CKS Exam Questions

PART B -- FIX ONE prominent security/best-practice issue in the Deployment manifest. 4) Open the manifest `vi /home/candidate/subtle-bee/deployment.yaml` 5) Change ONLY ONE existin...

Context: For testing purposes, the kubeadm provisioned cluster 's API server was configured to allow unauthenticated and unauthorized access. Task: First, secure the cluster 's API...

Question: 53 SIMULATION Context A Pod is misbehaving and poses a security threat to the system. Task One of the Pods belonging to the application ollama is misbehaving. It is direc...

Context You must implement auditing for the kubeadm provisioned cluster. Task First, reconfigure the cluster 's API server, so that: . the basic audit policy located at /etc/kubern...

3) Edit the ImagePolicyWebhook config. One of these is true on your cluster: Option 1 (most common in these tasks): ImagePolicyWebhook config is a standalone file. Option 2: ImageP...

You must connect to the correct host (e.g., via `ssh cks000031`). You are required to implement NetworkPolicies controlling the traffic flow of existing Deployments across namespac...

Context: You must expose a web application using HTTPS routes. Task: Create an Ingress resource named web in the prod namespace and configure it as follows: . Route traffic for hos...

PART C -- Point backend configuration to https://smooth-yak.local/review. 4) Edit the webhook kubeconfig to use the scanner endpoint.

A security audit has identified a Deployment improperly handling service account tokens, which could lead to security vulnerabilities. First, modify the existing ServiceAccount sta...

PART D -- Restart effect (make sure API server picks up config).

Context: The kubeadm provisioned cluster was recently upgraded, leaving one node on a slightly older version due to workload compatibility concerns. Task: Upgrade the cluster node...

PART E -- Test: apply vulnerable workload and confirm it is denied. 5) Use admin kubeconfig (because old kubectl config may break). 6) Deploy the test resource (should be DENIED).

PART F -- Verify the scanner was called (log check). 7) Check scanner access log. Quick "what to check if it doesn't deny"

Task: The alpine Deployment in the alpine namespace has three containers that run different versions of the alpine image. First, find out which version of the alpine image contains...

Question: 52 SIMULATION You must connect to the correct host. Failure to do so may result in a zero score. Analyze and edit the Dockerfile located at /home/candidate/subtle-bee/bui...

For compliance, all user namespaces enforce the restricted Pod Security Standard. The confidential namespace contains a Deployment that is not compliant with the restricted Pod Sec...

Fix one prominent security/best-practice issue in the Deployment manifest located at `/home/candidate/subtle-bee/deployment.yaml`. You must change ONLY ONE existing field that is a...

Perform the following tasks to secure the cluster node cks000037 : Remove user developer from the docker group. Do not remove the user from any other group. Reconfigure and restart...

Perform the following tasks to secure an existing application's Layer 4 (L4) transport communication using Istio.

One of the Pods belonging to the application ollama is misbehaving. It is directly accessing the system's memory reading from the sensitive file /dev/mem. The cluster uses the Dock...

You must connect to the correct host. Failure to do so may result in a zero score. [candidate@base]$ ssh cks000028 Context You must update an existing Pod to ensure the immutabilit...

Ensure that all Pods in the `mtls` namespace have the `istio-proxy` sidecar injected. Then, configure mutual authentication in `strict` mode for all workloads in the `mtls` namespa...

Context You must implement auditing for the kubeadm provisioned cluster. Task First, reconfigure the cluster 's API server, so that: . the basic audit policy located at /etc/kubern...

You must complete securing access to a web server using SSL files stored in a TLS Secret. Create a TLS Secret named `clever-cactus` in the `clever-cactus` namespace for an existing...

You must connect to the correct host. Failure to do so may result in a zero score. Context You must implement NetworkPolicies controlling the traffic flow of existing Deployments a...

PART A -- Deny ALL ingress traffic in prod namespace. Requirement: NetworkPolicy name: deny-policy, Namespace: prod (namespace is labeled env=prod), Effect: block all ingress.

PART B -- Allow ingress to data ONLY from Pods in prod. Requirement: NetworkPolicy name: allow-from-prod, Namespace: data (namespace is labeled env=data), Allow ingress only from P...

A security audit has identified a Deployment improperly handling service account tokens, which could lead to security vulnerabilities. First, modify the existing ServiceAccount sta...

Upgrade the cluster node compute-0 to match the version of the control plane node. You must connect to the correct host. Failure to do so may result in a zero score. [candidate@bas...

The alpine Deployment in the alpine namespace has three containers that run different versions of the alpine image. First, find out which version of the alpine image contains the l...

For compliance, all user namespaces enforce the restricted Pod Security Standard. The confidential namespace contains a Deployment that is not compliant with the restricted Pod Sec...

Perform the following tasks to secure the cluster node cks000037: Remove user developer from the docker group. Do not remove the user from any other group. Reconfigure and restart...

Context: A microservices-based application using unencrypted Layer 4 (L4) transport must be secured with Istio. Task: Perform the following tasks to secure an existing application'...

Istio is installed to secure Layer 4 (L4) communications. You may use your browser to access Istio's documentation. First, ensure that all Pods in the mtls namespace have the istio...

You must complete securing access to a web server using SSL files stored in a TLS Secret. Create a TLS Secret named clever-cactus in the clever-cactus namespace for an existing Dep...