# CKS-011 — Verify and install a Kubernetes binary

Domain: **1.5 Platform binary verification**  
Time: **4 minutes** · Score: **Section B only**

## Supplied files

```text
/opt/release/kubectl
/opt/release/kubectl.sha256
```

`kubectl.sha256` contains the official raw SHA-256 value but no filename.

## Task

Verify the downloaded binary against the checksum. Install it as `/usr/local/bin/kubectl` with owner `root:root` and mode `0755` only if verification succeeds. Then show its client version and installed ownership/mode.

## Section B — scored answer

```bash
# Your commands
```

Say **Grade CKS-011** when saved.