Get Your CertCKSPlayCompete
‹ CKS tests

Certified Kubernetes Security Specialist (CKS) practice questions

10 questions in 1 test. Open one to answer it on its own, or take a whole test.

Test 1

Take Test 1 ›
  1. A kube-bench run against a worker node reports two failures: "Ensure that the --anonymous-auth argument is set to false" and "Ensure that the --authorization-mode argument is not… · Cluster Setup
  2. A batch workload in the reporting namespace never talks to the Kubernetes API, yet a security review finds a valid API token mounted at… · Cluster Hardening
  3. In the team-a namespace, a developer is bound to a Role that grants create, update, and delete on deployments only, no access to secrets, serviceaccounts, or any cluster-scoped… · Cluster Hardening
  4. Your baseline requires every container in a new Deployment to run under the container runtime's default seccomp profile, so that dangerous syscalls are blocked without you having… · System Hardening
  5. After labelling an existing namespace with pod-security.kubernetes.io/enforce=restricted and pod-security.kubernetes.io/enforce-version=latest, you observe that privileged Pods… · Minimize Microservice Vulnerabilities
  6. You add an EncryptionConfiguration that lists aescbc first and identity second for the secrets resource, point the API server at it with --encryption-provider-config, and restart… · Minimize Microservice Vulnerabilities
  7. Your organisation runs an external image-attestation service that answers "allow" or "deny" for a given image reference. Every Pod admitted to the cluster must be checked against… · Supply Chain Security
  8. An incident review finds that two Pods created a week apart from the identical manifest image: registry.example.com/payments:1.4 are running different binaries: someone pushed… · Supply Chain Security
  9. An investigation into a suspected Secret exfiltration needs the request and response bodies of every secrets API call. The cluster's audit policy is applied and the API server is… · Monitoring, Logging & Runtime Security
  10. Runtime alerts show that an attacker who exploited a web container wrote a crypto-miner binary into /usr/local/bin and executed it in place. You are asked to make the container… · Monitoring, Logging & Runtime Security