Certified Kubernetes Security Specialist (CKS) - Concept Practice Exam 1

1. A CI identity deploys one application in namespace build. It currently has cluster-admin. What is the best authorization change after identifying the operations it actually needs?
2. A CI pipeline discovers a vulnerable library in an image before deployment. What is the most appropriate remediation workflow?
3. A cluster must run only images signed by an approved build identity. What control should evaluate the signature before admitting a workload?
4. A cluster security assessment identifies anonymous requests to the kubelet API as an unnecessary exposure. Which configuration direction addresses this finding?
5. A company runs a private Kubernetes API for administrators on its corporate network. Which pair of controls best reduces remote attack surface while maintaining authenticated management? Select 2.
6. A container should prevent writes to its root filesystem but still needs a writable /tmp directory. Which arrangement meets both requirements?
7. A deployment audit requires identifying the exact immutable image artifact that was approved. Which image reference is most appropriate?
8. A Linux workload should use its container runtime's default seccomp profile instead of running unconfined. Which Pod or container securityContext setting requests that behavior?
9. A namespace currently warns about violations of the restricted Pod Security Standard but still accepts noncompliant Pods. Which namespace label enables rejection of new violating Pods?
10. A platform supports a sandboxed container runtime for higher-isolation workloads. How should an application select the configured runtime handler?
11. A production container should resist an attack that installs tools into its root filesystem. Which controls directly support a less mutable runtime? Select 2.
12. A production image contains compilers and build credentials left from an earlier build step. Which build pattern best separates compilation from runtime delivery?
13. A security patch requires upgrading a kubeadm-managed highly available cluster. Which procedure best preserves operational control?
14. A security team creates a default-deny ingress NetworkPolicy, but traffic between selected Pods remains unrestricted. The cluster's network plugin does not implement NetworkPolicy enforcement. What is required?
15. A security team needs an inventory of software components and versions within an image to help assess newly disclosed dependency vulnerabilities. Which artifact is designed for this inventory?
16. A team needs an alert when an unexpected shell executes inside a production container. Which capability directly targets this runtime behavior?
17. A team proposes granting list on Secrets while denying get, assuming users cannot read the secret values. What is the key problem?
18. A team wants to detect risky Kubernetes manifest settings, such as privileged containers, before merging changes. Which control best fits this stage?
19. A web frontend never calls the Kubernetes API. How can its Pod avoid receiving an automatically mounted service account token?
20. A worker image contains unused network daemons and package-management tooling unrelated to its workload. Which hardening action directly reduces host attack surface?
21. A workload specifies a local AppArmor profile by name. What must be true on a node for that profile to be used successfully?
22. An administrator enables encryption at rest for Secrets in the API server's configuration. Existing Secrets were stored before the change. What additional action is needed to protect those stored records with the new configuration?
23. An application has no legitimate need for cloud instance credentials. An assessment finds it can query the node's cloud metadata endpoint. Which action most directly reduces that credential-exposure path?
24. An attacker with broad workload permissions should not be able to erase the only copy of API audit history. Which logging design best supports this objective?
25. An audit policy records RequestResponse bodies for all Secret requests. Security analysts notice credential values in the audit backend. Which policy change reduces unnecessary sensitive payload collection while retaining request identity metadata?
26. An Ingress controller terminates TLS using a valid certificate. The upstream application receives HTTP from the controller. Which security conclusion is correct?
27. An investigator needs to determine which Kubernetes identity deleted a Secret through the API. Which telemetry is the most direct evidence source when the relevant events were audited?
28. Before installing a Kubernetes binary, an administrator receives a checksum and signing information through a trusted release channel. What is the appropriate integrity check?
29. Runtime alerts show suspicious outbound connections from one workload. The response team has identified its controller and has an approved containment plan. What is the best immediate approach?
30. Two services need encrypted, mutually authenticated workload-to-workload connections. A compatible service mesh is installed. Which security capability addresses this need?

Comments — 0