無料でクラウドストレージから最新のJapancert CKS PDFダンプをダウンロードする：https://drive.google.com/open?id=1HEqjQufP5IyV9NPSL05zjPz7n1Q09Auo
Linux Foundation CKS試験のAPPテストエンジンは、ほとんどの認定候補者がファッションであり、この新しい学習方法に簡単に適応できるため、少なくとも60％の受験者に人気があります。 CKS試験のAPPテストエンジンは、いつでもどこでも使用できると考える人がいます。 また、候補者の一部は、このバージョンでは実際のテストで実際のシーンをシミュレートできると考えています。 ブラウザを開くことができれば、学ぶことができます。 また、オフラインで学習したい場合は、CKS試験のAPPテストエンジンをダウンロードしてインストールした後、キャッシュをクリアしないでください。
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Supply Chain Security | 20% | - Secure CI/CD practices - Image scanning and verification |
| Topic 2: Monitoring, Logging and Runtime Security | 15% | - Audit logging and monitoring - Runtime threat detection |
| Topic 3: Cluster Setup | 15% | - Secure installation configuration - Hardening cluster components |
| Topic 4: Minimizing Microservice Vulnerabilities | 20% | - Container isolation and security contexts - Pod security standards |
| Topic 5: System Hardening | 15% | - Host security controls - Kernel and node security configuration |
| Topic 6: Cluster Hardening | 15% | - Authentication and authorization - API server security |
>> Linux Foundation CKS試験攻略 <<
専門的にIT認証試験のためのソフトを作る会社として、我々の提供するのはLinux FoundationのCKSソフトのような高質量の商品だけでなく、最高の購入した前のサービスとアフターサービスです。オンライン係員は全日であなたにサービスを提供します。ほかのソフトを探したいなら、それとも、疑問があるなら、係員にお問い合わせください。ご購入した一年間、Linux FoundationのCKSソフトが更新されたら、あなたに最新版のソフトを送ります。
質問 # 58
You have a Kubernetes cluster with a Deployment named 'my-app' that exposes a service on port 80. You want to enforce a policy that allows only traffic from pods With a specific label to access this service.
正解：
解説：
Solution (Step by Step) :
1. Create a NetworkPolicy:
- Define a NetworkPolicy resource with a 'podSelector' that matches the 'my-app' Deployment.
- Create an 'ingress' rule that allows traffic only from pods with the specific label.
- Use the 'from' field to specify the label selector.
- Ensure that the port 80 is included in the 'ports' field.
2. Apply the NetworkPolicy: - Apply the YAML file using 'kubectl apply -f my-app-label-policy-yamr 3. Verify the NetworkPolicy: - Use 'kubectl get networkpolicies' to list the available network policies. - Use 'kubectl describe networkpolicy my-app-label-policy' to view the details ot the applied policy. 4. Test the NetworkPolicy: - Deploy a pod with the label 'allowed: true' and attempt to access the service on port 80. Verify that the connection is successful. - Deploy a pod without the label 'allowed: true' and attempt to access the service on port 80. Verify that the connection is denied.
質問 # 59
Enable audit logs in the cluster, To Do so, enable the log backend, and ensure that
1. logs are stored at /var/log/kubernetes/kubernetes-logs.txt.
2. Log files are retained for 5 days.
3. at maximum, a number of 10 old audit logs files are retained.
Edit and extend the basic policy to log:
正解：A
解説：
2. Log the request body of deployments changes in the namespace kube-system.
3. Log all other resources in core and extensions at the Request level.
4. Don't log watch requests by the "system:kube-proxy" on endpoints or
質問 # 60
You are responsible for securing the Kubernetes clusters supply chain. Your organization utilizes a private Docker registry to host container images. Currently, images are built and pushed to this registry without any validation or signing. How can you implement a policy to ensure that only signed and verified images are deployed to the cluster?
