CKS Kubernetes Cluster Hardening Quiz

1. Which etcd encryption algorithm is recommended for production Kubernetes clusters?

Aescbc

Md5

Sha256

Base64

2. What is the recommended approach for scanning container images in a CI/CD pipeline?

Integrate vulnerability scanning before image push to registry

Scan only after deployment

Manual scanning monthly

Disable scanning in production

3. Which tool is used to manage Kubernetes secrets encryption at rest?

Kms-plugin

Etcdctl

Kubelet

Apiserver

4. What is the purpose of a ClusterRole compared to a Role?

ClusterRole grants permissions across all namespaces

ClusterRole is faster than Role

ClusterRole manages cluster nodes

ClusterRole encrypts data

5. Which SecurityContext field prevents privilege escalation in a pod?

AllowPrivilegeEscalation: false

RunAsNonRoot: true

ReadOnlyRootFilesystem: true

Capabilities.drop: ALL

6. What command secures the kubelet API server with TLS?

--tls-cert-file and --tls-private-key-file flags

--secure-port flag

--enable-tls flag

--kubelet-tls flag

7. Which admission controller validates resource requests against namespace quotas?

ResourceQuota

LimitRanger

PodSecurityPolicy

ValidatingWebhook

8. What is the main benefit of using a service account token over kubeconfig for pod authentication?

Automatic token rotation and namespace-scoped permissions

Faster API calls

Simpler syntax

No encryption needed

9. Which kubectl command lists all RBAC roles in a namespace?

Kubectl get roles

Kubectl list rbac

Kubectl describe roles

Kubectl auth roles

10. What does the 'restricted' Pod Security Standard enforce?

Strict security constraints including no root, read-only filesystem, and capability restrictions

Allow all pod configurations

Only restrict network access

Limit pod replicas

11. Which Kubernetes API group is used to define Role and RoleBinding objects?

Rbac.authorization.k8s.io

Auth.k8s.io

Security.k8s.io

Core.k8s.io

12. What is the purpose of the NodeRestriction admission controller?

Prevent nodes from modifying their own labels and taints

Restrict pod scheduling to specific nodes

Encrypt node-to-node communication

Limit CPU and memory on nodes

13. Which Kubernetes object defines permissions for a specific user or service account?

RoleBinding

Namespace

Pod

ConfigMap

14. Pod Security Standards (PSS) replaced which deprecated feature?

PodSecurityPolicy

NetworkPolicy

ServiceAccount

ClusterRole

15. Which API server flag enables audit logging in Kubernetes?

--audit-log-path

--log-audit

--enable-logging

--audit-enabled

16. What is the default service account used by pods in a namespace?

Default

Admin

System

Cluster-admin

17. Which tool is used to scan container images for known vulnerabilities?

Trivy

Kubectl

Etcd

CoreDNS

18. What does RBAC stand for in Kubernetes?

Role-Based Access Control

Resource-Based Authentication Control

Routing-Based Application Cluster

Replication-Based Availability Cluster

19. Which admission controller prevents pods from running as root?

PodSecurityPolicy

ResourceQuota

ServiceAccount

NodeRestriction

20. What is the primary purpose of a NetworkPolicy in Kubernetes?

Manage pod-to-pod and pod-to-external traffic at the network layer

Encrypt all cluster communication

Allocate resources to pods

Schedule pods on specific nodes

CKS Kubernetes Cluster Hardening Quiz

1. Which etcd encryption algorithm is recommended for production Kubernetes clusters?

2.

What first name or nickname would you like us to use?

2. What is the recommended approach for scanning container images in a CI/CD pipeline?

3. Which tool is used to manage Kubernetes secrets encryption at rest?

4. What is the purpose of a ClusterRole compared to a Role?

5. Which SecurityContext field prevents privilege escalation in a pod?

6. What command secures the kubelet API server with TLS?

7. Which admission controller validates resource requests against namespace quotas?

8. What is the main benefit of using a service account token over kubeconfig for pod authentication?

9. Which kubectl command lists all RBAC roles in a namespace?

10. What does the 'restricted' Pod Security Standard enforce?

11. Which Kubernetes API group is used to define Role and RoleBinding objects?

12. What is the purpose of the NodeRestriction admission controller?

13. Which Kubernetes object defines permissions for a specific user or service account?

14. Pod Security Standards (PSS) replaced which deprecated feature?

15. Which API server flag enables audit logging in Kubernetes?

16. What is the default service account used by pods in a namespace?

17. Which tool is used to scan container images for known vulnerabilities?

18. What does RBAC stand for in Kubernetes?

19. Which admission controller prevents pods from running as root?

20. What is the primary purpose of a NetworkPolicy in Kubernetes?