CKS 시험은 문제에서 구체적으로 어떤 기술(AppArmor, Seccomp, RBAC 등)을 사용해야 하는지 명시하지 않고, 추상적인 보안 요구사항(예: “컨테이너의 호스트 쓰기 권한을 제한하라”, “의심스러운 시스템 콜을 로깅하라”)을 제시하는 경우가 많습니다.

이를 대비하기 위해 요구사항 상황별 해결 범주와 필요 스킬 집합을 다음과 같이 표로 정리하였습니다.

Skills Map by CKS problem solving scope

Main Category (Domain)	Detailed Scenario	Required Skill & Tools	Key CLI commands / configuration patterns	Result verification method (Verification)
1. Cluster Setup	Limit network traffic	NetworkPolicy settings	kubectl apply -f netpol.yaml (specify podSelector, ingress/egress, ipBlock)	kubectl exec -it -- wget -T 2 (Check whether timeout occurs)
	Inspect infrastructure/component vulnerabilities	Utilizing the kube-bench tool	Run ./kube-bench run --targets master, etc. and analyze results (FAIL)	Follow the remediation instructions specified in the [FAIL] section of the report.
	Enhanced basic API server security	Apply Admission Controller and NodeRestriction	Edit /etc/kubernetes/manifests/kube-apiserver.yaml / --enable-admission-plugins=NodeRestriction,...	After automatically restarting the API server, check that kubectl get po -n kube-system operates normally.
	Control external image approval policy	ImagePolicyWebhook integration	Kube-apiserver’s --admission-control-config-file and Kubeconfig integration settings	Check API server blocking message when distributing unauthorized images
2. Cluster Hardening	Resource Permission Control	RBAC (Role, Binding) settings	kubectl create role/clusterrole and kubectl create rolebinding/clusterrolebinding	kubectl auth can-i --as=system:serviceaccount::
	Prevention of SA token theft	Enhanced ServiceAccount security	Add automountServiceAccountToken: false to your SA or Pod definition	Check whether the /var/run/secrets/kubernetes.io/serviceaccount directory inside the Pod is mounted
	Upgrade Kubernetes version	kubeadm based upgrades	apt-get install kubeadm=X.Y.Z / kubeadm upgrade plan -> apply / apt-get install kubelet kubectl	Check version and node status Ready with kubectl get nodes
3. System Hardening	Block specific process permissions	Apply AppArmor profile	apparmor_parser -q /etc/apparmor.d/profile / set securityContext.appArmorProfile in Pod	Check for errors in kubectl describe pod or check blocking action after entering the pod.
	Block/restrict system calls	Apply Seccomp profile	/var/lib/kubelet/seccomp/profiles/profile.json Set securityContext.seccompProfile in Deployment/Pod	Check Pod creation status and Seccomp: 2 (filtering) in /proc/1/status
	Container Engine Daemon Security	Docker Daemon Protection	/etc/docker/daemon.json or modify containerd settings (userns-remap, enable TLS, etc.)	Check operation mode with docker info or systemctl status docker
	Remove unnecessary/risky packages	Host OS Security Management	systemctl stop/disable (e.g. telnet)	systemctl status or check whether port is listening
4. Minimize Microservice Vulnerabilities (Microservice protection)	Container isolation and permission restrictions	Set SecurityContext	Change Pod/Container internal settings: readOnlyRootFilesystem: true, runAsNonRoot: true, capabilities: { drop: ["ALL"] }	Write test after entering kubectl exec (touch /test -> check read-only file system), check non-root with id command
	Safe isolation of untrusted code	Using gVisor (RuntimeClass)	Create RuntimeClass (handler: runsc) and bind runtimeClassName: gvisor in Pod	Check gVisor(runsc) kernel sandbox logging when running dmesg inside the pod.
	L7 HTTP detailed traffic control	Cilium Network Policy	Create CiliumNetworkPolicy CRD and add specs.egress/ingress child HTTP rules	Check 403 Forbidden blocking when calling an unauthorized HTTP URL path.
	Application Policy Control	OPA Gatekeeper Policy Statement	Create and apply ConstraintTemplate and Constraint (Rego language)	When attempting to deploy a Pod that violates the rules (kubectl apply), check for blocking at the Admission Controller level.
	Protection of sensitive information	Secrets Encryption at Rest	Write EncryptionConfiguration YAML / import --encryption-provider-config option into kube-apiserver	After creating a Secret, check the encryption status (k8s:enc:aescbc:v1...) rather than plain text when querying data with etcdctl get.
5. Supply Chain Security	Container image packaging security	Dockerfile static hardening	USER , RUN find / -perm /6000 -type f -exec chmod a-s {} + (remove setuid)	Verify id when running built image and disable setuid executable file
	Create software bill document	SBOM creation tool (bom / trivy)	bom generate -o sbom.spdx --image or trivy sbom	Check whether the SPDX standard .spdx or JSON SBOM file is created in the specified path.
	Image Security Verification	Trivy Image Scan	trivy image --severity HIGH,CRITICAL	Counting the number of vulnerabilities among output results and saving report files
	Static Yaml Manifest Validation	Kubesec Static Analysis	kubesec scan pod.yaml	score Check the score and guidelines to correct Yaml’s security shortcomings
6. Monitoring & Logging	Host/Container Runtime Threat Detection	Falco Runtime Monitoring	Edit /etc/falco/falco_rules.local.yaml / systemctl restart falco	Monitor real-time threat detection logs in /var/log/syslog or /var/log/falco.log
	Audit Cluster Behavior	Kubernetes Audit Log settings	/etc/kubernetes/audit-policy.yaml Create policy / Register audit-log-path, audit-policy-file in kube-apiserver	Verify that events are logged to the /var/log/kubernetes/audit.log file.

CKS Troubleshooting Flow

Architecture & System Flow Diagram

SVG

100%

Pan & Zoom

Quick judgment tips at the test site

1. When you see the words “Restrict system calls” or “seccomp profile”, you must immediately think of the /var/lib/kubelet/seccomp/ directory and the mapping of securityContext.seccompProfile.
2. Requirements related to “Strict write permissions / Read only” imply specifying securityContext.readOnlyRootFilesystem: true inside the container.
3. “Audit system events” or “Detect runtime threats” instructs changes to the Falco service on the host or the Audit Log settings on K8s.
4. If you see “Sandbox containers” or “Isolate untrusted workload”, you need to create a RuntimeClass (gVisor/runsc) and add runtimeClassName to your Pod spec.
5. “Check external image approval” or “Image admission check” is an instruction to activate the ImagePolicyWebhook admission plugin.