Sample Questions from Certified Kubernetes Security Specialist (CKS)

Preview a few questions below — answers are revealed when you take the exam.

1. A Kubernetes cluster has been experiencing frequent unauthorized access attempts. To mitigate this, the team needs to implement a robust authentication mechanism. What approach should they take to enhance the security of the cluster's authentication process?

   • Implement mutual TLS authentication using cert-manager to issue and manage certificates for all cluster components, ensuring secure communication and identity verification.
   • Utilize Kubernetes' built-in token-based authentication and rotate tokens frequently to prevent unauthorized access, while also implementing network policies to restrict access to the API server.
   • Configure Kubernetes to use OpenID Connect (OIDC) for authentication, integrating with an external identity provider to manage user access and enforce strong authentication policies.
   • Deploy a custom authentication proxy in front of the Kubernetes API server, which performs additional checks and logging for all authentication requests, enhancing visibility and control over access.

2. Identify the command to create a Kubernetes Role that allows a user to get, list, and watch pods in the default namespace.

   • kubectl create role pod-viewer --verb=get,list,watch --resource=pods --namespace=default
   • kubectl create role pod-viewer --verb=get,list,watch --resource=pods
   • kubectl create clusterrole pod-viewer --verb=get,list,watch --resource=pods --namespace=default
   • kubectl create rolebinding pod-viewer --role=pod-viewer --user=username --namespace=default

3. Consider the situation where a Kubernetes cluster is deployed across multiple cloud providers for high availability. Which method solves it best for ensuring consistent security policies across all environments?

   • Utilize Kubernetes' built-in ConfigMaps and Secrets to store and distribute security configurations, ensuring consistency across environments.
   • Implement a centralized policy management system using Open Policy Agent (OPA) with Gatekeeper to enforce consistent security policies across all Kubernetes clusters.
   • Manually configure security policies on each Kubernetes cluster, ensuring that all environments adhere to the same security standards.
   • Use Kubernetes' native network policies to enforce security rules across all clusters, ensuring consistent application of security policies.

4. What strategy should be applied when securing sensitive data in a Kubernetes cluster to prevent unauthorized access?

   • Encrypt sensitive data at rest using Kubernetes Secrets and ensure that access to these secrets is restricted to authorized users only.
   • Store sensitive data in plain text within ConfigMaps and rely on Kubernetes' RBAC to control access to these resources.
   • Use environment variables to pass sensitive data to applications and rely on Kubernetes' network policies to secure communication.
   • Implement a custom solution that stores sensitive data in an external database and fetches it at runtime, bypassing Kubernetes' built-in security mechanisms.

5. Which architecture supports the requirements of a multi-tenant Kubernetes cluster where different tenants need isolated environments?

   • Implement a multi-cluster architecture using Kubernetes Federation, where each tenant has its own dedicated cluster with isolated resources.
   • Use Kubernetes Namespaces to isolate tenant environments within a single cluster, combined with NetworkPolicies to enforce tenant isolation.
   • Deploy a single-cluster architecture with shared resources and rely on Kubernetes' RBAC to control tenant access to resources.
   • Configure Kubernetes to use Pod Security Policies (PSPs) to enforce tenant isolation and resource limits within a single cluster.