30 Free CKS Practice Questions — Certified Kubernetes Security Specialist

Preparing for the CKS? These 30 free practice questions cover all CKS domains.

---

Cluster Setup and Hardening (Questions 1–8)

Question 1

Which CIS benchmark section addresses API server hardening?

a) Section 1 — Control Plane Components
b) Section 2 — Worker Nodes
c) Section 3 — Policies
d) Section 4 — Managed Services

Show Answer

Answer: a) Section 1 — Control Plane Components

Explanation: CIS Benchmark Section 1 covers control plane: API server, controller manager, scheduler, etcd configuration and security settings.

Question 2

Which kubelet flag enables TLS certificate rotation?

a) --rotate-certificates
b) --tls-cert-file
c) --auto-rotate
d) --enable-cert-rotation

Show Answer

Answer: a) --rotate-certificates

Explanation: --rotate-certificates=true enables automatic rotation of TLS certificates when they approach expiry. --rotate-server-certificates enables serving certificate rotation.

Questions 3–8

[Full set covers kube-bench, etcd encryption, RBAC hardening, API server audit logging]

---

Cluster Hardening (Questions 9–12)

Question 3

Which tool enforces policies as admission controllers?

a) OPA/Gatekeeper
b) Falco
c) Trivy
d) kube-bench

Show Answer

Answer: a) OPA/Gatekeeper

Explanation: OPA (Open Policy Agent) with Gatekeeper enforces admission control policies (e.g., "containers cannot run as root"). Falco is runtime security. Trivy scans vulnerabilities.

Question 4

What are the three Pod Security Standards?

a) Low, Medium, High
b) Privileged, Baseline, Restricted
c) Standard, Enhanced, Maximum
d) Basic, Secure, Hardened

Show Answer

Answer: b) Privileged, Baseline, Restricted

Explanation: Privileged (unrestricted, for system-level pods), Baseline (minimally restrictive, prevents known escalations), Restricted (most secure, hardened).

Questions 5–12

[Full set covers PodSecurity admission, service account hardening, namespace restrictions]

---

Supply Chain Security (Questions 13–17)

Question 5

Which tool signs container images?

a) Cosign
b) Trivy
c) Falco
d) Anchore

Show Answer

Answer: a) Cosign

Explanation: Cosign (part of Sigstore) signs and verifies container images. Trivy and Anchore scan for vulnerabilities. Falco monitors runtime.

Questions 6–17

[Full set covers image scanning, admission controller webhooks, image policy, and SBOM]

---

Runtime Security (Questions 18–30)

Question 6

Which runtime security tool monitors syscalls for suspicious activity?

a) Falco
b) Trivy
c) OPA
d) kube-hunter

Show Answer

Answer: a) Falco

Explanation: Falco monitors system calls and container activity using rules to detect anomalous behavior. It's the CNCF's runtime security tool.

Question 7

What is the purpose of Seccomp in container security?

a) Limiting network access
b) Restricting system calls a container can make
c) Scanning for vulnerabilities
d) Encrypting container data

Show Answer

Answer: b) Restricting system calls a container can make

Explanation: Seccomp (Secure Computing Mode) filters system calls available to a container. A default seccomp profile blocks dangerous syscalls.

Questions 8–30

[Full set covers AppArmor, gVisor, user namespaces, audit logging, immutable pods, and runtime classes]

---

How Did You Score?

Access all CKS practice questions →