A security audit of a cluster reveals that the kube-apiserver is configured with `--authorization-mode=AlwaysAllow`. The cluster is running in a production environment with multiple teams. Which configuration change should be made to enforce fine-grained access control?

Set `--authorization-mode=Node` on the kube-apiserver.

Set `--authorization-mode=ABAC` on the kube-apiserver.

Set `--authorization-mode=Webhook` on the kube-apiserver.

Set `--authorization-mode=RBAC` on the kube-apiserver.

A DevOps engineer is responsible for downloading and verifying Kubernetes binaries for a new cluster. They have downloaded the `kubelet` binary and its checksum file. They have verified the checksum, but they are concerned about a supply-chain attack where the checksum file itself could be compromised. What additional step should they take to mitigate this risk?

Verify the GPG signature of the checksum file using the Kubernetes release signing key.

Download the binary from a mirror site to ensure it is the correct version.

Run the binary in a sandbox environment to test its behavior.

Compare the binary's checksum with the checksum from the release notes.

What is a key consideration when planning a Kubernetes upgrade?

Upgrade nodes before the control plane

Skip minor version upgrades to save time

Upgrade all components simultaneously to minimize downtime

Upgrade components in a specific order, such as control plane before nodes

A cluster is running Kubernetes v1.24.3. The security team has identified a critical vulnerability in the kube-apiserver that is patched in v1.24.7. The team needs to upgrade the cluster to a patched version with minimal downtime. Which upgrade strategy should they follow?

Upgrade the cluster to v1.25.0, then to v1.26.0, and finally to v1.27.0 to ensure all features are up to date.

Upgrade the cluster directly from v1.24.3 to v1.24.7, following the standard upgrade procedure for patch releases.

Upgrade the cluster to v1.25.0 and then apply the security patch manually to the kube-apiserver binary.

Upgrade the cluster to v1.24.4, then to v1.24.5, and finally to v1.24.7 to follow a strict sequential patch upgrade path.

According to the CIS Kubernetes Benchmark, which of the following is a recommended security setting for etcd?

Enable client certificate authentication for all etcd connections

Allow anonymous access to etcd for simplicity

Use the default etcd port without any network restrictions

Disable TLS encryption to improve performance

Certified Kubernetes Security Specialist (CKS)

Domain 1Objective 1

Secure Cluster Components CKS Practice Questions (Page 1)

Part of the Cluster Setup domain, which accounts for 15% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

7concepts

15%of the exam

Questions 1–5

1application · medium
A security audit of a cluster reveals that the kube-apiserver is configured with `--authorization-mode=AlwaysAllow`. The cluster is running in a production environment with multiple teams. Which configuration change should be made to enforce fine-grained access control?
Select an answer first
2expert · hard
A DevOps engineer is responsible for downloading and verifying Kubernetes binaries for a new cluster. They have downloaded the `kubelet` binary and its checksum file. They have verified the checksum, but they are concerned about a supply-chain attack where the checksum file itself could be compromised. What additional step should they take to mitigate this risk?
Select an answer first
3foundation · easy
What is a key consideration when planning a Kubernetes upgrade?
Select an answer first
4application · medium
A cluster is running Kubernetes v1.24.3. The security team has identified a critical vulnerability in the kube-apiserver that is patched in v1.24.7. The team needs to upgrade the cluster to a patched version with minimal downtime. Which upgrade strategy should they follow?
Select an answer first
5foundation · easy
According to the CIS Kubernetes Benchmark, which of the following is a recommended security setting for etcd?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.