BONUS!!! Download part of ActualCollection CKS dumps for free: https://drive.google.com/open?id=1ls6g_GIgp5wVmk_iHdcvhtl_qTJLusmg
In the past few years, our CKS study materials have helped countless candidates pass the CKS exam. After having a related certification, some of them encountered better opportunities for development, some went to great companies, and some became professionals in the field. CKS Study Materials have stood the test of time and market and received countless praises. We will transfer our CKS test prep to you online immediately, and this service is also the reason why our CKS study torrent can win peopleโs heart and mind.
| Section | Weight | Objectives |
|---|---|---|
| Cluster Hardening | 15% | - Minimize admission of privileged containers - Minimize admission of containers with sharing the host IPC namespace - Minimize admission of containers with capabilities assigned - Minimize admission of containers without seccomp profiles - Minimize admission of containers without AppArmor profile - Minimize admission of containers with sharing the host network namespace - Minimize admission of containers with added capabilities - Minimize admission of containers with FlexVolume volumes - Minimize admission of containers without a security context - Minimize admission of containers with sharing the host process namespace - Minimize admission of containers with hostPath volumes - Minimize admission of containers with raw block devices - Minimize admission of containers with allowPrivilegeEscalation - Minimize admission of containers that allow host namespaces |
| Minimize Microservice Vulnerabilities | 20% | - Understand the principle of immutable containers - Use OPA Gatekeeper to enforce security controls - Use PSP to enforce security controls - Configure network policies for namespace isolation - Use AppArmor or seccomp profiles to constrain container behavior - Set appropriate security contexts for pods and containers |
| Monitoring, Logging, and Runtime Security | 20% | - Understand and monitor network traffic - Falco - container security monitoring and threat detection - Perform behavioral analytics to detect malicious activity - Minimize the attack surface using container health indicators - Detect threats at the container level - Audit and detect logs and events for anomalies |
| Cluster Setup | 10% | - Understand the security implications of embedding cloud provider flags - Use role-based access control (RBAC) to minimize exposure - Use Pod Security Policies to control security-related pod behaviors - Use Cis benchmarks to check Kubernetes cluster settings - Configure TLS certificates and minimum version for etcd - Manage sensitive information in clusters - Implement Pod-to-Pod encryption using mTLS or WireGuard |
| System Hardening | 15% | - Understand the concept of OPA (Open Policy Agent) and Gatekeeper - Enable audit logging - Kernel defaults and parameters using sysctl - Modify host components to improve security |
| Supply Chain Security | 20% | - Use static analysis tools to detect vulnerabilities - Use distroless images for static workload - Use image admission controllers to prevent use of untrusted images - Sign container images and verify signatures - Understand the container build process - Minimize base image footprint - Understand image security scanning and its workflow - Understand the software supply chain best practices |
You can enter a better company and improve your salary if you obtain the certification for the exam. CKS exam materials will help you pass the exam and get corresponding certification successfully. CKS exam materials contain most of knowledge points for the exam, and you can have a good command of the knowledge points if you choose us. In addition, we offer you free demo for CKS Exam Braindumps, and you can have a try before buying. We provided you with free update for 365 days, and the update version will be sent to your email automatically.
NEW QUESTION # 54
SIMULATION
Documentation
ServiceAccount, Deployment,
Projected Volumes
You must connect to the correct host . Failure to do so may
result in a zero score.
[candidate@base] $ ssh cks000033
Context
A security audit has identified a Deployment improperly handling service account tokens, which could lead to security vulnerabilities.
Task
First, modify the existing ServiceAccount stats-monitor-sa in the namespace monitoring to turn off automounting of API credentials.
Next, modify the existing Deployment stats-monitor in the namespace monitoring to inject a ServiceAccount token mounted at /var/run/secrets/kubernetes.io/serviceaccount/token.
Use a Projected Volume named token to inject the ServiceAccount token and ensure that it is mounted read-only.
The Deployment's manifest file can be found at /home/candidate/stats-monitor/deployment.yaml.
