無料でクラウドストレージから最新のJpshiken CKS PDFダンプをダウンロードする：https://drive.google.com/open?id=1qlWdvufVvfNjD5UUomjsHRWms88EQADA
ネットワーク環境でCKS試験トレーニングガイドを使用すると、次回使用するときにインターネットに接続する必要がなくなり、CKS試験トレーニングを自分で選択することができます。当社のCKS試験トレーニングは機器を制限せず、ネットワークについて心配する必要はありません。これにより、CKSテストガイドを使用したい限り、学習状態に入ることができます。そして、CKSトレーニング資料は、CKS試験に合格するための最良の試験資料であることがわかります。
| Certification Vendor: | Linux Foundation |
|---|---|
| Exam Name: | Certified Kubernetes Security Specialist (CKS) Exam |
| Exam Number: | CKS |
| Related Certifications: | Certified Kubernetes Application Developer (CKAD) Certified Kubernetes Administrator (CKA) |
| Exam Duration: | 120 minutes |
| Exam Format: | Performance-based exam, Hands-on lab (Kubernetes environment), Terminal-based tasks |
| Exam Price: | USD 395 |
| Real Exam Qty: | Performance-based tasks (no fixed number) |
| Passing Score: | Not publicly disclosed |
| Available Languages: | English |
| Certificate Validity Period: | 2 years |
| Recommended Training: | Kubernetes Security Essentials (Linux Foundation Training) CKS Exam Preparation Course |
| Exam Registration: | Linux Foundation Certification Page Linux Foundation Candidate Handbook |
| Sample Questions: | Linux Foundation CKS Sample Questions |
| Exam Way: | Online, proctored, remote performance-based exam |
| Pre Condition: | Valid Certified Kubernetes Administrator (CKA) certification is required |
| Official Syllabus URL: | https://training.linuxfoundation.org/certification/certified-kubernetes-security-specialist/ |
Jpshikenは、Certified Kubernetes Security Specialist (CKS)試験に必要な人向けの安定した信頼できる試験問題プロバイダーです。 私たちは長い間市場に滞在し、成長してきました。CKS試験問題の優れた品質と高い合格率のため、私たちは常にここにいます。 安全な環境と効果的な製品については、数千人の候補者が私たちの研究の質問を選んでいます。なぜあなたは私たちJpshikenの研究の質問に挑戦してみてください。
CKS認定試験の対象となるには、個人が有効なKubernetes管理者（CKA）認定を保持する必要があります。 CKS認定は、CKA認定で学んだ知識とスキルに基づいており、個人にKubernetesのセキュリティをより深く理解しています。 CKS認定試験は、Kubernetes管理者、DevOpsエンジニア、クラウドセキュリティエンジニア、セキュリティアナリストなど、さまざまな役割で働く専門家向けに設計されています。
質問 # 16
SIMULATION
a. Retrieve the content of the existing secret named default-token-xxxxx in the testing namespace.
Store the value of the token in the token.txt
b. Create a new secret named test-db-secret in the DB namespace with the following content:
username: mysql
password: password@123
Create the Pod name test-db-pod of image nginx in the namespace db that can access test-db-secret via a volume at path /etc/mysql-credentials
正解：
解説：
To add a Kubernetes cluster to your project, group, or instance:
Navigate to your:
Project's Operations > Kubernetes page, for a project-level cluster.
Group's Kubernetes page, for a group-level cluster.
Admin Area > Kubernetes page, for an instance-level cluster.
Click Add Kubernetes cluster.
Click the Add existing cluster tab and fill in the details:
Kubernetes cluster name (required) - The name you wish to give the cluster.
Environment scope (required) - The associated environment to this cluster.
API URL (required) - It's the URL that GitLab uses to access the Kubernetes API. Kubernetes exposes several APIs, we want the "base" URL that is common to all of them. For example, https://kubernetes.example.com rather than https://kubernetes.example.com/api/v1.
Get the API URL by running this command:
kubectl cluster-info | grep -E 'Kubernetes master|Kubernetes control plane' | awk '/http/ {print $NF}' CA certificate (required) - A valid Kubernetes certificate is needed to authenticate to the cluster. We use the certificate created by default.
List the secrets with kubectl get secrets, and one should be named similar to default-token-xxxxx. Copy that token name for use below.
Get the certificate by running this command:
kubectl get secret <secret name> -o jsonpath="{['data']['ca\.crt']}"
質問 # 17
You are running a Kubernetes cluster that hosts a critical database application. You need to implement a policy that prevents any unauthorized access to the database pod from other pods within the cluster.
正解：
解説：
Solution (Step by Step) :
1. Create a Network Policy:
- Create a NetworkPolicy in the namespace of your database pod:
2. Apply the Network Policy: - Apply the NetworkP01iCY using 'kubectl apply -f database-access-control.yaml 3. Test the Policy: - Run a pod in a different namespace or with a different label and attempt to connect to the database pod. - The NetworkPolicy should prevent any unauthorized access.
