CKS exam material & Free CKS AI Tutor

QUESTION: 1

Create a new ServiceAccount named backend-sa in the existing namespace default, which has the capability to list the pods inside the namespace default. Create a new Pod named backend-pod in the namespace default, mount the newly created sa backend-sa to the pod, and Verify that the pod is able to list pods.
Ensure that the Pod is running.

See Explanation section for answer.

Answer(s): A

Explanation:

A service account provides an identity for processes that run in a Pod.

When you (a human) access the cluster (for example, using kubectl), you are authenticated by the apiserver as a particular User Account (currently this is usually admin, unless your cluster administrator has customized your cluster). Processes in containers inside pods can also contact the apiserver.
When they do, they are authenticated as a particular Service Account (for example, default).

When you create a pod, if you do not specify a service account, it is automatically assigned the default service account in the same namespace. If you get the raw json or yaml for a pod you have created (for example, kubectl get pods/<podname> -o yaml), you can see the spec.serviceAccountName field has been automatically set. You can access the API from inside a pod using automatically mounted service account credentials, as described in Accessing the Cluster. The API permissions of the service account depend on the authorization plugin and policy in use.
In version 1.6+, you can opt out of automounting API credentials for a service account by setting automountServiceAccountToken: false on the service account:
apiVersion: v1
kind: ServiceAccount metadata:
name: build-robot automountServiceAccountToken: false
...
In version 1.6+, you can also opt out of automounting API credentials for a particular pod:
apiVersion: v1

kind: Pod metadata:
name: my-pod spec:
serviceAccountName: build-robot automountServiceAccountToken: false
...
The pod spec takes precedence over the service account if both specify a automountServiceAccountToken value.

Show Answer Next Question

QUESTION: 2

Fix all issues via configuration and restart the affected components to ensure the new setting takes effect.
Fix all of the following violations that were found against the API server:-

1.Ensure the --authorization-mode argument includes RBAC
2.Ensure the --authorization-mode argument includes Node
3.Ensure that the --profiling argument is set to false Fix all of the following violations that were found against the Kubelet:-
4.Ensure the --anonymous-auth argument is set to false.
5.Ensure that the --authorization-mode argument is set to Webhook.
6.Fix all of the following violations that were found against the ETCD:-
7.Ensure that the --auto-tls argument is not set to true Hint: Take the use of Tool Kube-Bench

See Explanation section for answer.

Answer(s): A

Explanation:

API server:
Ensure the --authorization-mode argument includes RBAC Turn on Role Based Access Control.

Role Based Access Control (RBAC) allows fine-grained control over the operations that different entities can perform on different objects in the cluster. It is recommended to use the RBAC authorization mode.
Fix - Buildtime
Kubernetes apiVersion: v1
kind: Pod metadata:
creationTimestamp: null labels:
component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec:
containers:
- command:
+ - kube-apiserver
+ - --authorization-mode=RBAC,Node image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe:
failureThreshold: 8
httpGet:
host: 127.0.0.1
path: /healthz port: 6443
scheme: HTTPS
initialDelaySeconds: 15
timeoutSeconds: 15
name: kube-apiserver-should-pass resources:
requests:
cpu: 250m volumeMounts:
- mountPath: /etc/kubernetes/
name: k8s readOnly: true
- mountPath: /etc/ssl/certs name: certs
- mountPath: /etc/pki name: pki hostNetwork: true volumes:
- hostPath:
path: /etc/kubernetes name: k8s
- hostPath:
path: /etc/ssl/certs name: certs
- hostPath:
path: /etc/pki name: pki

Ensure the --authorization-mode argument includes Node

Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube- apiserver.yaml on the master node and set the --authorization-mode parameter to a value that includes Node.
--authorization-mode=Node,RBAC

Audit:
/bin/ps -ef | grep kube-apiserver | grep -v grep
Expected result:
'Node,RBAC' has 'Node'

Ensure that the --profiling argument is set to false

Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube- apiserver.yaml on the master node and set the below parameter.
--profiling=false
Audit:
/bin/ps -ef | grep kube-apiserver | grep -v grep
Expected result:
'false' is equal to 'false'
Fix all of the following violations that were found against the Kubelet:- Ensure the --anonymous-auth argument is set to false. Remediation: If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to false. If using executable arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
--anonymous-auth=false
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload systemctl restart kubelet.service
Audit:
/bin/ps -fC kubelet
Audit Config:
/bin/cat /var/lib/kubelet/config.yaml
Expected result:
'false' is equal to 'false'

2) Ensure that the --authorization-mode argument is set to Webhook.

