Linux Foundation Certified Kubernetes Security Specialist (CKS) Exam Questions

Linux Foundation Certified Kubernetes Security Specialist Exam Objectives

1. 1

   1.0 Cluster Setup (15%)

   • 1.1Use Network security policies to restrict cluster level access
   • 1.2Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)
   • 1.3Properly set up Ingress objects with security control
   • 1.4Protect node metadata and endpoints
   • 1.5Minimize use of, and access to, GUI elements
   • 1.6Verify platform binaries before deploying
2. 2

   2.0 Cluster Hardening (15%)

   • 2.1Restrict access to Kubernetes API
   • 2.2Use Role Based Access Controls to minimize exposure
   • 2.3Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones
   • 2.4Update Kubernetes frequently
3. 3

   3.0 System Hardening (10%)

   • 3.1Minimize host OS footprint (reduce attack surface)
   • 3.2Minimize IAM roles
   • 3.3Minimize external access to the network
   • 3.4Appropriately use kernel hardening tools such as AppArmor, seccomp
4. 4

   4.0 Minimize Microservice Vulnerabilities (20%)

   • 4.1Setup appropriate OS level security domains e.g. using PSP, OPA, security contexts
   • 4.2Manage Kubernetes secrets
   • 4.3Use container runtime sandboxes in multi-tenant environments (e.g. gvisor, kata containers)
   • 4.4Implement pod to pod encryption by use of mTLS
5. 5

   5.0 Supply Chain Security (20%)

   • 5.1Minimize base image footprint
   • 5.2Secure your supply chain: whitelist allowed registries, sign and validate images
   • 5.3Use static analysis of user workloads (e.g.Kubernetes resources, Docker files)
   • 5.4Scan images for known vulnerabilities
6. 6

   6.0 Monitoring, Logging and Runtime Security (20%)

   • 6.1Perform behavioral analytics of syscall process and file activities at the host and container level to detect malicious activities
   • 6.2Detect threats within physical infrastructure, apps, networks, data, users and workloads
   • 6.3Detect all phases of attack regardless where it occurs and how it spreads
   • 6.4Perform deep analytical investigation and identification of bad actors within environment
   • 6.5Ensure immutability of containers at runtime
   • 6.6Use Audit Logs to monitor access