Free Preparation Discussions
MENU
Linux Foundation CKS Exam Questions
- Topic 1: Cluster Setup: This topic assesses the skills of Kubernetes practitioners in configuring secure Kubernetes clusters. It covers network security policies, CIS benchmarks, ingress security, node metadata protection, minimizing GUI access, and verifying platform binaries. Proficiency in these areas ensures a secure foundation for Kubernetes deployments.
- Topic 2: Cluster Hardening: Cluster hardening focuses on securing Kubernetes API access, utilizing Role-Based Access Controls, managing service accounts, and keeping Kubernetes updated. This CKS exam topic measures Kubernetes practitioners' ability to enhance cluster security by reducing exposure and managing permissions effectively.
- Topic 3: System Hardening: It involves minimizing the host OS footprint, managing IAM roles, limiting network access, and using kernel hardening tools like AppArmor and seccomp. The topic tests the skills of Kubernetes practitioners that are required to secure the underlying OS and its interactions with Kubernetes.
- Topic 4: Minimize Microservice Vulnerabilities: This topic of the Linux Foundation Kubernetes Security Specialist exam evaluates techniques to secure microservices, including OS-level security domains, managing Kubernetes secrets, using container runtime sandboxes, and implementing pod-to-pod encryption. It measures the ability to safeguard against vulnerabilities within a multi-tenant environment.
- Topic 5: Supply Chain Security: Supply chain security addresses securing base images, whitelisting registries, signing images, performing static analysis, and scanning for vulnerabilities. The CKA exam assesses the skills of Kubernetes practitioners in protecting the entire supply chain of containerized applications from creation to deployment.
- Topic 6: Monitoring, Logging, and Runtime Security: This area of the Certified Kubernetes Security Specialist exam focuses on behavioral analytics, threat detection across infrastructure, and ensuring container immutability. The proficiency of the Kubernetes practitioner here demonstrates the ability to maintain security and investigate incidents effectively.
Free Linux Foundation CKS Exam Actual Questions
Note: Premium Questions for CKS were last updated On Apr. 22, 2025 (see below)
Create a new ServiceAccount named backend-sa in the existing namespace default, which has the capability to list the pods inside the namespace default.
Create a new Pod named backend-pod in the namespace default, mount the newly created sa backend-sa to the pod, and Verify that the pod is able to list pods.
Ensure that the Pod is running.
A container image scanner is set up on the cluster.
Given an incomplete configuration in the directory
/etc/kubernetes/confcontrol and a functional container image scanner with HTTPS endpoint https://test-server.local.8081/image_policy
1. Enable the admission plugin.
2. Validate the control configuration and change it to implicit deny.
Finally, test the configuration by deploying the pod having the image tag as latest.
You must complete this task on the following cluster/nodes: Cluster:trace Master node:master Worker node:worker1 You can switch the cluster/configuration context using the following command: [desk@cli] $kubectl config use-context trace Given: You may use Sysdig or Falco documentation. Task: Use detection tools to detect anomalies like processes spawning and executing something weird frequently in the single container belonging to Podtomcat. Two tools are available to use: 1. falco 2. sysdig Tools are pre-installed on the worker1 node only. Analyse the container's behaviour for at least 40 seconds, using filters that detect newly spawning and executing processes. Store an incident file at/home/cert_masters/report, in the following format: [timestamp],[uid],[processName] Note:Make sure to store incident file on the cluster's worker node, don't move it to master node.
Create a PSP that will only allow the persistentvolumeclaim as the volume type in the namespace restricted.
Create a new PodSecurityPolicy named prevent-volume-policy which prevents the pods which is having different volumes mount apart from persistentvolumeclaim.
Create a new ServiceAccount named psp-sa in the namespace restricted.
Create a new ClusterRole named psp-role, which uses the newly created Pod Security Policy prevent-volume-policy
Create a new ClusterRoleBinding named psp-role-binding, which binds the created ClusterRole psp-role to the created SA psp-sa.
Hint:
Also, Check the Configuration is working or not by trying to Mount a Secret in the pod maifest, it should get failed.
POD Manifest:
apiVersion: v1
kind: Pod
metadata:
name:
spec:
containers:
- name:
image:
volumeMounts:
- name:
mountPath:
volumes:
- name:
secret:
secretName:
Context
A container image scanner is set up on the cluster, but it's not yet fully integrated into the cluster s configuration. When complete, the container image scanner shall scan for and reject the use of vulnerable images.
Task
Given an incomplete configuration in directory /etc/kubernetes/epconfig and a functional container image scanner with HTTPS endpoint https://wakanda.local:8081 /image_policy :
1. Enable the necessary plugins to create an image policy
2. Validate the control configuration and change it to an implicit deny
3. Edit the configuration to point to the provided HTTPS endpoint correctly
Finally, test if the configuration is working by trying to deploy the vulnerable resource /root/KSSC00202/vulnerable-resource.yml.
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Vallie
18 days agoTruman
27 days agoArminda
1 months agoSunshine
2 months agoFletcher
2 months agoAlease
2 months agoEleonore
3 months agoGeoffrey
3 months agoBarbra
3 months agoFrancoise
3 months agoDeane
4 months agoHermila
4 months agoBlossom
4 months agoFelix
4 months agoWilliam
5 months agoJolanda
5 months agoMicaela
5 months agoEladia
5 months agoSherita
5 months agoAdolph
5 months agoJanet
6 months agoMa
6 months agoCamellia
6 months agoTarra
6 months agoGlynda
7 months agoHassie
7 months agoJesus
7 months agoJulene
7 months agoLoren
7 months agoBillye
8 months agoNadine
10 months ago