CKS Exam Prep 2026 Updated Practice
Questions, Comprehensive Kubernetes Security
Review, Detailed Rationales, Verified Answers,
Complete Success Workbook
Exam Domains & Weights:
Domain Weight
1. Cluster Setup 10–15%
2. Cluster Hardening 15%
3. System Hardening 10–15%
4. Minimize Microservice Vulnerabilities 20%
5. Supply Chain Security 20%
6. Monitoring, Logging, and Runtime Security 20%
CRITICAL NOTE: The CKS exam is NOT multiple-choice. It is
a practical, hands-on exam where you perform real Kubernetes security tasks.
This guide includes scenario-based practice questions to test your knowledge,
but you must practice hands-on in a lab environment to succeed.
Key 2026 Updates:
• Cluster Setup domain weight increased from 10% to 15%
• New focus on ingress with TLS configuration
• Emphasis on CIS benchmarks, network policies, and node metadata
, • Tools tested: Trivy, Falco, OPA/Gatekeeper, kube-bench, Cosign, gVisor
Exam Environment:
• Multiple clusters with different contexts
• Third-party security tools pre-installed (Trivy, Falco, kube-bench, etc.)
• You may reference official documentation during the exam
DOMAIN 1: CLUSTER SETUP (10–15%)
Question 1
A cluster administrator needs to set up a new Kubernetes cluster with security best
practices. Which CIS Benchmark component should be reviewed first to ensure the
cluster is configured securely?
A. Pod Security Standards
B. CIS Kubernetes Benchmark
C. OPA Gatekeeper policies
D. Network policies
Answer: B. CIS Kubernetes Benchmark
Rationale: The CIS Kubernetes Benchmark provides a comprehensive set of
security configuration recommendations for Kubernetes components including the
API server, controller manager, scheduler, etcd, and worker nodes. Reviewing the
CIS Benchmark is the foundational step for secure cluster setup. Pod Security
Standards (A), OPA policies (C), and Network Policies (D) are important but come
after the baseline CIS Benchmark review.
Question 2
An administrator needs to configure the Kubernetes API server to enable audit
logging. Which API server flag enables audit logging?
A. --audit-policy-file
B. --audit-log-path
,C. --audit-webhook-config-file
D. --enable-admission-plugins
Answer: A. --audit-policy-file
Rationale: The --audit-policy-file flag specifies the path to a file that defines the
audit policy configuration. This is required to enable audit logging. --audit-log-
path (B) specifies where to write audit logs but does not enable audit logging
itself. --audit-webhook-config-file (C) is for sending audit events to a webhook. --
enable-admission-plugins (D) enables admission controllers, not audit logging.
Question 3
A cluster administrator is setting up network policies for a new cluster. Which of
the following is a best practice for network policy default behavior?
A. Allow all traffic by default and add deny rules as needed
B. Deny all traffic by default and add allow rules as needed
C. Allow traffic only from the same namespace
D. Allow traffic only from the ingress controller
Answer: B. Deny all traffic by default and add allow rules as needed
Rationale: The principle of least privilege applies to network policies. A default-
deny approach ensures that only explicitly allowed traffic can flow between
pods. Option A is insecure. Option C is too restrictive without context. Option D is
incomplete.
Question 4
An administrator is configuring TLS for an ingress resource. Which annotation is
required for cert-manager to automatically provision a certificate?
A. cert-manager.io/cluster-issuer
B. kubernetes.io/ingress.class
C. nginx.ingress.kubernetes.io/ssl-redirect
D. acme.cert-manager.io/http01-edit-in-place
Answer: A. cert-manager.io/cluster-issuer
, Rationale: The cert-manager.io/cluster-issuer annotation tells cert-manager which
ClusterIssuer to use for certificate provisioning. The kubernetes.io/ingress.class (B)
specifies the ingress controller. ssl-redirect (C) controls HTTP to HTTPS
redirection. The ACME annotation (D) is for specific challenge configurations.
Question 5
A cluster administrator needs to verify that the API server is configured with the --
anonymous-auth=false flag. Which command should be used to check the API
server configuration?
A. kubectl describe pod kube-apiserver -n kube-system
B. ps aux | grep kube-apiserver
C. cat /etc/kubernetes/manifests/kube-apiserver.yaml
D. All of the above
Answer: D. All of the above
Rationale: All three methods can be used to check API server flags: describing the
pod (A), checking processes on the node (B), or viewing the static pod manifest
(C). The exam may restrict which methods are available depending on the context.
Question 6
An administrator is setting up a cluster and needs to ensure that kubelet anonymous
authentication is disabled. Which kubelet configuration file setting should be
modified?