質問 # 18
You have a Kubernetes cluster with a deployment named 'web-app' running a web applicatiom You suspect that a specific user with the username 'malicious-user' might be attempting unauthorized access to the cluster To investigate this, you want to use Kubernetes audit logs to identify any attempts made by this user to access resources within your namespace 'my-namespace'.
How would you configure Kubernetes audit logging and filter the logs to isolate potential malicious activity by 'malicious-user within the 'my- namespace' namespace?
正解：
解説：
Solution (Step by Step):
1. Enable Kubernetes Audit Logging:
- Create a ConfigMap named 'audit-policy' with the following content:
- Apply the ConfigMap to the cluster: bash kubectl apply -f audit-policy-yaml 2 Configure the Audit Backend: - Create a ConfigMap named 'audit-sink' with the following content
- Apply the ConfigMap: bash kubectl apply -f audit-sink-yaml 3. Filter Audit Logs: - Use ' kubectl logs -f -n kube-system' to view the audit logs. - Filter tne logs for requests made by 'malicious-user' Within 'my-namespace'- bash kubectl logs -f -n kube-system I grep "user.name=malicious-user" I grep "namespace-my-namespace" - This command will display any audit log entries related to requests made by 'malicious-user' within the my-namespace' namespace. 4. Analyze the Logs: - Examine the logs for suspicious activity, such as attempts to access sensitive resources, perform unauthorized actions, or exploit vulnerabilities. - Use the information gathered from the audit logs to take appropriate security measures. Note: - The 'lever field in the audit policy can be customized to control the level ot detail in the audit logs. For example, 'Metadata' logs only the request metadata, while 'Request' logs all details of the request - The audit logs will be stored according to the configuration of the 'audit-sink' ConfigMap. - This is a basic example. You may need to adjust the filters and analysis techniques based on your specific security requirements.
質問 # 19
You are managing a Kubernetes cluster With several applications running within pods. Your security policy mandates that all pods should run with the 'privileged' flag set to 'false' , while allowing a few pods to run with privileged access for specific tasks. How would you implement this policy by leveraging the Kubernetes security best practices?
正解：
解説：
Solution (Step by Step) :
1. Create a Security Context Constraint (SCC): Create a new SCC named 'non-privileged-sce with the following configuration:
- 'allowPrivilegeEscalation': 'false' (Prevents pods from elevating privileges even if they run with privileged containers)
- 'privileged': 'false' (Disallows containers from running with privileged access)
- 'runAsLJser': ' 1000' (Assigns a specific non-root user ID for containers)
- 'readOnlyRootFilesystem': 'true' (Prevents containers from modifying the host's root filesystem)
- 'seccompProfile': 'localhost/unconfined' (Specifies a seccomp profile for restricting system calls)
2. Apply the SCC: Apply the SCC using 'kuoectl apply -f non-privileged-scc.yaml 3. Create a Second SCC for Privileged Pods: Create a new SCC named 'privileged-sce with the following configuratiom - 'allowPrivilegeEscalation': 'trues - 'privileged': 'true' - 'runAsuser': - 'readOnlyRootFilesystem': 'false' - 'seccompprofile': 'localhost/unconfined'
4. Apply the Privileged SCC: Apply the SCC using 'kubectl apply -f privileged-scc.yaml 5. Update Your Deployment Configurations: - For deployments requiring privileged access, include 'securityContext.securityContextConstraints: privileged-sce within the pod specification. - For all other deployments, include 'securityContext.securityContextConstraints: non-prjvileged-scc' within the pod specification.
6. Restrict Access to SCCs: You can funer enhance security by configuring which users or service accounts can use each SCC. This can be done by using Role-Based Access Control (RBAC) to grant permissions to specific user accounts or service accounts for the SCCs.
This approach ensures that the majority of pods operate with minimal privileges, enhancing security, while allowing a few essential deployments to run with elevated access. Remember to constantly review and update your security policies as your cluster and applications evolve.
質問 # 20
SIMULATION
Given an existing Pod named nginx-pod running in the namespace test-system, fetch the service-account-name used and put the content in /candidate/KSC00124.txt Create a new Role named dev-test-role in the namespace test-system, which can perform update operations, on resources of type namespaces.
Create a new RoleBinding named dev-test-role-binding, which binds the newly created Role to the Pod's ServiceAccount ( found in the Nginx pod running in namespace test-system).
正解：
解説：
See the Explanation belowExplanation:
質問 # 21
......
CKS資格勉強: https://www.jpshiken.com/CKS_shiken.html
P.S.JpshikenがGoogle Driveで共有している無料の2026 Linux Foundation CKSダンプ：https://drive.google.com/open?id=1qlWdvufVvfNjD5UUomjsHRWms88EQADA