Secure Cluster Components CKS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A DevOps engineer is downloading the `kube-apiserver` binary for a new cluster. They want to verify the integrity and authenticity of the binary before deploying it. They have downloaded the binary and the corresponding checksum file from the official Kubernetes release page. Which command should they use to verify the binary?

   • A`gpg --verify kube-apiserver.sha512`
   • B`openssl dgst -sha256 -verify kube-apiserver`
   • C`cksum kube-apiserver`
   • D`sha512sum -c kube-apiserver.sha512`
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security review of a cluster finds that the CoreDNS deployment is running with the default service account and has the `automountServiceAccountToken` set to `true`. The cluster uses Kubernetes 1.24+. Which action should be taken to align with the CIS benchmark's least-privilege principle?

   • ADisable the CoreDNS service account by setting `serviceAccountName: ""` in the deployment.
   • BSet `automountServiceAccountToken: false` on the CoreDNS deployment while keeping the default service account.
   • CCreate a dedicated service account for CoreDNS and set `automountServiceAccountToken: false` on the deployment.
   • DCreate a Role and RoleBinding that grants the default service account access to the kube-system namespace.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A cluster administrator is configuring a new kubelet for a worker node. They want to ensure that the kubelet only serves requests from the kube-apiserver. The kubelet is configured with `--anonymous-auth=false` and `--authorization-mode=Webhook`. What additional configuration is required to ensure the kube-apiserver can authenticate to the kubelet?

   • AConfigure the kubelet with `--kubeconfig` pointing to a kubeconfig file that contains a client certificate for the kubelet.
   • BConfigure the kube-apiserver with `--kubelet-certificate-authority` pointing to the CA that signed the kubelet's serving certificate.
   • CSet `--read-only-port=0` on the kubelet to disable the insecure read-only port.
   • DSet `--authentication-token-webhook=true` on the kubelet.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security scan of a cluster reports that CoreDNS is running with elevated privileges. The CIS benchmark recommends that CoreDNS run with the least privileges possible. Which configuration change should be made to the CoreDNS deployment?

   • ASet the CoreDNS container to run as the `root` user to ensure it has all necessary permissions.
   • BAdd a `securityContext` to the CoreDNS container that sets `allowPrivilegeEscalation: false` and `readOnlyRootFilesystem: true`.
   • CSet the CoreDNS container's `privileged` flag to `true` to ensure it can bind to port 53.
   • DRemove the `securityContext` from the CoreDNS deployment to allow it to use the default settings.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a CIS benchmark recommendation for securing communication with CoreDNS?

   • AUse plain UDP for all DNS queries to reduce overhead
   • BUse TLS for DNS queries where supported
   • CAllow all pods to access CoreDNS without any network policies
   • DDisable CoreDNS and use external DNS servers
   Reveal Solution Discussion Select an answer first