CKS

Certified Kubernetes Security Specialist

10 Free 90 Pro

Sign in for free to access all 10 free questions.

Showing 12 of 100 questions

cks-01 beginner

Free

Enable and Audit Kubernetes API Server Flags

Review the kube-apiserver configuration for insecure security flags and disable them following CIS Benchmark recommendations.

Cluster Setup 15m est.

cks-02 beginner

Free

Scan Container Images with Trivy

Run Trivy to scan container images for CVEs, interpret results, and replace a vulnerable image with a secure alternative.

Workload Security 15m est.

cks-03 beginner

Free

Apply a PodSecurity Admission Standard

Configure a namespace to enforce the "restricted" Pod Security Standard and verify that non-compliant pods are rejected.

Workload Security 15m est.

cks-04 beginner

Free

Encrypt Kubernetes Secrets at Rest

Configure the API server to encrypt Secrets in etcd using AES-CBC encryption and verify the encryption is applied.

Secrets Management 25m est.

cks-05 beginner

Free

Audit RBAC Permissions and Remove Excessive Access

Identify over-privileged ServiceAccounts using kubectl auth can-i and remove unnecessary ClusterRoleBindings.

RBAC 20m est.

cks-23 beginner

Free

Enforce Pod Security Context

Configure a pod to run as non-root with dropped capabilities and read-only root filesystem.

Pod Security Context 20m est.

cks-27 beginner

Free

Enforce Read-Only Root Filesystem for Pods

Configure a deployment to use readOnlyRootFilesystem with an emptyDir volume.

Read-Only Root Filesystem 15m est.

cks-31 beginner

Free

Use a ServiceAccount with Minimal RBAC

Create a service account and bind it to a minimal Role.

ServiceAccount RBAC 15m est.

cks-38 beginner

Free

Limit Resource Usage with ResourceQuota

Create a ResourceQuota to limit CPU and memory usage in a namespace.

ResourceQuota 15m est.

cks-71 beginner

Free

Disable Anonymous Authentication on Kubelet

Configure the kubelet to reject anonymous requests by setting the --anonymous-auth flag to false in the kubelet configuration.

Cluster Hardening 20m est.

cks-73 beginner

Implement Pod Security Standards (Baseline)

Label a namespace with the Pod Security Standard "baseline" enforce level to block privileged pods from running.

Workload Security 15m est.

cks-76 beginner

Create ServiceAccount and Bind to ClusterRole

Create a ServiceAccount that has cluster-wide read-only access to all cluster resources via a ClusterRoleBinding.

RBAC 15m est.

...