Get Mar-2026 updated Exam CKS Dumps with New Questions [Q36-Q54]

Posted On March 31, 2026

Get Mar-2026 updated Exam CKS Dumps with New Questions

100% Pass Guarantee for CKS Exam Dumps with Actual Exam Questions

The CKS certification is a valuable credential for IT professionals who work with Kubernetes and containerized applications. It demonstrates a candidate’s commitment to maintaining the highest standards of security in their work and provides a competitive edge in the job market. Certified Kubernetes Security Specialist (CKS) certification exam is rigorous and challenging, requiring candidates to have a strong understanding of Kubernetes security best practices. However, it is also a rewarding experience, as successful candidates will have the skills and knowledge to secure Kubernetes environments and protect their organizations from cyber threats.

Linux Foundation CKS (Certified Kubernetes Security Specialist) Certification Exam is an industry-recognized certification that validates a candidate’s skills and knowledge in securing containerized applications and Kubernetes platforms. CKS exam is designed to test a candidate’s ability to identify and address security risks in Kubernetes environments, as well as their proficiency in implementing security controls and best practices.

Q36. You are implementing a strategy to secure the container images that are deployed to your Kubernetes cluster. You want to ensure that only images that meet specific security requirements are allowed to be deployed. What steps can you take to enforce these security requirements on your container images?

Q37. SIMULATION
Context
You must implement auditing for the kubeadm provisioned cluster.
Task
First, reconfigure the cluster ‘s API server, so that:
. the basic audit policy located at
/etc/kubernetes/logpolicy/audit-policy.yaml is used,
. logs are stored at /var/log/kubernetes/audit-logs.txt,
. and a maximum of 2 logs are retained for 10 days.
The cluster uses the Docker Engine as its container runtime . If needed, use the docker command to troubleshoot running containers.
The basic policy only specifies what not to log.
Next, edit and extend the basic policy to log:
. namespaces interactions at RequestResponse level
. the request body of deployments interactions in the namespace webapps
. ConfigMap and Secret interactions in all namespaces at the Metadata level
. all other requests at the Metadata level
Make sure the API server uses the extended policy.
Failure to do so may result in a reduced score.

Q38. You are running a Kubernetes cluster with a deployment named “my-app” that uses a container image from a public registry. You suspect that a recent deployment update may have introduced a vulnerability in one of the containers. Explain how you would use a container security posture management (CSPM) tool like Aqua Security to identify and address this potential security risk.

Solution (Step by Step) :
1. Deploy Aqua Security:
– Install and configure Aqua Security on your Kubernetes cluster. Aqua Security is a comprehensive CSPM solution that offers a wide range of container security features, including vulnerability scanning, runtime security, and policy enforcement
2 Enable Continuous Image Scanning:
– Configure Aqua Security to continuously scan container images stored in your private registry for vulnerabilities. You can set up policies to block images With specific vulnerabilities or those that fail to meet your security requirements.
3. Implement Runtime Security:
– Enable Aqua Security’s runtime security capabilities to monitor running containers for suspicious activity. This includes:
– File Integrity Monitoring (FIM): Detect unauthorized changes to files within containers.
– Network Security: Monitor network connections and identify unauthorized or suspicious traffic.
– Process Monitoring: Detect and block unexpected processes launched within containers.
4. Define Security Policies:
– Create custom security policies in Aqua Security to enforce specific security rules and controls for your Kubernetes cluster. These policies can
define:
– Vulnerability Limits: Allow only containers with specific vulnerability levels to run.
– Network Access Controls: Restrict network connections from containers.
– Resource IJsage Limits: Limit the resources (CPU, memory) that containers can consume-
5. Investigate Security Alerts:
– Aqua Security will generate alerts when it detects potential security risks- Investigate these alerts to understand the root cause of the issue and take corrective actions.
6. Remediate Security Issues:
– Use Aqua Security’s remediation capabilities to address vulnerabilities and security issues. This could involve updating container images, patching vulnerabilities, or implementing additional security controls.
7. Monitor and Report:
– Regularly review the security reports and dashboards provided by Aqua Security to track your container security posture- Stay informed about any potential threats and proactively address them.

Q39. You are managing a Kubernetes cluster running an application that uses a private container registry. The registry is secured using basic authentication, but the credentials are stored in a secret in the cluster. You want to ensure that the application container can access the registry without storing the credentials directly within the container image.
How would you configure the application deployment to access the private registry securely without exposing the credentials?

