10 beginner questions on the CKS curriculum domains: Cluster Setup, Cluster Hardening, System Hardening, Minimize Microservice Vulnerabilities, Supply Chain Security, and Monitoring, Logging and Runtime Security. They cover network policies, RBAC, service account tokens, seccomp, Pod Security Standards, Secrets, image digests, admission control and audit logs. The real exam is hands-on; these questions check the concepts behind its tasks.

Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.

  1. A team wants pods in the payments namespace to accept incoming traffic only from pods labelled app=frontend. Which Kubernetes object should they create?

    • A. A ResourceQuota for the payments namespace
    • B. A NetworkPolicy allowing ingress from app=frontend ✔ correct
    • C. A PodDisruptionBudget for the payments pods
    • D. A LimitRange with default CPU and memory limits

    Answer: B. A NetworkPolicy selects pods and lists the allowed ingress sources, here pods labelled app=frontend. Once a pod is selected by an ingress policy, other inbound traffic is denied. Quotas, limit ranges and disruption budgets do not filter traffic.

    Source: kubernetes.io/docs/concepts/services-networking/network-policies/ · Domain: Cluster Setup

  2. Creating a NetworkPolicy object has no effect unless the cluster's network plugin implements network policies.

    • A. True ✔ correct
    • B. False

    Answer: A. True. Network policies are enforced by the network plugin (CNI). If the plugin does not support them, the API server still accepts the object, but no traffic is filtered.

    Source: kubernetes.io/docs/concepts/services-networking/network-policies/ · Domain: Cluster Setup

  3. An administrator must give a monitoring service account read-only access to Pods in the shop namespace and nowhere else. Which setup follows least privilege?

    • A. A ClusterRole with get, list, watch on pods, bound by a ClusterRoleBinding
    • B. The cluster-admin ClusterRole, bound by a RoleBinding in shop
    • C. A Role in shop with get, list, watch on pods, bound by a RoleBinding ✔ correct
    • D. A Role in shop with create and delete on pods, bound by a RoleBinding

    Answer: C. A Role with a RoleBinding grants permissions inside one namespace only, and the verbs get, list and watch allow reading without changes. A ClusterRoleBinding grants access in every namespace, and cluster-admin grants far too much.

    Source: kubernetes.io/docs/reference/access-authn-authz/rbac/ · Domain: Cluster Hardening

  4. A web application pod never calls the Kubernetes API. How can an engineer stop the pod from receiving a service account API token that it does not need?

    • A. Set automountServiceAccountToken: false in the pod spec ✔ correct
    • B. Set hostNetwork: true in the pod spec
    • C. Run the pod in the kube-system namespace
    • D. Set imagePullPolicy: Always on the container

    Answer: A. Setting automountServiceAccountToken: false on the pod (or on its service account) opts out of mounting API credentials, so a compromised container has no token to reuse. The other settings do not control token mounting.

    Source: kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ · Domain: Cluster Hardening

  5. Which securityContext setting applies the container runtime's default seccomp profile to restrict the system calls a container can make?

    • A. seccompProfile: {type: Unconfined}
    • B. privileged: true
    • C. allowPrivilegeEscalation: true
    • D. seccompProfile: {type: RuntimeDefault} ✔ correct

    Answer: D. RuntimeDefault applies the runtime's default seccomp profile, which blocks many risky system calls. Unconfined turns seccomp off, and the privileged and privilege-escalation settings weaken isolation instead of hardening it.

    Source: kubernetes.io/docs/tutorials/security/seccomp/ · Domain: System Hardening

  6. A platform team is hardening workloads to follow the Pod Security Standards Restricted profile. Which two settings are consistent with that profile? (Select TWO)

    • A. runAsNonRoot: true ✔ correct
    • B. privileged: true
    • C. allowPrivilegeEscalation: false ✔ correct
    • D. hostNetwork: true
    • E. capabilities: {add: ["SYS_ADMIN"]}

    Answer: A, C. The Restricted profile requires containers to run as non-root and to set allowPrivilegeEscalation: false. Privileged containers, host networking and adding capabilities such as SYS_ADMIN are not allowed.

    Source: kubernetes.io/docs/concepts/security/pod-security-standards/ · Domain: Minimize Microservice Vulnerabilities

  7. A security engineer asks how Kubernetes Secret values are protected in etcd on a cluster that still uses the default API server settings. What is the correct answer?

    • A. They are encrypted with a key created when the cluster is installed
    • B. They are stored unencrypted unless encryption at rest is enabled ✔ correct
    • C. They are hashed, so nobody can read the original value back
    • D. They are kept in kubelet memory and never written to etcd

    Answer: B. By default, Secrets are stored unencrypted in etcd; base64 is only an encoding. Enable encryption at rest, restrict access to etcd and use RBAC to limit who can read Secrets.

    Source: kubernetes.io/docs/concepts/configuration/secret/ · Domain: Minimize Microservice Vulnerabilities

  8. To be sure that a pod always runs exactly the same image content, even if someone later pushes a new image under the same tag, how should the image be referenced?

    • A. By its digest (app@sha256:...) ✔ correct
    • B. By the latest tag
    • C. With imagePullPolicy: Always
    • D. By a version tag such as app:1.4

    Answer: A. A digest identifies one exact image content, so the pod always gets the same image. Tags, including version tags and latest, can be moved to another image; Always only forces a fresh pull of whatever the tag points to.

    Source: kubernetes.io/docs/concepts/containers/images/ · Domain: Supply Chain Security

  9. A company wants the API server to reject any new pod whose image does not come from its own approved registry. Which mechanism enforces this when the pod is created?

    • A. A RuntimeClass that selects a sandboxed runtime
    • B. A validating admission policy or admission webhook ✔ correct
    • C. A PriorityClass for workloads from the approved registry
    • D. A LimitRange that applies to every namespace

    Answer: B. Admission control can reject API requests before objects are stored. A ValidatingAdmissionPolicy (or a validating webhook) can check each pod's image against the permitted registries. RuntimeClass, PriorityClass and LimitRange do not validate image sources.

    Source: kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/ · Domain: Supply Chain Security

  10. An administrator needs to find out which user deleted a Deployment yesterday. Which source records who sent each request to the API server?

    • A. The container logs of the Deployment's pods
    • B. The metrics collected by metrics-server
    • C. The Kubernetes audit log ✔ correct
    • D. The node's kubelet configuration file

    Answer: C. Kubernetes auditing records a chronological set of API server requests, including the user, the action and the resource, as defined by the audit policy. Pod logs and metrics do not show who changed cluster objects.

    Source: kubernetes.io/docs/tasks/debug/debug-cluster/audit/ · Domain: Monitoring, Logging and Runtime Security

Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public CNCF / Linux Foundation exam objectives (CNCF CKS curriculum v1.34 (github.com/cncf/curriculum); LF page: exam based on Kubernetes v1.35), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by CNCF / Linux Foundation; exam names are trademarks of their owners. Official exam page: training.linuxfoundation.org/certification/certified-kubernetes-securi.

Last modified: Sunday, 25 October 2026, 9:57 PM