正解：
解説：
Solution (Step by Step) :
1. Set Up a Signing Authority:
- Choose a trusted entity (e.g., a dedicated server or a dedicated user account) to act as the signing authority.
- Generate a private and public key pair using tools like 'openssr or 'gpg'
- Store the private key securely and ensure only authorized individuals have access.
2. Configure Image Signing:
- Create a script or integrate signing into your image build process.
- when building an image, use the private key from the signing authority to sign the image.
- The signing process embeds a digital signature within the image manifest.
3. Integrate Image Verification
- Configure the Kubernetes cluster to enforce image signature verification.
- Utilize tools like 'admission webhookS to inspect incoming images.
- The webh00k will check if the image has a valid signature from the trusted authority.
- If the signature is invalid or missing, the deployment will be blocked.
4. Example Implementation (using 'cosign'):
-
5. Integrate with CI/CD pipelines: - Integrate image signing and verification into your automated CI/CD pipelines. - This ensures consistency and prevents accidental deployment of unsigned images.
質問 # 61
Enable audit logs in the cluster, To Do so, enable the log backend, and ensure that
1. logs are stored at /var/log/kubernetes/kubernetes-logs.txt.
2. Log files are retained for 5 days.
3. at maximum, a number of 10 old audit logs files are retained.
Edit and extend the basic policy to log:
1. Cronjobs changes at RequestResponse
2. Log the request body of deployments changes in the namespace kube-system.
3. Log all other resources in core and extensions at the Request level.
4. Don't log watch requests by the "system:kube-proxy" on endpoints or
正解：
解説：
質問 # 62
You are building a highly secure and sensitive Kubernetes cluster. Your architecture includes a separate namespace for running all CI/CD pipeline pods, isolated from the main application namespace. You want to ensure that only authorized users can access secrets in the CI/CD namespace- Describe how you would implement a secure mechanism for managing secrets and limiting access to them within the CI/CD namespace.
正解：
解説：
Solution (Step by Step) :
1. Create a Dedicated Service Account for CI/CD:
- In the CI/CD namespace, create a service account named 'ci-cd-sa'
- This service account will be used only for running CI/CD pipelines.
2. Create a Secret with Restricted Access:
- Use the ' kubectl create secret generic' command to create a new secret in the CI/CD namespace.
- For example, you could use 'kubectl create secret generic my-secret -namespace-ci-cd' to create a secret named 'my- secret
- Use '--type' argument to create secrets of different types such as 'opaque', 'docker-registry' etc.
3. Create a RoleBinding:
- Create a role binding named 'ci-cd-sa-rolebinding' that associates the 'ci-cd-sa' service account with a custom role named 'ci-cd-secret-reader'
- This custom role will only grant access to read tne secrets in tne CI/CD namespace.
- Create a new role for the ci-cd-sa service account to only read the secrets in the namespace.
4. Configure your CI/CD pipeline: - Ensure your CI/CD pipelines are configured to use the 'ci-cd-sa' service account. - Configure your pipeline to access the secrets using the Kubernetes API.
質問 # 63
......
当社Linux FoundationのCKS学習ツールでは、選択できる3つのバージョンがあり、PDFバージョン、PCバージョン、APPオンラインバージョンが含まれます。各バージョンはさまざまな状況や機器に対応しており、最も便利な方法を選択してCKSテストトレントを学習できます。たとえば、APPオンラインバージョンは印刷可能で、ダウンロードへの即時アクセスを促進します。 CKSガイドトレントはいつでもどこでも学習できます。 CKS学習ツールのPCバージョンは、実際の試験のシナリオを刺激できます。 365日間の無料アップデートと無料デモを提供しています。
CKS試験情報: https://www.japancert.com/CKS.html
無料でクラウドストレージから最新のJapancert CKS PDFダンプをダウンロードする：https://drive.google.com/open?id=1HEqjQufP5IyV9NPSL05zjPz7n1Q09Auo