confidentiality without TLS.

Question 5

A team is hardening service-account usage in a sensitive namespace. Per the upstream Service Accounts page, what permission does the default ServiceAccount in each namespace get out of the box when RBAC is enabled?

Accepted Answer

The default ServiceAccount in each namespace gets no permissions other than the default API discovery permissions Kubernetes grants to all authenticated principals.

Answer

The default ServiceAccount is granted system:masters scope so that Pods in kube-system continue to function for backwards compatibility with v1.0 clusters from older releases.

Answer

The default ServiceAccount inherits the permissions of the kube-controller-manager so that controller-driven Pods can manage their own namespace freely without operator action.

Answer

The default ServiceAccount gets full cluster-admin permissions in its own namespace until the cluster operator explicitly trims it back via a RoleBinding update at install time.

Question 6

A platform team is rolling out a Linux-syscall sandbox for a sensitive workload running on Linux nodes. They have decided to use seccomp. Per the seccomp tutorial, which Pod-level setting is incompatible with seccomp confinement?

Accepted Answer

It is not possible to apply a seccomp profile to a container running with privileged: true set; privileged containers always run as Unconfined.

Answer

Seccomp profiles only take effect when CAP_SYS_ADMIN is dropped; privileged containers have CAP_SYS_ADMIN and therefore the profile is enforced more strictly than usual ever.

Answer

Seccomp can only run on read-only root filesystems; privileged containers must explicitly mount their root filesystem read-only for seccomp to apply at all in any case.

Answer

Seccomp is fully compatible with privileged: true; the kernel applies the profile in addition to the privileged flag with no observable behavioral change at runtime cycle.

Question 7

An MLOps team is hardening a Pod that should run as the lowest-privilege user possible. Per the security context reference, what does the readOnlyRootFilesystem setting do?

Accepted Answer

It mounts the container's root filesystem as read-only, blocking the container process from modifying any path under / except writable volumes mounted into the container.

Answer

It rotates the root user's UID/GID every 60 seconds during container lifetime so a compromised process cannot persistently retain root-equivalent access to the file inode tree.

Answer

It locks the container's image to the digest in the registry; any image-tag drift causes the kubelet to refuse to start the container at the next runtime restart on a node.

Answer

It strips all capabilities from the container at startup, including NET_BIND_SERVICE; the container is denied any privileged operation regardless of securityContext.capabilities settings.

Question 8

A SRE is tasked with surfacing live CPU and memory usage so the Horizontal Pod Autoscaler and kubectl top can function, and must identify which component actually collects those numbers. Which statement is correct?

Accepted Answer

The lightweight metrics-server queries each node's kubelet for CPU and memory and exposes metrics.k8s.io.

Answer

The kube-apiserver scrapes each pod directly and serves the figures to kubectl top from its own audit backend.

Answer

Prometheus must be the cluster default so PromQL range queries can feed the autoscaler its scaling input.

Answer

Falcosidekick aggregates container statistics from kernel drivers and posts them to the metrics pipeline.

Question 9

An engineer is rolling out signed Helm charts and must tell consumers where the record that lets them verify the integrity and origin of the packaged chart myapp-1.2.3.tgz is stored. Per Helm's provenance guidance, where is that record kept?

Accepted Answer

In a provenance file stored alongside the packaged chart, named myapp-1.2.3.tgz.prov.

Answer

Inside an annotations block embedded within the chart's Chart.yaml metadata file.

Answer

Inside a signature label attached to the chart once it gets pushed to a remote OCI registry.

Answer

In a detached checksum recorded in the repository's index.yaml entry for the chart.

Question 10

A platform team is rolling out shared, multi-tenant worker nodes and must decide on an imagePullCredentialsVerificationPolicy for the kubelet. The requirement: every pod that requests an image already present on a node must still have its pull credentials reverified, with no exception even for images preloaded onto the node. Which policy value enforces that requirement?

Accepted Answer

AlwaysVerify, requiring all images to undergo credential reverification regardless of whether the image is already present

Answer

NeverVerifyPreloadedImages, letting any image pulled to the node by another process be used without reverifying pull credentials

Answer

NeverVerifyAllowlistedImages, exempting node images on the verification allowlist from any pull-credential reverification step

Answer

NeverVerify, allowing anyone scheduled onto the node to use any image already present without any credential reverification

Question 11

An administrator is modeling how service-account identities are populated. Per the Service Accounts concept page, which property correctly describes service accounts?

