Certified Kubernetes Security Specialist (CKS)
Domain 4Objective 3
Investigate and Identify Phases of Attack and Bad Actors Within the Environment CKS Practice Questions (Page 1)
Part of the Supply Chain Security domain, which accounts for 20% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 16 practice questions to prepare you well beyond it. (estimate)
16questions here
4free pages
5concepts
20%of the exam
Questions 1–5
- 1
A security team is investigating a breach where an attacker gained access to the cluster through a compromised service account. The attacker then created a deployment that runs a container with a hostPath volume, mounting the node's filesystem. The container is running a script that collects and sends data to an external server. Which phase of the attack lifecycle does the data exfiltration represent?
Select an answer first - 2
A security analyst is investigating a potential security incident. They notice that a pod is making API calls to create pods with hostPath volumes. The pod's service account has permission to create pods. Which indicator of compromise (IoC) is this?
Select an answer first - 3
A company has a Kubernetes cluster that hosts a customer-facing web application. An incident response team discovers that a pod in the 'web' namespace is running a cryptocurrency miner. The pod was created with a service account that is only used by a CI/CD pipeline. Which type of bad actor is most likely responsible?
Select an answer first - 4
An attacker who has gained access to a node wants to read the cluster's configuration data, including secrets. Which Kubernetes component stores this sensitive data and is a high-value target on the attack surface?
Select an answer first - 5
Which of the following is a common indicator of compromise (IoC) in a Kubernetes environment?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.