In a CI/CD pipeline, where is the most appropriate stage to run a static analysis tool like KubeLinter on Kubernetes manifests?

Only when a security incident occurs

At the same time as the application is being load-tested

After the workload has been running for a week to collect runtime data

Before the manifests are applied to the cluster

A team uses KubeLinter to lint their Helm charts in CI. They want to ensure that no chart can deploy a workload with `privileged: true`. They have a `values.yaml` that conditionally sets `privileged` based on an environment variable. Which KubeLinter configuration is most appropriate?

Enable the `privileged` check and set `failOn` to `error`.

Use `--add-check` to add a custom check for `privileged`.

Disable the `privileged` check because Helm charts are not supported by KubeLinter.

Set `failOn` to `warning` to allow warnings but not fail the build.

When using Kubesec to analyze a Kubernetes deployment manifest, what does a higher risk score indicate?

The manifest is more secure and has fewer potential security issues

The manifest has a greater number of potential security risks

The manifest contains syntax errors that prevent it from being applied

The manifest is ready for production deployment without further review

What is the main benefit of integrating static analysis tools into a CI/CD pipeline?

It eliminates the need for any manual code reviews

Security issues are detected early in the development process, reducing the cost of fixing them

It automatically patches all vulnerabilities found in the code

It guarantees that no security vulnerabilities will exist in the final deployment

What is the primary function of KubeLinter?

To scan container images for known vulnerabilities

To monitor running pods and provide real-time security alerts

To check Kubernetes YAML files and Helm charts for security and best-practice violations

To enforce network policies in a Kubernetes cluster

Certified Kubernetes Security Specialist (CKS)

Domain 2Objective 4

Perform Static Analysis of User Workloads and Container Images (e.g. Kubesec, KubeLinter) CKS Practice Questions (Page 1)

Part of the Minimize Microservice Vulnerabilities domain, which accounts for 20% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

6concepts

20%of the exam

Questions 1–5

1foundation · easy
In a CI/CD pipeline, where is the most appropriate stage to run a static analysis tool like KubeLinter on Kubernetes manifests?
Select an answer first
2application · medium
A team uses KubeLinter to lint their Helm charts in CI. They want to ensure that no chart can deploy a workload with `privileged: true`. They have a `values.yaml` that conditionally sets `privileged` based on an environment variable. Which KubeLinter configuration is most appropriate?
Select an answer first
3foundation · easy
When using Kubesec to analyze a Kubernetes deployment manifest, what does a higher risk score indicate?
Select an answer first
4foundation · easy
What is the main benefit of integrating static analysis tools into a CI/CD pipeline?
Select an answer first
5foundation · easy
What is the primary function of KubeLinter?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.