Secure Cluster Components CKS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of the CIS Kubernetes Benchmark?

   • ATo define the minimum hardware requirements for a production cluster
   • BTo automatically patch vulnerabilities in a running Kubernetes cluster
   • CTo provide a set of best-practice recommendations for securely configuring Kubernetes components
   • DTo replace the need for role-based access control (RBAC) in a cluster
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a recommended security practice for CoreDNS according to the CIS Kubernetes Benchmark?

   • ADisable all logging to reduce resource usage
   • BUse the default configuration without any modifications
   • CExpose CoreDNS directly to the internet for external DNS resolution
   • DRun CoreDNS with the least privilege required, such as a non-root user and minimal capabilities
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the purpose of verifying the checksum of a Kubernetes binary before deployment?

   • ATo ensure the binary has not been tampered with or corrupted during download
   • BTo verify the binary is from a trusted source
   • CTo confirm the binary is compatible with the operating system
   • DTo check the binary for known vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A cluster is experiencing issues with the kubelet's authorization. The kubelet is configured with `--authorization-mode=Webhook`. The kube-apiserver is configured with `--authorization-mode=RBAC`. Some kubelet requests are being denied, and the administrator suspects a misconfiguration. What is the most likely cause of the kubelet's authorization failures?

   • AThe kubelet's webhook configuration is pointing to the wrong kube-apiserver endpoint.
   • BThe kubelet is not configured with `--anonymous-auth=false`.
   • CThe kube-apiserver is not configured with the `--authorization-mode=Webhook` flag.
   • DThe kubelet's client certificate is not signed by the cluster's CA.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security auditor is reviewing a Kubernetes cluster against the CIS Kubernetes Benchmark. The auditor notes that the kube-apiserver is configured with `--etcd-certfile` and `--etcd-keyfile`, but the etcd server itself is listening on a plain HTTP endpoint. The auditor flags this as a critical finding. Which remediation should the team implement to address the root cause of this finding?

   • AConfigure etcd to serve only HTTPS traffic by setting `--client-cert-auth=true` and providing `--cert-file` and `--key-file`.
   • BRestrict network access to etcd by adding a NetworkPolicy that only allows traffic from the kube-apiserver pods.
   • CRemove the `--etcd-certfile` and `--etcd-keyfile` flags from the kube-apiserver since etcd is not using TLS.
   • DSet the `--insecure-skip-tls-verify` flag on the kube-apiserver to allow it to connect to the plain HTTP etcd endpoint.
   Reveal Solution Discussion Select an answer first