P.S. Free & New CKS dumps are available on Google Drive shared by Actual4dump: https://drive.google.com/open?id=1DCg7IOC2ChAwg9ViE8wlGEQudWgRfhdc
The version of APP and PC of our CKS exam torrent is also popular. They can simulate real operation of test environment and users can test CKS test prep in mock exam in limited time. They are very practical and they have online error correction and other functions. The characteristic that three versions of CKS Exam Torrent all have is that they have no limit of the number of users, so you don’t encounter failures anytime you want to learn our CKS quiz guide. The three different versions can help customers solve any questions and meet their all needs.
| Section | Weight | Objectives |
|---|---|---|
| Supply Chain Security | 20% | - Secure CI/CD practices - Image scanning and verification |
| Cluster Setup | 15% | - Hardening cluster components - Secure installation configuration |
| Minimizing Microservice Vulnerabilities | 20% | - Pod security standards - Container isolation and security contexts |
| Monitoring, Logging and Runtime Security | 15% | - Audit logging and monitoring - Runtime threat detection |
| Cluster Hardening | 15% | - API server security - Authentication and authorization |
| System Hardening | 15% | - Host security controls - Kernel and node security configuration |
>> Exam CKS Study Solutions <<
Purchasing a product may be a caucious thing for all of us, because we not only need to consider the performance of the product but also need to think about the things after purchasing. Our product will provide free demo for trying, and after you have bought the product of the CKS exam, we will send you the product by email in ten minutes after we have received the payment. After you bought the practice materials for the CKS Exam, if you have any question in the process of using, you can ask the service staff for help by email. Free update for having bought product is also available.
NEW QUESTION # 60
You need to configure a Kubernetes cluster to use a pod security policy (PSP) that restricts the use of privileged containers and specific capabilities. You want to only allow specific pods in the 'production' namespace to run With the 'NET_ADMIN' capability.
Answer:
Explanation:
Solution (Step by Step) :
1. create a PSPI
- Define a PSP that restricts the use of privileged containers and capabilities, except for the capability for pods in the 'production' namespace.
2. Create a PSP Binding: - Bind the PSP to the 'production' namespace-
3. Create a Pod: - Create a Pod in the 'production' namespace and specify the 'securitycontext' with the 'NET_ADMIN' capability.
4. Apply the YAML files: - Apply the created YAML files using 'kubectl apply -f 5. Verify the permissions: - Try to create a Pod in other namespaces with the 'NET_ADMIN' capability. It should be rejected.
NEW QUESTION # 61
SIMULATION
Documentation dockerd
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh cks000037
Task
Perform the following tasks to secure the cluster node cks000037 :
Remove user developer from the docker group.
Do not remove the user from any other group.
Reconfigure and restart the Docker daemon to ensure that the socket
file located at /var/run/docker.sock is owned by the group root.
Re-configure and restart the Docker daemon to ensure it does not listen on any TCP port.
After completing your work, ensure the Kubernetes cluster is healthy.
Answer:
Explanation:
See the Explanation below for complete solution
Explanation:
1) Connect to the correct host
ssh cks000037
sudo -i
2) Remove user developer from the docker group ONLY
2.1 Verify current groups (optional but fast)
id developer
2.2 Remove ONLY from docker group
gpasswd -d developer docker
2.3 Verify removal
id developer
✅ docker should not appear; other groups must remain.
3) Reconfigure Docker to secure the socket and disable TCP
Docker config file:
vi /etc/docker/daemon.json
3.1 Set socket group to root and disable TCP listeners
Ensure the file contains exactly these relevant settings (merge with existing JSON if present):
{
"group": "root",
"hosts": ["unix:///var/run/docker.sock"]
}
Important:
"group": "root" → docker.sock owned by group root
"hosts" includes ONLY the unix socket (no tcp://)
If the file already exists with other keys, add/adjust only these keys and keep valid JSON (commas!).
Save and exit:
:wq
4) Restart Docker daemon
systemctl daemon-reload
systemctl restart docker
systemctl status docker --no-pager
5) Verify Docker socket ownership and permissions
ls -l /var/run/docker.sock
Expected:
srw-rw---- 1 root root ...
✅ Owner: root
✅ Group: root
6) Verify Docker is NOT listening on TCP
ss -lntp | grep docker
Expected:
No output (or nothing bound to TCP by dockerd)
Optional double-check:
ps aux | grep dockerd | grep -v grep
Ensure no -H tcp://... flags.