Accepted Answer

Each service account is bound to a Kubernetes namespace; every namespace gets a default ServiceAccount upon creation by the apiserver in standard upstream installs.

Answer

Each service account is provisioned by a privileged DaemonSet in kube-system that periodically reconciles SA tokens against an external IdP via SAML on schedule every minute.

Answer

Each service account is cluster-scoped and visible across every namespace, so a single SA reference is sufficient for any Pod regardless of where it runs in the cluster.

Answer

Each service account is mirrored to a Linux user account on every node so kubelet can map ServiceAccount IDs to a node-level UID space at startup of the daemon.

Question 12

A security engineer is mapping MITRE ATT&CK Mitigation M1048 to a CKS hardening control set. Per the M1048 mitigation, which Kubernetes-relevant practice does it cover?

Accepted Answer

Application Isolation and Sandboxing restricts the execution of code to a controlled and isolated environment (e.g., a virtual environment, container, or sandbox).

Answer

Application Isolation and Sandboxing requires turning off all NetworkPolicies in the namespace so syscall traces can be exported without filter overhead by the host kernel agent fleet.

Answer

Application Isolation and Sandboxing forces every Pod to share the kube-system namespace so a single audit log can capture all sandboxed application syscalls in real time accurately.

Answer

Application Isolation and Sandboxing replaces RBAC with a sidecar enforcing per-process file capabilities and removes the need for any Pod-level securityContext entirely on cluster fleet.

Question 13

A platform team is choosing where to store sensitive bytes for a Pod and must explain how Secrets differ from ConfigMaps. Per the Secret concept page, which design decision separates a Secret from a ConfigMap?

Accepted Answer

Secrets are similar to ConfigMaps but are specifically intended to hold confidential data; using a Secret means the application code does not need to embed confidential data directly.

Answer

Secrets are stored unencrypted on the kubelet filesystem in /var/lib/kubelet/secrets/ across every node; ConfigMaps are stored in etcd; encryption configuration only applies to ConfigMaps at rest.

Answer

Secrets are only available to Pods in kube-system; tenant namespaces must use ConfigMaps and rely on a runtime sidecar to encrypt the sensitive bytes before reading them at process start.

Answer

Secrets are short-lived (TTL 60 minutes by default) and ConfigMaps are long-lived; the kubelet cleans up Secret files automatically when the TTL expires regardless of any controller action.

Question 14

A SRE is investigating a runtime alert and must explain Falco's design to the security team. Per the Falco overview, what category of cloud-native security tool is Falco and what does it deliver?

Accepted Answer

Falco is a cloud native security tool that provides runtime security across hosts, containers, Kubernetes, and cloud environments and delivers real-time alerts based on custom rules.

Answer

Falco is a registry mirror that proxies container image pulls and signs images at pull time; it has no runtime detection role and is not part of the CNCF runtime security suite at all currently.

Answer

Falco is a Kubernetes admission controller that intercepts every API request and emits an audit log entry; it does not run on the node and has no relationship to syscalls or kernel-level events at all today.

Answer

Falco is a build-time SBOM scanner that runs in CI; it does not perform any runtime monitoring and is not deployed in production clusters per upstream guidance for current releases of v0.x today.

Question 15

An organization is adopting a secure software development framework that recommends practices for reducing vulnerabilities and addressing root causes. Per NIST, which framework matches this description?

Accepted Answer

NIST SP 800-218 (SSDF v1.1), which recommends a core set of high-level secure software development practices to reduce vulnerabilities and address root causes for future recurrences.

Answer

NIST SP 800-37 (RMF), since RMF Step 5 'Authorize' is the SSDF v1.1 governance document for secure software development life-cycle activities in federal information systems today.

Answer

NIST SP 800-53 Rev. 5, since the AC control family is the canonical SSDF v1.1 reference for secure software development life-cycle activities in any FedRAMP-authorized cloud system today.

Answer

NIST SP 800-63 (Digital Identity Guidelines), since password-rotation policy is the canonical SSDF input and reducing password-related vulnerabilities is the primary SSDF goal in v1.1.

Certified Kubernetes Security Specialist

Sample questions

Sources

Similar exams