A. authentication.anonymous.enabled: false
B. authorization.mode: AlwaysAllow
C. readOnlyPort: 10255
D. client-ca-file: /path/to/ca.crt
Answer: A. authentication.anonymous.enabled: false
Rationale: The kubelet configuration file (typically /var/lib/kubelet/config.yaml)
has an authentication section where anonymous.enabled controls anonymous
access. Setting this to false disables anonymous
authentication. authorization.mode: AlwaysAllow (B) would be
Questions, Comprehensive Kubernetes Security
Review, Detailed Rationales, Verified Answers,
Complete Success Workbook
Exam Domains & Weights:
Domain Weight
1. Cluster Setup 10–15%
2. Cluster Hardening 15%
3. System Hardening 10–15%
4. Minimize Microservice Vulnerabilities 20%
5. Supply Chain Security 20%
6. Monitoring, Logging, and Runtime Security 20%
CRITICAL NOTE: The CKS exam is NOT multiple-choice. It is
a practical, hands-on exam where you perform real Kubernetes security tasks.
This guide includes scenario-based practice questions to test your knowledge,
but you must practice hands-on in a lab environment to succeed.
Key 2026 Updates:
• Cluster Setup domain weight increased from 10% to 15%
• New focus on ingress with TLS configuration
• Emphasis on CIS benchmarks, network policies, and node metadata
, • Tools tested: Trivy, Falco, OPA/Gatekeeper, kube-bench, Cosign, gVisor
Exam Environment:
• Multiple clusters with different contexts
• Third-party security tools pre-installed (Trivy, Falco, kube-bench, etc.)
• You may reference official documentation during the exam
DOMAIN 1: CLUSTER SETUP (10–15%)
Question 1
A cluster administrator needs to set up a new Kubernetes cluster with security best
practices. Which CIS Benchmark component should be reviewed first to ensure the
cluster is configured securely?
A. Pod Security Standards
B. CIS Kubernetes Benchmark
C. OPA Gatekeeper policies
D. Network policies
Answer: B. CIS Kubernetes Benchmark
Rationale: The CIS Kubernetes Benchmark provides a comprehensive set of
security configuration recommendations for Kubernetes components including the
API server, controller manager, scheduler, etcd, and worker nodes. Reviewing the
CIS Benchmark is the foundational step for secure cluster setup. Pod Security
Standards (A), OPA policies (C), and Network Policies (D) are important but come
after the baseline CIS Benchmark review.
Question 2
An administrator needs to configure the Kubernetes API server to enable audit
logging. Which API server flag enables audit logging?
A. --audit-policy-file
B. --audit-log-path
,C. --audit-webhook-config-file
D. --enable-admission-plugins
Answer: A. --audit-policy-file
Rationale: The --audit-policy-file flag specifies the path to a file that defines the
audit policy configuration. This is required to enable audit logging. --audit-log-
path (B) specifies where to write audit logs but does not enable audit logging
itself. --audit-webhook-config-file (C) is for sending audit events to a webhook. --
enable-admission-plugins (D) enables admission controllers, not audit logging.
Question 3
A cluster administrator is setting up network policies for a new cluster. Which of
the following is a best practice for network policy default behavior?
A. Allow all traffic by default and add deny rules as needed
B. Deny all traffic by default and add allow rules as needed
C. Allow traffic only from the same namespace
D. Allow traffic only from the ingress controller
Answer: B. Deny all traffic by default and add allow rules as needed
Rationale: The principle of least privilege applies to network policies. A default-
deny approach ensures that only explicitly allowed traffic can flow between
pods. Option A is insecure. Option C is too restrictive without context. Option D is
incomplete.
Question 4
An administrator is configuring TLS for an ingress resource. Which annotation is
required for cert-manager to automatically provision a certificate?
A. cert-manager.io/cluster-issuer
B. kubernetes.io/ingress.class
C. nginx.ingress.kubernetes.io/ssl-redirect
D. acme.cert-manager.io/http01-edit-in-place
Answer: A. cert-manager.io/cluster-issuer
, Rationale: The cert-manager.io/cluster-issuer annotation tells cert-manager which
ClusterIssuer to use for certificate provisioning. The kubernetes.io/ingress.class (B)
specifies the ingress controller. ssl-redirect (C) controls HTTP to HTTPS
redirection. The ACME annotation (D) is for specific challenge configurations.
Question 5
A cluster administrator needs to verify that the API server is configured with the --
anonymous-auth=false flag. Which command should be used to check the API
server configuration?
A. kubectl describe pod kube-apiserver -n kube-system
B. ps aux | grep kube-apiserver
C. cat /etc/kubernetes/manifests/kube-apiserver.yaml
D. All of the above
Answer: D. All of the above
Rationale: All three methods can be used to check API server flags: describing the
pod (A), checking processes on the node (B), or viewing the static pod manifest
(C). The exam may restrict which methods are available depending on the context.
Question 6
An administrator is setting up a cluster and needs to ensure that kubelet anonymous
authentication is disabled. Which kubelet configuration file setting should be
modified?
A. authentication.anonymous.enabled: false
B. authorization.mode: AlwaysAllow
C. readOnlyPort: 10255
D. client-ca-file: /path/to/ca.crt
Answer: A. authentication.anonymous.enabled: false
Rationale: The kubelet configuration file (typically /var/lib/kubelet/config.yaml)
has an authentication section where anonymous.enabled controls anonymous
access. Setting this to false disables anonymous
authentication. authorization.mode: AlwaysAllow (B) would be