Answer:
Explanation:
See the Explanation below for complete solution
Explanation:
1) Connect to correct host
ssh cks000033
sudo -i
export KUBECONFIG=/etc/kubernetes/admin.conf
2) Patch the ServiceAccount to disable automounting
Task: turn off automounting of API credentials for stats-monitor-sa in monitoring.
kubectl -n monitoring patch sa stats-monitor-sa -p '{"automountServiceAccountToken": false}' Verify:
kubectl -n monitoring get sa stats-monitor-sa -o yaml | grep -i automount
3) Edit the Deployment manifest file
Task says to modify the manifest at:
/home/candidate/stats-monitor/deployment.yaml
vi /home/candidate/stats-monitor/deployment.yaml
4) In the Deployment, ensure it uses the ServiceAccount AND inject token via Projected Volume
4.1 Make sure Deployment uses the SA
Under:
spec: -> template: -> spec:
ensure:
serviceAccountName: stats-monitor-sa
(If it already exists, leave it; don't add extra changes beyond requirements.)
4.2 Add a projected volume named token
Under:
spec: -> template: -> spec: -> volumes:
add (or modify existing volume if present) so it is exactly:
- name: token
projected:
sources:
- serviceAccountToken:
path: token
This creates the file token inside the mounted directory, so the final path becomes:
/var/run/secrets/kubernetes.io/serviceaccount/token
4.3 Mount the projected volume read-only at the required location
Under the target container:
spec: -> template: -> spec: -> containers: -> (your container) -> volumeMounts:
Add:
- name: token
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
readOnly: true
โ
This satisfies:
Projected volume name: token
Mount path: /var/run/secrets/kubernetes.io/serviceaccount/token (file inside mount) Mounted read-only
4.4 Important: Don't break default token mount behavior
Because you disabled SA automounting at the ServiceAccount level, you must explicitly mount the projected token (done above). That's the whole point of this task.
Save and exit:
:wq
5) Apply the updated Deployment
kubectl -n monitoring apply -f /home/candidate/stats-monitor/deployment.yaml Wait rollout:
kubectl -n monitoring rollout status deployment/stats-monitor
6) Verify the token file exists in the running Pod
Get a pod name:
POD=$(kubectl -n monitoring get pods -l app=stats-monitor -o jsonpath='{.items[0].metadata.name}') echo $POD Check the token file path exists:
kubectl -n monitoring exec -it $POD -- ls -l /var/run/secrets/kubernetes.io/serviceaccount/token Optional: confirm it's mounted read-only (usually shown by mount options):
kubectl -n monitoring exec -it $POD -- mount | grep /var/run/secrets/kubernetes.io/serviceaccount
โ
What the examiner checks
SA stats-monitor-sa has:
automountServiceAccountToken: false
Deployment stats-monitor mounts a projected volume named token
Token file is at:
/var/run/secrets/kubernetes.io/serviceaccount/token
Mount is readOnly: true
If label selector doesn't match (-l app=stats-monitor)
Use:
kubectl -n monitoring get pods
Then set:
POD=<paste-pod-name>
NEW QUESTION # 55
You have a Pod that runs an application that accesses a database service running in a different namespace. You want to enforce a rule that only allows the pod to connect to the database service on a specific port. Explain how to achieve this using NetworkPolicy.
Answer:
Explanation:
Solution (Step by Step) :
1. Create a NetworkPolicy:
- Create a ' NetworkPoIicV resource that defines the rules for the pod.
- This example allows the pod to connect to the database service on port 5432 in the 'database-namespace namespace.
2. Apply the NetworkPolicy: - Apply the 'NetworkPolicy' using 'kubectl apply -f database-access-policy.yaml 3. Verify the Policy: - Run the application in the pod and attempt to connect to the database service on the specified port- - Verify that the connection is successful. - Attempt to connect to the database service on a different port or from a different namespace. - Verity that these attempts are blocked.
NEW QUESTION # 56
Cluster: scanner Master node: controlplane Worker node: worker1
You can switch the cluster/configuration context using the following command:
[desk@cli] $ kubectl config use-context scanner
Given: You may use Trivy's documentation.
Task: Use the Trivy open-source container scanner to detect images with severe vulnerabilities used by Pods in the namespace nato.
Look for images with High or Critical severity vulnerabilities and delete the Pods that use those images. Trivy is pre-installed on the cluster's master node. Use cluster's master node to use Trivy.
