さらに、JPTestKing CKSダンプの一部が現在無料で提供されています：https://drive.google.com/open?id=1J6AyZYme1J9N0_Rr_OA__Vohw3fFRu0W
当社の製品を使用したこれらの人々は、CKS学習教材を高く評価しています。製品を購入して真剣に検討することを決めた場合、簡単に試験に合格し、短時間でCKS認定を取得することが非常に簡単になります。また、お客様の夢の実現をお手伝いします。ここで、CKS学習教材を紹介する機会をください。私たちの紹介に貴重な時間を費やした後悔はありません。また、CKS学習クイズは手頃な価格であるため、過剰に請求されることはありません。
| Section | Weight | Objectives |
|---|---|---|
| Supply Chain Security | 20% | - Signed artifacts & verification - Static analysis tools - SBOM & CI/CD security - Image security & scanning - Permitted registries |
| System Hardening | 10% | - Least privilege IAM - Kernel hardening (AppArmor, seccomp) - Network access control - Minimize OS attack surface |
| Monitoring, Logging and Runtime Security | 20% | - Container immutability - Audit log configuration - Behavioral analytics - Threat detection (Falco) - Incident investigation |
| Cluster Setup | 15% | - CIS benchmark compliance - Secure Ingress configuration - Node metadata protection - Binary verification - Network security policies |
| Cluster Hardening | 15% | - Component updates & vulnerability mitigation - Service account security - API access restriction - RBAC configuration |
| Minimize Microservice Vulnerabilities | 20% | - Pod Security Standards - OPA/Gatekeeper implementation - Isolation & multi-tenancy - Security contexts - Secret management |
Linux Foundation認証試験に参加する方はJPTestKingの問題集を買ってください。CKS試験の成功を祈ります。
質問 # 65
SIMULATION
Create a RuntimeClass named gvisor-rc using the prepared runtime handler named runsc.
Create a Pods of image Nginx in the Namespace server to run on the gVisor runtime class
正解：
解説：
SeetheExplanationbelowExplanation:
Install the Runtime Class for gVisor
{ # Step 1: Install a RuntimeClass
cat <<EOF | kubectl apply -f -
apiVersion: node.k8s.io/v1beta1
kind: RuntimeClass
metadata:
name: gvisor
handler: runsc
EOF
}
Create a Pod with the gVisor Runtime Class
{ # Step 2: Create a pod
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
name: nginx-gvisor
spec:
runtimeClassName: gvisor
containers:
- name: nginx
image: nginx
EOF
}
Verify that the Pod is running
{ # Step 3: Get the pod
kubectl get pod nginx-gvisor -o wide
}
質問 # 66
Create a PSP that will only allow the persistentvolumeclaim as the volume type in the namespace restricted.
Create a new PodSecurityPolicy named prevent-volume-policy which prevents the pods which is having different volumes mount apart from persistentvolumeclaim.
Create a new ServiceAccount named psp-sa in the namespace restricted.
Create a new ClusterRole named psp-role, which uses the newly created Pod Security Policy prevent-volume-policy Create a new ClusterRoleBinding named psp-role-binding, which binds the created ClusterRole psp-role to the created SA psp-sa.
Hint:
Also, Check the Configuration is working or not by trying to Mount a Secret in the pod maifest, it should get failed.
POD Manifest:
apiVersion: v1
kind: Pod
metadata:
name:
spec:
containers:
- name:
image:
volumeMounts:
- name:
mountPath:
volumes:
- name:
secret:
secretname:
正解：
解説：
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: restricted
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' spec:
privileged: false
# Required to prevent escalations to root.
allowPrivilegeEscalation: false
# This is redundant with non-root + disallow privilege escalation,
# but we can provide it for defense in depth.
requiredDropCapabilities:
- ALL
# Allow core volume types.
volumes:
- 'configMap'
- 'emptyDir'
- 'projected'
- 'secret'
- 'downwardAPI'