Q40. SIMULATION
Documentation Upgrading kubeadm clusters
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh cks000034
Context
The kubeadm provisioned cluster was recently upgraded, leaving one node on a slightly older version due to workload compatibility concerns.
Task
Upgrade the cluster node compute-0 to match the version of the control plane node.
Use a command like the following to connect to the compute node:
[candidate@cks000034] $ ssh compute-0
Do not modify any running workloads in the cluster.
Do not forget to exit from the compute node once you have completed your tasks:
[candidate@icompute-e] $ exit

Q41. You nave a Kubernetes cluster with a Deployment named ‘web-app- that runs multiple replicas of a web application. You need to create a network policy that allows only traffic from pods in the same namespace to access the web application’s API endpoint on port 8080.

Q42. You’re working on a Kubernetes cluster where container images are pulled from a private registry. Security best practices dictate that you should configure the cluster to only allow image pulls from authorized registries. Explain how you would enforce this policy using image admission controllers and provide a practical example of an admission control configuration.

Q43. Your organization uses Kubernetes to run a microservice application. One of the microservices is a payment gateway that processes sensitive payment information. How would you implement security measures to protect this payment gateway microservice and minimize the risk of data breaches, considering the security requirements are very stringent?

Solution (Step by Step) :
1. Isolate the Payment Gateway:
– Dedicated Namespace: Create a dedicated namespace for the payment gateway service, separated from other services.
– Network Policies: Implement strict network policies to limit communication with the payment gateway. Only allow access from authorized services and specific IP addresses-
2. Pod Security Policies (PSPs):
– Restricted Capabilities: Apply PSPs to restrict the payment gateway pods’ capabilities. Disable capabilities like “NET ADMIN” (network administration) and “SYS_ADMIN” (system administration).
– Security Context: Configure the ‘securitycontext’ to run the payment gateway pods as a non-root user, with restricted permissions.
– Image Integrity: Use image signing and verification to ensure that the payment gateway images are trusted and haven’t been tampered with.
3. Encryption:
– Data at Rest: Use strong encryption to protect the payment gateway’s data at rest, including databases, files, and storage volumes.
– Data in Transit: Utilize TLS/SSL to secure communication between the payment gateway and other services, including external payment processors.
4. Strong Authentication and Authorization.
– Service Accounts: use a dedicated service account for the payment gateway, restricted to accessing only the necessary resources.
– R8AC: Implement RBAC to control access to the payment gateway service, ensuring that only authorized users and services can interact with it.
– Multi-Factor Authentication Consider using two-factor authentication for any human interaction with the payment gateway service.
5. Monitoring and Auditing:
– Log Aggregation: Implement log aggregation for the payment gateway, capturing all activities and potential security events.
– Security Monitoring: Use security monitoring tools to detect any suspicious activity related to the payment gateway, including access attempts, failed logins, and data access patterns.
– Regular Security Audits: Conduct regular security audits to identity and address potential vulnerabilities and ensure the security controls are effective.
6. Vulnerability Management:
– Regular Scanning: use vulnerability scanners to identify and patch any known vulnerabilities in the payment gateway software and dependencies.
– Security Patching: Implement a robust security patching process to apply updates and fixes promptly
7. Penetration Testing:
– Regular Penetration Testing: Perform regular penetration testing to evaluate the payment gateway’s security posture from a hacker’s perspective. This will help identify potential security weaknesses and ensure that your security controls are effective.

Q44. SIMULATION

Context
A CIS Benchmark tool was run against the kubeadm-created cluster and found multiple issues that must be addressed immediately.
Task
Fix all issues via configuration and restart the affected components to ensure the new settings take effect.
Fix all of the following violations that were found against the API server:

Fix all of the following violations that were found against the Kubelet:

Fix all of the following violations that were found against etcd:

Q45. You are working on a Kubernetes cluster that iS deployed on a Cloud provider. You need to ensure that the Kubernetes nodes are hardened according to security best practices. Implement a solution that automatically scans the nodes for vulnerabilities and applies necessary security updates.

Q46. SIMULATION
You must connect to the correct host . Failure to do so may
result in a zero score.
[candidato@base] $ ssh cks000023
Task
Analyze and edit the Dockerfile located at /home/candidate/subtle-bee/build/Dockerfile, fixing one instruction present in the file that is a prominent security/best-practice issue.
Do not add or remove instructions; only modify the one existing instruction with a security/best-practice concern.
Do not build the Dockerfile, Failure to do so may result in running out of storage and a zero score.
Analyze and edit the given manifest file /home/candidate/subtle-bee/deployment.yaml, fixing one fields present in the file that are a prominent security/best-practice issue.
Do not add or remove fields; only modify the one existing field with a security/best-practice concern.
Should you need an unprivileged user for any of the tasks, use user nobody with user ID 65535.