Answer:
Explanation:
NEW QUESTION # 57
Your organization is running a critical application in a Kubernetes cluster, and you need to implement a system to monitor and detect any malicious activity within the containers. Describe how you can leverage audit logs and container runtime security tools like Sysdig to achieve this goal.
Answer:
Explanation:
Solution (Step by Step) :
1. Enable Kubernetes Audit Logging:
- Configure your Kubernetes cluster to generate audit logs. This involves enabling the 'audit' feature in the 'kube-apiserver' configuration and specifying the desired level of audit logging (e.g., 'Metadata', 'Request' , 'RequestResponse').
2. Define Audit Policies:
- Create audit policies to filter and prioritize the audit events you want to capture. For example, define a policy to audit all container image pulls and API requests related to specific resources.
3. Deploy Sysdig: - Install and configure Sysdig on your Kubernetes cluster Sysdig is a powerful container runtime security tool that provides real-time monitoring and threat detection capabilities. 4. Configure Sysdig Rules: - Create custom rules in Sysdig to detect suspicious activity within containers. These rules can be based on specific events, file access patterns, network connections, and other indicators of compromise.
5. Integrate with Logging and Monitoring Systems: - Integrate Sysdig with your existing logging and monitoring tools (e.g., ELK stack, Prometheus) to centralize and analyze security events. 6. Review and Analyze Logs: - Regularly review the audit logs and Sysdig alerts to identify any potential security threats. - Investigate suspicious events to understand the root cause and take appropriate actions.
NEW QUESTION # 58
You can switch the cluster/configuration context using the following command: [desk@cli] $ kubectl config use-context qa Context: A pod fails to run because of an incorrectly specified ServiceAccount Task: Create a new service account named backend-qa in an existing namespace qa, which must not have access to any secret. Edit the frontend pod yaml to use backend-qa service account Note: You can find the frontend pod yaml at /home/cert_masters/frontend-pod.yaml
Answer:
Explanation:
[desk@cli] $ k create sa backend-qa -n qa sa/backend-qa created [desk@cli] $ k get role,rolebinding -n qa No resources found in qa namespace. [desk@cli] $ k create role backend -n qa --resource pods,namespaces,configmaps --verb list # No access to secret [desk@cli] $ k create rolebinding backend -n qa --role backend --serviceaccount qa:backend-qa [desk@cli] $ vim /home/cert_masters/frontend-pod.yaml apiVersion: v1 kind: Pod metadata:
name: frontend
spec:
serviceAccountName: backend-qa # Add this
image: nginx
name: frontend
[desk@cli] $ k apply -f /home/cert_masters/frontend-pod.yaml pod created
[desk@cli] $ k create sa backend-qa -n qa serviceaccount/backend-qa created [desk@cli] $ k get role,rolebinding -n qa No resources found in qa namespace. [desk@cli] $ k create role backend -n qa --resource pods,namespaces,configmaps --verb list role.rbac.authorization.k8s.io/backend created [desk@cli] $ k create rolebinding backend -n qa --role backend --serviceaccount qa:backend-qa rolebinding.rbac.authorization.k8s.io/backend created [desk@cli] $ vim /home/cert_masters/frontend-pod.yaml apiVersion: v1 kind: Pod metadata:
name: frontend
spec:
serviceAccountName: backend-qa # Add this
image: nginx
name: frontend
[desk@cli] $ k apply -f /home/cert_masters/frontend-pod.yaml pod/frontend created https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
NEW QUESTION # 59
......
ActualCollection is an excellent source of information on IT Certifications. In the ActualCollection, you can find study skills and learning materials for your exam. ActualCollection's Linux Foundation CKS training materials are studied by the experienced IT experts. It has a strong accuracy and logic. To encounter ActualCollection, you will encounter the best training materials. You can rest assured that using our Linux Foundation CKS Exam Training materials. With it, you have done fully prepared to meet this exam.
CKS Reliable Exam Dumps: https://www.actualcollection.com/CKS-exam-questions.html
P.S. Free & New CKS dumps are available on Google Drive shared by ActualCollection: https://drive.google.com/open?id=1ls6g_GIgp5wVmk_iHdcvhtl_qTJLusmg