7) Ensure Kubernetes cluster is healthy
7.1 Check node and pods
export KUBECONFIG=/etc/kubernetes/admin.conf
kubectl get nodes
kubectl get pods -A
All nodes should be Ready, core pods Running.
NEW QUESTION # 62
SIMULATION
Fix all issues via configuration and restart the affected components to ensure the new setting takes effect.
Fix all of the following violations that were found against the API server:- a. Ensure the --authorization-mode argument includes RBAC b. Ensure the --authorization-mode argument includes Node c. Ensure that the --profiling argument is set to false Fix all of the following violations that were found against the Kubelet:- a. Ensure the --anonymous-auth argument is set to false.
b. Ensure that the --authorization-mode argument is set to Webhook.
Fix all of the following violations that were found against the ETCD:-
a. Ensure that the --auto-tls argument is not set to true
Hint: Take the use of Tool Kube-Bench
Answer:
Explanation:
API server:
Ensure the --authorization-mode argument includes RBAC
Turn on Role Based Access Control.
Role Based Access Control (RBAC) allows fine-grained control over the operations that different entities can perform on different objects in the cluster. It is recommended to use the RBAC authorization mode.
Fix - Buildtime
Kubernetes
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
component: kube-apiserver
tier: control-plane
name: kube-apiserver
namespace: kube-system
spec:
containers:
- command:
+ - kube-apiserver
+ - --authorization-mode=RBAC,Node
image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0
livenessProbe:
failureThreshold: 8
httpGet:
host: 127.0.0.1
path: /healthz
port: 6443
scheme: HTTPS
initialDelaySeconds: 15
timeoutSeconds: 15
name: kube-apiserver-should-pass
resources:
requests:
cpu: 250m
volumeMounts:
- mountPath: /etc/kubernetes/
name: k8s
readOnly: true
- mountPath: /etc/ssl/certs
name: certs
- mountPath: /etc/pki
name: pki
hostNetwork: true
volumes:
- hostPath:
path: /etc/kubernetes
name: k8s
- hostPath:
path: /etc/ssl/certs
name: certs
- hostPath:
path: /etc/pki
name: pki
Ensure the --authorization-mode argument includes Node
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --authorization-mode parameter to a value that includes Node.
--authorization-mode=Node,RBAC
Audit:
/bin/ps -ef | grep kube-apiserver | grep -v grep
Expected result:
'Node,RBAC' has 'Node'
Ensure that the --profiling argument is set to false
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the below parameter.
--profiling=false
Audit:
/bin/ps -ef | grep kube-apiserver | grep -v grep
Expected result:
'false' is equal to 'false'
Fix all of the following violations that were found against the Kubelet:- Ensure the --anonymous-auth argument is set to false.
Remediation: If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to false. If using executable arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
--anonymous-auth=false
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
Audit:
/bin/ps -fC kubelet
Audit Config:
/bin/cat /var/lib/kubelet/config.yaml
Expected result:
'false' is equal to 'false'
2) Ensure that the --authorization-mode argument is set to Webhook.
Audit
docker inspect kubelet | jq -e '.[0].Args[] | match("--authorization-mode=Webhook").string' Returned Value: --authorization-mode=Webhook Fix all of the following violations that were found against the ETCD:- a. Ensure that the --auto-tls argument is not set to true Do not use self-signed certificates for TLS. etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should not be available to unauthenticated clients. You should enable the client authentication via valid certificates to secure the access to the etcd service.
Fix - Buildtime
Kubernetes
apiVersion: v1
kind: Pod
metadata:
annotations:
scheduler.alpha.kubernetes.io/critical-pod: ""
creationTimestamp: null
labels:
component: etcd
tier: control-plane
name: etcd
namespace: kube-system
spec:
containers:
- command:
+ - etcd
+ - --auto-tls=true
image: k8s.gcr.io/etcd-amd64:3.2.18
imagePullPolicy: IfNotPresent
livenessProbe:
exec:
command:
- /bin/sh
- -ec
- ETCDCTL_API=3 etcdctl --endpoints=https://[192.168.22.9]:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt
--cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key get foo failureThreshold: 8 initialDelaySeconds: 15 timeoutSeconds: 15 name: etcd-should-fail resources: {} volumeMounts:
- mountPath: /var/lib/etcd
name: etcd-data
- mountPath: /etc/kubernetes/pki/etcd
name: etcd-certs
hostNetwork: true
priorityClassName: system-cluster-critical
volumes:
- hostPath:
path: /var/lib/etcd
type: DirectoryOrCreate
name: etcd-data
- hostPath:
path: /etc/kubernetes/pki/etcd
type: DirectoryOrCreate
name: etcd-certs
status: {}
NEW QUESTION # 63
You are working on a Kubernetes cluster that hosts a critical microservices application. You have identified that the application is vulnerable to a known attack vector through a specific service called "payment-service." You need to quickly implement a security measure to mitigate this attack vector while minimizing the impact on other services.