Audit docker inspect kubelet | jq -e '.[0].Args[] | match("--authorization-mode=Webhook").string' Returned Value: --authorization-mode=Webhook

Fix all of the following violations that were found against the ETCD:- a. Ensure that the --auto-tls argument is not set to true Do not use self-signed certificates for TLS. etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should not be available to unauthenticated clients. You should enable the client authentication via valid certificates to secure the access to the etcd service.
Fix - Buildtime
Kubernetes apiVersion: v1
kind: Pod metadata:

annotations:
scheduler.alpha.kubernetes.io/critical-pod: ""
creationTimestamp: null labels:
component: etcd tier: control-plane name: etcd namespace: kube-system spec:
containers:
- command:
+ - etcd
+ - --auto-tls=true image: k8s.gcr.io/etcd-amd64:3.2.18
imagePullPolicy: IfNotPresent livenessProbe:
exec:
command:
- /bin/sh
- -ec
- ETCDCTL_API=3 etcdctl --endpoints=https://[192.168.22.9]:2379 -- cacert=/etc/kubernetes/pki/etcd/ca.crt
--cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt -- key=/etc/kubernetes/pki/etcd/healthcheck-client.key get foo failureThreshold: 8
initialDelaySeconds: 15
timeoutSeconds: 15
name: etcd-should-fail resources: {}
volumeMounts:
- mountPath: /var/lib/etcd name: etcd-data
- mountPath: /etc/kubernetes/pki/etcd name: etcd-certs hostNetwork: true priorityClassName: system-cluster-critical volumes:
- hostPath:
path: /var/lib/etcd type: DirectoryOrCreate name: etcd-data
- hostPath:
path: /etc/kubernetes/pki/etcd type: DirectoryOrCreate name: etcd-certs status: {}

Show Answer Next Question

QUESTION: 3

Create a PSP that will prevent the creation of privileged pods in the namespace. Create a new PodSecurityPolicy named prevent-privileged-policy which prevents the creation of privileged pods.
Create a new ServiceAccount named psp-sa in the namespace default. Create a new ClusterRole named prevent-role, which uses the newly created Pod Security Policy prevent-privileged-policy.
Create a new ClusterRoleBinding named prevent-role-binding, which binds the created ClusterRole prevent-role to the created SA psp-sa.

Also, Check the Configuration is working or not by trying to Create a Privileged pod, it should get failed.

See Explanation section for answer.

Answer(s): A

Explanation:

Create a PSP that will prevent the creation of privileged pods in the namespace.

$ cat clusterrole-use-privileged.yaml
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole metadata:
name: use-privileged-psp rules:
- apiGroups: ['policy']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames:
- default-psp
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding metadata:
name: privileged-role-bind namespace: psp-test roleRef:
apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: use-privileged-psp subjects:
- kind: ServiceAccount name: privileged-sa
$ kubectl -n psp-test apply -f clusterrole-use-privileged.yaml After a few moments, the privileged Pod should be created.

Create a new PodSecurityPolicy named prevent-privileged-policy which prevents the creation of privileged pods.

apiVersion: policy/v1beta1
kind: PodSecurityPolicy metadata:
name: example spec:
privileged: false # Don't allow privileged pods!
# The rest fills in some required fields.
seLinux:
rule: RunAsAny supplementalGroups:
rule: RunAsAny runAsUser:
rule: RunAsAny fsGroup:
rule: RunAsAny volumes:
- '*'

And create it with kubectl:
kubectl-admin create -f example-psp.yaml
Now, as the unprivileged user, try to create a simple pod:

kubectl-user create -f- <<EOF
apiVersion: v1
kind: Pod metadata:
name: pause spec:
containers:
- name: pause image: k8s.gcr.io/pause
EOF
The output is similar to this:
Error from server (Forbidden): error when creating "STDIN": pods "pause" is forbidden: unable to validate against any pod security policy: []

Create a new ServiceAccount named psp-sa in the namespace default.