Q47. You are managing a Kubernetes cluster With a critical application deployed as a Deployment. You need to ensure that only authorized users can access the Kubernetes API to manage this application’s resources. Describe the security measures you would implement to restrict access to the Kubernetes API and ensure only authorized users can manage this specific Deployment

Q48. You can switch the cluster/configuration context using the following command:
[desk@cli] $ kubectl config use-context dev
A default-deny NetworkPolicy avoid to accidentally expose a Pod in a namespace that doesn’t have any other NetworkPolicy defined.
Task: Create a new default-deny NetworkPolicy named deny-network in the namespace test for all traffic of type Ingress + Egress The new NetworkPolicy must deny all Ingress + Egress traffic in the namespace test.
Apply the newly created default-deny NetworkPolicy to all Pods running in namespace test.
You can find a skeleton manifests file at /home/cert_masters/network-policy.yaml

Q49. You have a Kubernetes cluster with multiple namespaces, each representing a different department You need to ensure that resources in one namespace cannot access resources in another namespace, even if they are running as the same user. How would you implement this isolation policy and what are the potential risks if this isolation is not implemented effectively?

Q50. SIMULATION
Fix all issues via configuration and restart the affected components to ensure the new setting takes effect.
Fix all of the following violations that were found against the API server:- a. Ensure that the RotateKubeletServerCertificate argument is set to true.
b. Ensure that the admission control plugin PodSecurityPolicy is set.
c. Ensure that the –kubelet-certificate-authority argument is set as appropriate.
Fix all of the following violations that were found against the Kubelet:- a. Ensure the –anonymous-auth argument is set to false.
b. Ensure that the –authorization-mode argument is set to Webhook.
Fix all of the following violations that were found against the ETCD:-
a. Ensure that the –auto-tls argument is not set to true
b. Ensure that the –peer-auto-tls argument is not set to true
Hint: Take the use of Tool Kube-Bench

Q51. You have a Kubernetes cluster running a critical application with a Deployment named ‘myapp-deployment. You suspect a recent image update has introduced a vulnerability that’s causing the application to crash frequently.
You need to investigate this issue and determine the exact phase of the attack and the potential bad actor responsible. You have access to the following resources: Kubernetes audit logs: Enabled at the cluster level.
Container logs: Available for all pods associated with the ‘myapp-deployments Network traffic logs: Captured by a network security solution. How would you use these resources to identify the attack phase, the potential bad actor, and the source of the vulnerability?

Solution (Step by Step) :
1. Analyze Kubernetes Audit Logs:
Focus on events related to the ‘myapp-deployment: Search for entries related to pod creation, deletion, image pulls, and resource updates. Look for suspicious activity: Pay attention to any unusual image updates, unauthorized access attempts, or resource changes that occurred around the time of the crashes.
Identify the user or service account responsible for the changes: This could point to a potential bad actor if the user’service account is not expected to modify the Deployment.
2. Examine Container Logs:
Search for crash messages and error codes: This will provide insights into the specific cause of the application crashes.
Identify any unusual or suspicious activity within the container: Look for signs of malicious processes, unauthorized network connections, or data exfiltration attempts.
3. Analyze Network Traffic Logs:
Identify the source of the compromised image: Network logs can reveal the IP address of the registry or repository from which the vulnerable image was pulled.
Examine network connections from the affected pods: Look for unusual or unauthorized outbound connections that could indicate malware or communication with a malicious server.
4. Correlate Findings:
Combine information from the different logs to build a comprehensive picture of the attack.
For example, if you find a suspicious image pull in the audit logs, and the container logs show signs of malware activity, you have strong evidence of malicious image vulnerability.
Example Code Snippets:
Kubernetes Audit Logs (using kubectl):
bash
kubectl logs -f -n kube-system kube-apiserver -c kube-apiserver | grep “myapp-deployment” | grep “Create” | grep “Image”
Container Logs (using kubectl):
bash
kubectl logs -f myapp-deployment-pod-name -c myapp
Network Traffic Logs (using a network security tool like Falco):
falco -f falco.yaml -o json
Note: The specific commands and tools may vary depending on your Kubernetes environment and security tools.

Q52. You are running a critical application in your Kubernetes cluster and want to minimize the attack surface by removing unnecessary features from the cluster- You need to identify and disable features that are not essential for your application.

Q53. SIMULATION
Create a network policy named allow-np, that allows pod in the namespace staging to connect to port 80 of other pods in the same namespace.
Ensure that Network Policy:-
1. Does not allow access to pod not listening on port 80.
2. Does not allow access from Pods, not in namespace staging.

Q54. Given an existing Pod named test-web-pod running in the namespace test-system Edit the existing Role bound to the Pod’s Service Account named sa-backend to only allow performing get operations on endpoints.
Create a new Role named test-system-role-2 in the namespace test-system, which can perform patch operations, on resources of type statefulsets.

Create a new RoleBinding named test-system-role-2-binding binding the newly created Role to the Pod’s ServiceAccount sa-backend.