# Assume that persistentVolumes set up by the cluster admin are safe to use.
- 'persistentVolumeClaim'
hostNetwork: false
hostIPC: false
hostPID: false
runAsUser:
# Require the container to run without root privileges.
rule: 'MustRunAsNonRoot'
seLinux:
# This policy assumes the nodes are using AppArmor rather than SELinux.
rule: 'RunAsAny'
supplementalGroups:
rule: 'MustRunAs'
ranges:
# Forbid adding the root group.
- min: 1
max: 65535
fsGroup:
rule: 'MustRunAs'
ranges:
# Forbid adding the root group.
- min: 1
max: 65535
readOnlyRootFilesystem: false
質問 # 67
SIMULATION
use the Trivy to scan the following images,
1. amazonlinux:1
2. k8s.gcr.io/kube-controller-manager:v1.18.6
Look for images with HIGH or CRITICAL severity vulnerabilities and store the output of the same in /opt/trivy-vulnerable.txt
正解：
解説：
Send us you rsuggestion on it
質問 # 68
You are managing a Kubernetes cluster With various security measures in place. You have a deployment named 'my-apps that uses the default service account for its pods. To ensure that only authorized users can access the pods running in the 'my-app' deployment, implement a security policy that restricts access to tne pods based on user identity.
正解：
解説：
Solution (Step by Step) :
1. Create a Pod Security Policy (PSP):
- Define a PSP named 'restricted-pod-access' that allows only authenticated users with specific permissions to access the pods.
- Use 'runAsUser' to specify that pods must run as a non-root user, 'readOnlyRootFilesystem' to prevent modifications to the root filesystem, and 'allowPrivilegeEscalations to disable privilege escalation.
2. Create a Role Binding: - Create a role binding named my-app-access-binding' that associates the 'my-app' deployment's service account with the 'restricted-pod-access' PSP.
3. Update the Deployment - Update the 'my-app' deployment to use the default service account and add the 'securityContext' to the 'podSpec' with the 'securityContext.pspName' set to 'restricted-pod-access'.
4. Test and Verify: - Verot that only authorized users with appropriate permissions can access pods in the 'my-app' deployment. - This step ensures that the security policy is correctly implemented and enforced.
質問 # 69
You are running a Kubernetes cluster with a deployment named "my-app" that has been experiencing unexpected crashes. The crash logs indicate that the container's memory consumption is exceeding the resource limits defined in the deployment YAML. Explain how you can utilize the Kubernetes resource quotas and admission controller to prevent this from happening again.
正解：
解説：
Solution (Step by Step) :
1. Create a ResourceQuota:
- Define a ResourceQuota that limits the resources that can be consumed by pods in a specific namespace.
- Specify the limits for CPU, memory, storage, and other resources.
- For example, to limit memory usage to 2Gi per pod in the "my-app" namespace:
2. Enable the Resourceauota Admission Controller: - Ensure that the "Resourceauota" admission controller is enabled in your Kubernetes cluster. This can usually be done by setting the 'admissioncontror flag in the 'kube-apiserver' configuration. 3. Apply the ResourceQuota: - Apply the ResourceQuota to the "my-app" namespace using 'kubectl apply -f resource-quota_yaml 4. Update the Deployment - Modify the deployment's YAML file to specify the resource requests and limits for the container, ensuring they are within the defined ResourceQuota limits. For example:
5. Apply the updated deployment - Apply the updated deployment using 'kubectl apply -f deployment.yaml' 6. Monitor and Evaluate: - Monitor the resource consumption of pods in the "my-app" namespace and adjust the ResourceQuota limits as needed to ensure that your cluster remains stable.
質問 # 70
......
昇進の機会を得て仕事に就きたいと考えているなら、当社からCKS学習問題を選択するのが最良の選択のチャンスになります。なぜなら、CKS学習教材には、あなたが自分自身を改善し、他の人よりも優れたものにするのに役立つ十分な能力があるからです。当社のCKS学習教材は、多くの人々が認定を取得し、夢を実現するのに役立ちました。また、当社のCKSテストガイドに連絡する機会もあります。
CKS PDF問題サンプル: https://www.jptestking.com/CKS-exam.html
BONUS！！！ JPTestKing CKSダンプの一部を無料でダウンロード：https://drive.google.com/open?id=1J6AyZYme1J9N0_Rr_OA__Vohw3fFRu0W