$ cat clusterrole-use-privileged.yaml
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole metadata:
name: use-privileged-psp rules:
- apiGroups: ['policy']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames:
- default-psp
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding metadata:
name: privileged-role-bind namespace: psp-test roleRef:
apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: use-privileged-psp subjects:
- kind: ServiceAccount name: privileged-sa
$ kubectl -n psp-test apply -f clusterrole-use-privileged.yaml After a few moments, the privileged Pod should be created.

Create a new ClusterRole named prevent-role, which uses the newly created Pod Security Policy prevent-privileged-policy.

apiVersion: policy/v1beta1

kind: PodSecurityPolicy metadata:
name: example spec:
privileged: false # Don't allow privileged pods!
# The rest fills in some required fields.
seLinux:
rule: RunAsAny supplementalGroups:
rule: RunAsAny runAsUser:
rule: RunAsAny fsGroup:
rule: RunAsAny volumes:
- '*'
And create it with kubectl:
kubectl-admin create -f example-psp.yaml
Now, as the unprivileged user, try to create a simple pod:
kubectl-user create -f- <<EOF
apiVersion: v1
kind: Pod metadata:
name: pause spec:
containers:
- name: pause image: k8s.gcr.io/pause
EOF
The output is similar to this:
Error from server (Forbidden): error when creating "STDIN": pods "pause" is forbidden: unable to validate against any pod security policy: []

Create a new ClusterRoleBinding named prevent-role-binding, which binds the created ClusterRole prevent-role to the created SA psp-sa.

apiVersion: rbac.authorization.k8s.io/v1
# This role binding allows "jane" to read pods in the "default" namespace. # You need to already have a Role named "pod-reader" in that namespace.
kind: RoleBinding metadata:
name: read-pods namespace: default subjects:
# You can specify more than one "subject"
- kind: User name: jane # "name" is case sensitive apiGroup: rbac.authorization.k8s.io roleRef:
# "roleRef" specifies the binding to a Role / ClusterRole kind: Role #this must be Role or ClusterRole name: pod-reader # this must match the name of the Role or ClusterRole you wish to bind to apiGroup: rbac.authorization.k8s.io apiVersion: rbac.authorization.k8s.io/v1
kind: Role metadata:
namespace: default name: pod-reader rules:
- apiGroups: [""] # "" indicates the core API group resources: ["pods"]
verbs: ["get", "watch", "list"]

Show Answer Next Question

QUESTION: 4

Context

A Role bound to a Pod's ServiceAccount grants overly permissive permissions. Complete the following tasks to reduce the set of permissions.

Task

Given an existing Pod named web-pod running in the namespace security.

Edit the existing Role bound to the Pod's ServiceAccount sa-dev-1 to only allow performing watch operations, only on resources of type services.

Create a new Role named role-2 in the namespace security, which only allows performing update operations, only on resources of type namespaces.

Create a new RoleBinding named role-2-binding binding the newly created Role to the Pod's ServiceAccount.

See Explanation section for answer.

Answer(s): A

Explanation:

Show Answer Next Question

QUESTION: 5

Enable audit logs in the cluster, To Do so, enable the log backend, and ensure that

1. logs are stored at /var/log/kubernetes-logs.txt.
2. Log files are retained for 12 days.
3. at maximum, a number of 8 old audit logs files are retained.
4. set the maximum size before getting rotated to 200MB Edit and extend the basic policy to log:
1. namespaces changes at RequestResponse
2. Log the request body of secrets changes in the namespace kube-system.
3. Log all other resources in core and extensions at the Request level.
4. Log "pods/portforward", "services/proxy" at Metadata level.
5. Omit the Stage RequestReceived
6. All other requests at the Metadata level

See Explanation section for answer.

