Linux Foundation CKS Certification Exam Sample Questions

CKS Braindumps, CKS Exam Dumps, CKS Examcollection, CKS Questions PDF, CKS Sample Questions, Kubernetes Security Specialist Dumps, Kubernetes Security Specialist Official Cert Guide PDF, Kubernetes Security Specialist VCE, Linux Foundation Kubernetes Security Specialist PDFWe have prepared Certified Kubernetes Security Specialist (CKS) certification sample questions to make you aware of actual exam properties. This sample question set provides you with information about the Kubernetes Security Specialist exam pattern, question formate, a difficulty level of questions and time required to answer each question. To get familiar with Certified Kubernetes Security Specialist (CKS) exam, we suggest you try our Sample Linux Foundation CKS Certification Practice Exam in simulated Linux Foundation certification exam environment.

To test your knowledge and understanding of concepts with real-time scenario based Linux Foundation CKS questions, we strongly recommend you to prepare and practice with Premium Linux Foundation Kubernetes Security Specialist Certification Practice Exam. The premium Linux Foundation Kubernetes Security Specialist certification practice exam helps you identify topics in which you are well prepared and topics in which you may need further training to achieving great score in actual Certified Kubernetes Security Specialist (CKS) exam.

Linux Foundation CKS Sample Questions:

01. An attacker with push access replaces an image in the company's own trusted registry with a backdoored build that keeps the same repository name and tag. The cluster already restricts pulls to that trusted registry.
Which control would still prevent the backdoored image from being admitted?
a) Admission-time signature verification against the authorized build pipeline's key.
b) An admission vulnerability scan that blocks images carrying known published CVEs.
c) Setting imagePullPolicy: Always so the current image is always pulled on each restart.
d) The existing trusted-registry allow-list, since the replaced image still originates from the approved internal registry and passes the source check.
 
02. Before any manifest is merged, a team wants to automatically reject one that sets securityContext.privileged: true or mounts a host path. Which tool is designed to catch these insecure settings by statically analyzing the Kubernetes manifest itself?
a) An image vulnerability scanner such as trivy image, Clair, or Grype.
b) A Dockerfile linter such as hadolint.
c) A cluster configuration benchmark such as kube-bench.
d) A manifest policy scanner such as kubesec or an OPA/conftest policy.
 
03. A compromised container tries to trigger the host kernel into autoloading a rarely used module, such as an obscure filesystem or network-protocol module that carries a known vulnerability, so it can then exploit that module from inside the container.
Which host hardening measure most directly prevents this?
a) Blacklist the unneeded kernel modules so the host will not autoload them on demand.
b) Set the container's seccomp profile to RuntimeDefault to filter the syscalls it may issue.
c) Apply a NetworkPolicy that restricts the container's outbound egress traffic.
d) Enable a read-only root filesystem on the container to prevent binary tampering.
 
04. PodSecurityPolicy was removed from Kubernetes, and clusters now need a native way to enforce the Pod Security Standards on namespaces.
Which built-in admission controller took over that role?
a) OPA Gatekeeper
b) Pod Security Admission
c) The NodeRestriction admission plugin
d) The NetworkPolicy controller
 
05. A pod hosts a batch job that never calls the Kubernetes API, yet its container still receives the namespace default ServiceAccount's token mounted at the usual serviceaccount path. An auditor warns this token could be reused if the container is compromised.
Which setting removes that token from the pod?
a) Attach a NetworkPolicy that denies the pod all egress to the API server endpoint.
b) Delete the default ServiceAccount from the pod's namespace so no token can be mounted.
c) Set the container's readOnlyRootFilesystem field to true to lock the image.
d) Set automountServiceAccountToken: false on the pod spec or on the ServiceAccount it uses.
 
06. Even if an attacker achieves code execution inside a running container, a team wants to stop them from writing a web shell or altering existing binaries on the container's root filesystem.
Which securityContext setting most directly prevents this?
a) allowPrivilegeEscalation: false
b) automountServiceAccountToken: false
c) readOnlyRootFilesystem: true
d) runAsNonRoot: true
 
07. An organization needs a cluster-wide rule that rejects any pod which is privileged or pulls an image from outside an approved registry list, which is custom logic the built-in Pod Security Standards cannot express.
Which two tools can enforce such a policy at admission time?
(Choose two.)
a) Pod Security Admission configured with the Restricted profile
b) OPA Gatekeeper, applying constraints backed by Rego policies
c) Per-pod securityContext settings applied by each team
d) Kyverno, using cluster policies written as Kubernetes resources
 
08. In a namespace that contains no NetworkPolicy resources at all, how does the cluster treat network traffic to and from the pods running there?
a) Traffic is permitted only on ports the kubelet registers, with everything else dropped until a policy opens it.
b) All ingress and egress traffic is permitted, because a pod stays non-isolated until a NetworkPolicy selects it.
c) Only ingress from the same namespace is permitted, while all egress and cross-namespace ingress is blocked by default.
d) All ingress and egress traffic is denied, because the cluster applies an implicit default-deny baseline to every namespace.
 
09. A Secret stores a production database password that is consumed by a single application. Which two practices most reduce the password's exposure if another workload or account in the cluster is compromised?
(Choose two.)
a) Move the password into a ConfigMap that the pod references at startup
b) Base64-encode the password a second time before storing it in the Secret
c) Restrict get access to the Secret through RBAC so only the application's ServiceAccount can read it
d) Mount the Secret as a file through a volume instead of injecting it into an environment variable
 
10. You are hardening a multi-tenant cluster against a stolen kubelet credential. If an attacker obtains one worker node's kubelet client certificate, you need to guarantee they cannot use it to read Secrets belonging to pods on other nodes or edit a different node's object.
Which admission plugin enforces that limit?
a) The ServiceAccount admission controller managing token mounting and defaults.
b) The AlwaysPullImages admission controller forcing a registry pull per pod.
c) The NodeRestriction admission controller scoping each kubelet's writes.
d) The PodSecurity admission controller enforcing the baseline or restricted standard.

Answers:

Question: 01
Answer: a		 Question: 02
Answer: d		 Question: 03
Answer: a		 Question: 04
Answer: b		 Question: 05
Answer: d
Question: 06
Answer: c		 Question: 07
Answer: b, d		 Question: 08
Answer: b		 Question: 09
Answer: c, d		 Question: 10
Answer: c

Note: Please update us by writing an email on feedback@vmexam.com for any error in Certified Kubernetes Security Specialist (CKS) certification exam sample questions

Rating: 5 / 5 (75 votes)