BONUS!!! Download part of ExamDiscuss CKS dumps for free: https://drive.google.com/open?id=1z5kOqsf-EVIkOXfeskzGfG3Z-QSimJz1
This is the CKS PDF format which contains real CKS exam questions. You can print it and make a hard copy of this PDF file as well which helps you to prepare on the go. It comes in handy format and helps you prepare well with updated Certified Kubernetes Security Specialist (CKS) exam questions. Moreover, this PDF has questions that are according to the present content of the test. This PDF format helps you to enhance your understanding of each topic which you need to self-evaluate to boost your Linux Foundation CKS Exam Score.
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Cluster Hardening | 15% | - Authentication and authorization - API server security |
| Topic 2: Supply Chain Security | 20% | - Image scanning and verification - Secure CI/CD practices |
| Topic 3: Minimizing Microservice Vulnerabilities | 20% | - Container isolation and security contexts - Pod security standards |
| Topic 4: System Hardening | 15% | - Kernel and node security configuration - Host security controls |
| Topic 5: Cluster Setup | 15% | - Secure installation configuration - Hardening cluster components |
| Topic 6: Monitoring, Logging and Runtime Security | 15% | - Runtime threat detection - Audit logging and monitoring |
The CKS training vce offered by ExamDiscuss will be the best tool for you to pass your actual test. The CKS questions & answers are especially suitable for the candidates like you for the coming exam test. The contents of Linux Foundation study dumps are edited by our experts who have rich experience, and easy for all of you to understand. So, with the skills and knowledge you get from CKS practice pdf, you can 100% pass and get the certification you want.
NEW QUESTION # 15
SIMULATION
Context
The kubeadm-created cluster's Kubernetes API server was, for testing purposes, temporarily configured to allow unauthenticated and unauthorized access granting the anonymous user duster-admin access.
Task
Reconfigure the cluster's Kubernetes API server to ensure that only authenticated and authorized REST requests are allowed.
Use authorization mode Node,RBAC and admission controller NodeRestriction.
Cleaning up, remove the ClusterRoleBinding for user system:anonymous.
Answer:
Explanation:
See the Explanation below
Explanation:
NEW QUESTION # 16
Task
Analyze and edit the given Dockerfile /home/candidate/KSSC00301/Docker file (based on the ubuntu:16.04 image), fixing two instructions present in the file that are prominent security/best-practice issues.
Analyze and edit the given manifest file /home/candidate/KSSC00301/deployment.yaml, fixing two fields present in the file that are prominent security/best-practice issues.
Answer:
Explanation:
NEW QUESTION # 17
You need to configure a Kubernetes cluster to use a pod security policy (PSP) that restricts the use of privileged containers and specific capabilities. You want to only allow specific pods in the 'production' namespace to run With the 'NET_ADMIN' capability.
Answer:
Explanation:
Solution (Step by Step) :
1. create a PSPI
- Define a PSP that restricts the use of privileged containers and capabilities, except for the capability for pods in the 'production' namespace.
2. Create a PSP Binding: - Bind the PSP to the 'production' namespace-
3. Create a Pod: - Create a Pod in the 'production' namespace and specify the 'securitycontext' with the 'NET_ADMIN' capability.
4. Apply the YAML files: - Apply the created YAML files using 'kubectl apply -f 5. Verify the permissions: - Try to create a Pod in other namespaces with the 'NET_ADMIN' capability. It should be rejected.
NEW QUESTION # 18
SIMULATION
On the Cluster worker node, enforce the prepared AppArmor profile
#include <tunables/global>
profile docker-nginx flags=(attach_disconnected,mediate_deleted) {
#include <abstractions/base>
network inet tcp,
network inet udp,
network inet icmp,
deny network raw,
deny network packet,
file,
umount,
deny /bin/** wl,
deny /boot/** wl,
deny /dev/** wl,
deny /etc/** wl,
deny /home/** wl,
deny /lib/** wl,
deny /lib64/** wl,
deny /media/** wl,
deny /mnt/** wl,
deny /opt/** wl,
deny /proc/** wl,
deny /root/** wl,
deny /sbin/** wl,
deny /srv/** wl,
deny /tmp/** wl,
deny /sys/** wl,
deny /usr/** wl,
audit /** w,
/var/run/nginx.pid w,
/usr/sbin/nginx ix,
deny /bin/dash mrwklx,
deny /bin/sh mrwklx,
deny /usr/bin/top mrwklx,
capability chown,
capability dac_override,
capability setuid,
capability setgid,
capability net_bind_service,
deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir)
# deny write to files not in /proc/<number>/** or /proc/sys/**
deny @{PROC}/{[
BONUS!!! Download part of ExamDiscuss CKS dumps for free: https://drive.google.com/open?id=1z5kOqsf-EVIkOXfeskzGfG3Z-QSimJz1