Answer(s): A

Explanation:

Kubernetes auditing provides a security-relevant chronological set of records about a cluster. Kube- apiserver performs auditing. Each request on each stage of its execution generates an event, which is then pre-processed according to a certain policy and written to a backend. The policy determines what's recorded and the backends persist the records. You might want to configure the audit log as part of compliance with the CIS (Center for Internet Security) Kubernetes Benchmark controls.

The audit log can be enabled by default using the following configuration in cluster.yml:
services:
kube-api:
audit_log:
enabled: true
When the audit log is enabled, you should be able to see the default values at /etc/kubernetes/audit- policy.yaml

The log backend writes audit events to a file in JSONlines format. You can configure the log audit backend using the following kube-apiserver flags:
--audit-log-path specifies the log file path that log backend uses to write audit events. Not specifying this flag disables log backend. - means standard out --audit-log-maxage defined the maximum number of days to retain old audit log files --audit-log-maxbackup defines the maximum number of audit log files to retain --audit-log-maxsize defines the maximum size in megabytes of the audit log file before it gets rotated If your cluster's control plane runs the kube-apiserver as a Pod, remember to mount the hostPath to the location of the policy file and log file, so that audit records are persisted. For example:
--audit-policy-file=/etc/kubernetes/audit-policy.yaml \ --audit-log-path=/var/log/audit.log

Show Answer Next Question

What the CKS Exam Tests and How to Pass It

The Certified Kubernetes Security Specialist (CKS) exam is designed for IT professionals who are responsible for securing container-based applications and Kubernetes platforms. This Linux Foundation certification validates the ability to implement security best practices in a production environment, which is a critical requirement for organizations deploying cloud-native infrastructure. Employers in sectors ranging from finance to healthcare rely on this certification to ensure their engineers possess the specialized skills needed to protect sensitive data and maintain compliance within complex Kubernetes clusters. By passing this exam, candidates demonstrate that they can handle the security lifecycle of a cluster, from initial setup to ongoing runtime protection, which is essential for any DevOps or security engineering role.

What the CKS Exam Covers

The CKS exam evaluates a candidate's proficiency across several critical domains, requiring a deep understanding of how to secure a cluster from the ground up. Candidates must demonstrate competence in Cluster Setup and Cluster Hardening, which involve configuring the control plane and API server with security in mind. Furthermore, the exam tests System Hardening and the ability to Minimize Microservice Vulnerabilities, ensuring that applications running on the platform are isolated and protected against common attack vectors. Supply Chain Security is another major focus, requiring knowledge of how to secure container images and the build pipeline, while Monitoring, Logging and Runtime Security ensures that candidates can detect and respond to threats in real-time. Our practice questions are structured to mirror these domains, allowing you to test your knowledge across the entire spectrum of Kubernetes security.

Among these domains, Supply Chain Security and Runtime Security are often cited as the most technically demanding areas because they require a nuanced understanding of how external threats interact with internal cluster components. Candidates must be able to identify vulnerabilities in container images and implement policies that prevent unauthorized code from executing, which requires more than just theoretical knowledge. This level of technical depth means that rote memorization is insufficient; you must be able to apply security principles to solve complex, scenario-based problems under pressure. Mastering these specific areas is vital, as they represent the most common points of failure in real-world production environments.

Are These Real CKS Exam Questions?

Our platform provides practice questions that are sourced and verified by the community, consisting of IT professionals and recent test-takers who have successfully passed the actual Linux Foundation certification. While we do not provide leaked or confidential exam content, our questions reflect what appears on the real exam because they are derived from the collective experience of those who have navigated the testing environment. If you've been searching for CKS exam dumps or braindump files, our community-verified practice questions offer something more valuable, each question is verified and explained by IT professionals who recently passed the exam. This approach ensures that you are studying relevant, high-quality material that aligns with the current exam objectives rather than relying on outdated or unreliable sources.

Community verification works through a collaborative process where users actively discuss answer choices, flag potentially confusing or incorrect items, and share context from their recent exam experiences. When a question is flagged, it is reviewed by other members of the community to ensure accuracy and clarity, which helps refine the quality of the study material over time. This feedback loop is what makes our practice questions a reliable resource for your exam preparation, as it allows you to learn from the mistakes and insights of others. By engaging with these discussions, you gain a better understanding of the logic behind the correct answers, which is far more effective than simply memorizing patterns.