How can you use a network policy to isolate the "payment-service" from the rest of the cluster and prevent the attack without disrupting the normal functioning of other microservices?
Answer:
Explanation:
Solution (Step by Step) :
1. Identify the specific traffic flows:
- Analyze the network traffic of the "payment-service" to understand the communication patterns it uses.
- Determine which services are essential for the "payment-service" to operate correctly.
- Identify the specific ports and protocols used by the "payment-service" to communicate with those services.
2. Define the network policy:
- Create a network policy specifically for the "payment-service."
- Allow only the necessary traffic flows to and from the "payment-service."
- Block any other traffic, including potential attack vectors.
3. Deploy and test the policy:
- Apply the network policy to the cluster.
- Monitor the "payment-service" closely to ensure it continues to operate correctly.
- Test the policy with simulated attacks to confirm its effectiveness.
Example Network Policy:
This policy allows the "payment-service" to communicate only With "order-service" and "database" services while blocking all other traffic. This allows the service to continue operating normally while isolating it from the rest of the cluster and mitigating the potential attack vector.
NEW QUESTION # 64
SIMULATION
Enable audit logs in the cluster, To Do so, enable the log backend, and ensure that
1. logs are stored at /var/log/kubernetes-logs.txt.
2. Log files are retained for 12 days.
3. at maximum, a number of 8 old audit logs files are retained.
4. set the maximum size before getting rotated to 200MB
Edit and extend the basic policy to log:
1. namespaces changes at RequestResponse
2. Log the request body of secrets changes in the namespace kube-system.
3. Log all other resources in core and extensions at the Request level.
4. Log "pods/portforward", "services/proxy" at Metadata level.
5. Omit the Stage RequestReceived
All other requests at the Metadata level
Answer:
Explanation:
Kubernetes auditing provides a security-relevant chronological set of records about a cluster. Kube-apiserver performs auditing. Each request on each stage of its execution generates an event, which is then pre-processed according to a certain policy and written to a backend. The policy determines what's recorded and the backends persist the records.
You might want to configure the audit log as part of compliance with the CIS (Center for Internet Security) Kubernetes Benchmark controls.
The audit log can be enabled by default using the following configuration in cluster.yml:
services:
kube-api:
audit_log:
enabled: true
When the audit log is enabled, you should be able to see the default values at /etc/kubernetes/audit-policy.yaml The log backend writes audit events to a file in JSONlines format. You can configure the log audit backend using the following kube-apiserver flags:
--audit-log-path specifies the log file path that log backend uses to write audit events. Not specifying this flag disables log backend. - means standard out
--audit-log-maxage defined the maximum number of days to retain old audit log files
--audit-log-maxbackup defines the maximum number of audit log files to retain
--audit-log-maxsize defines the maximum size in megabytes of the audit log file before it gets rotated If your cluster's control plane runs the kube-apiserver as a Pod, remember to mount the hostPath to the location of the policy file and log file, so that audit records are persisted. For example:
--audit-policy-file=/etc/kubernetes/audit-policy.yaml \
--audit-log-path=/var/log/audit.log
NEW QUESTION # 65
......
According to the statistics shown in the feedback chart, the general pass rate for latest CKS test prep is 98%, which is far beyond that of others in this field. In recent years, our CKS exam guide has been well received and have reached 99% pass rate with all our dedication. As one of the most authoritative question bank in the world, our study materials make assurance for your passing the CKS Exam.
Latest CKS Test Cram: https://www.actual4dump.com/Linux-Foundation/CKS-actualtests-dumps.html
BONUS!!! Download part of Actual4dump CKS dumps for free: https://drive.google.com/open?id=1DCg7IOC2ChAwg9ViE8wlGEQudWgRfhdc