How to Prepare for the CKS Exam

Effective exam preparation for the CKS requires a hands-on approach, as this is a performance-based exam that tests your ability to execute tasks in a live terminal environment. You should prioritize building a lab environment where you can practice configuring network policies, setting up admission controllers, and auditing cluster logs without relying on external assistance. It is highly recommended to spend significant time reading the official Linux Foundation documentation, as this will be your primary resource during the actual exam. Every practice question includes a free AI Tutor explanation that breaks down the reasoning behind the correct answer, so you understand the concept, not just the answer. By integrating this AI Tutor into your daily study routine, you can bridge the gap between theoretical knowledge and practical application.

A common mistake candidates make is focusing too heavily on memorizing commands rather than understanding the underlying security architecture of Kubernetes. Because the CKS is a performance-based certification exam, you must be comfortable navigating the command line and troubleshooting issues on the fly, which cannot be achieved through passive reading. Time management is another critical factor; many candidates struggle to complete all tasks within the allotted time because they spend too long searching for documentation or debugging simple configuration errors. To avoid this, practice your workflow until you can perform standard security tasks, such as creating a PodSecurityPolicy or configuring an audit policy, with speed and precision.

What to Expect on Exam Day

The CKS exam is a performance-based, hands-on certification exam administered in a proctored, remote environment. You will be expected to solve a series of tasks within a live Kubernetes cluster, meaning you must be proficient in using the command line and editing configuration files under time constraints. The exam environment typically provides access to specific documentation, and you should be familiar with how to navigate these resources quickly to find the information you need. Because the exam is proctored, you must ensure your testing space meets all technical and environmental requirements set by the Linux Foundation. Understanding the format and the constraints of the testing platform is a key part of your overall exam prep strategy.

Who Should Use These CKS Practice Questions

These practice questions are intended for security engineers, DevOps professionals, and system administrators who have significant experience managing Kubernetes clusters and are looking to validate their expertise. We recommend that candidates have a solid foundation in Kubernetes administration, ideally having already passed the CKA (Certified Kubernetes Administrator) exam, as the CKS builds directly upon those core skills. If you are aiming to advance your career by demonstrating your ability to secure cloud-native environments, this certification exam is a logical and highly respected step. Using our platform for your exam preparation will help you identify knowledge gaps and build the confidence necessary to succeed on your first attempt.

To get the most out of these resources, do not simply read the answer and move on; instead, engage with the AI Tutor explanation to ensure you grasp the "why" behind each security configuration. Read the community discussions to see how others approached the same problem, as this often reveals alternative methods or common pitfalls that you might otherwise overlook. If you find yourself consistently getting a specific topic wrong, flag that question and revisit it after reviewing the relevant documentation. Browse the questions above and use the community discussions and AI Tutor to build real exam confidence.

Linux Foundation CKS Exam Prep
Certified Kubernetes Security Specialist (Page 2 )

QUESTION: 1

Explanation:

QUESTION: 2

Explanation:

QUESTION: 3

Explanation:

QUESTION: 4

Explanation:

QUESTION: 5

Explanation:

Why

Why the other options are less suitable

Simple explanation

What the CKS Exam Tests and How to Pass It

What the CKS Exam Covers

Are These Real CKS Exam Questions?

How to Prepare for the CKS Exam

What to Expect on Exam Day

Who Should Use These CKS Practice Questions

Linux Foundation CKS Exam Prep Certified Kubernetes Security Specialist (Page 2 )

QUESTION: 1

Explanation:

QUESTION: 2

Explanation:

QUESTION: 3

Explanation:

QUESTION: 4

Explanation:

QUESTION: 5

Explanation:

Why

Why the other options are less suitable

Simple explanation

What the CKS Exam Tests and How to Pass It

What the CKS Exam Covers

Are These Real CKS Exam Questions?

How to Prepare for the CKS Exam

What to Expect on Exam Day

Who Should Use These CKS Practice Questions

Linux Foundation CKS Exam Prep
Certified Kubernetes Security Specialist (Page 2 )