P.S.It-PassportsがGoogle Driveで共有している無料の2026 Linux Foundation CKSダンプ：https://drive.google.com/open?id=1TYM8ynPatHz8aMrz9njV-1UwdWyGShWd
誰もが成功を望んでいますが、誰もが勉強に忍耐する強い心を持っているわけではありません。現在Linux Foundationのステータスに満足できない場合は、CKSの実際の試験が役立ちます。 CKS試験問題は、常に最高99％の合格率を誇っています。教材を使用すると、試験準備の時間を節約できます。 CKSテストエンジンを選択すると、簡単に認定を取得できます。選択して、CKS学習教材を購入し、今すぐ学習を開始してください！知識、Certified Kubernetes Security Specialist (CKS)実績と幸福があなたを待っています！
| Section | Weight | Objectives |
|---|---|---|
| Supply Chain Security | 20% | - Image security & scanning - SBOM & CI/CD security - Signed artifacts & verification - Permitted registries - Static analysis tools |
| Minimize Microservice Vulnerabilities | 20% | - Pod Security Standards - Isolation & multi-tenancy - Secret management - Security contexts - OPA/Gatekeeper implementation |
| System Hardening | 10% | - Minimize OS attack surface - Kernel hardening (AppArmor, seccomp) - Network access control - Least privilege IAM |
| Cluster Setup | 15% | - Secure Ingress configuration - Binary verification - CIS benchmark compliance - Node metadata protection - Network security policies |
| Monitoring, Logging and Runtime Security | 20% | - Container immutability - Threat detection (Falco) - Audit log configuration - Behavioral analytics - Incident investigation |
| Cluster Hardening | 15% | - Service account security - Component updates & vulnerability mitigation - API access restriction - RBAC configuration |
当社はIt-Passports、世界中のCKS試験トレントコンパイル部門の販売およびアフターサービスを提供する多国籍企業です。 さらに、当社はこの分野で一流の企業になりました。そのため、関連するCKS認定を取得するために試験の準備をしている場合、当社がまとめたCKSのLinux Foundation試験問題はあなたの堅実なものです。 選択。 当社の世界中のすべての従業員は、お客様がCKS試験に合格するための電子的なCKS試験トレントの最高のグローバルサプライヤになるという共通の使命の下でCertified Kubernetes Security Specialist (CKS)運営されています。
質問 # 61
You can switch the cluster/configuration context using the following command: [desk@cli] $ kubectl config use-context dev Context: A CIS Benchmark tool was run against the kubeadm created cluster and found multiple issues that must be addressed. Task: Fix all issues via configuration and restart the affected components to ensure the new settings take effect. Fix all of the following violations that were found against the API server: 1.2.7 authorization-mode argument is not set to AlwaysAllow FAIL 1.2.8 authorization-mode argument includes Node FAIL 1.2.7 authorization-mode argument includes RBAC FAIL Fix all of the following violations that were found against the Kubelet: 4.2.1 Ensure that the anonymous-auth argument is set to false FAIL 4.2.2 authorization-mode argument is not set to AlwaysAllow FAIL (Use Webhook autumn/authz where possible) Fix all of the following violations that were found against etcd: 2.2 Ensure that the client-cert-auth argument is set to true
正解：
解説：
worker1 $ vim /var/lib/kubelet/config.yaml
anonymous:
enabled: true #Delete this
enabled: false #Replace by this
authorization:
mode: AlwaysAllow #Delete this
mode: Webhook #Replace by this
worker1 $ systemctl restart kubelet. # To reload kubelet config ssh to master1 master1 $ vim /etc/kubernetes/manifests/kube-apiserver.yaml - -- authorization-mode=Node,RBAC master1 $ vim /etc/kubernetes/manifests/etcd.yaml - --client-cert-auth=true Explanation ssh to worker1 worker1 $ vim /var/lib/kubelet/config.yaml apiVersion: kubelet.config.k8s.io/v1beta1 authentication:
anonymous:
enabled: true #Delete this
enabled: false #Replace by this
webhook:
cacheTTL: 0s
enabled: true
x509:
clientCAFile: /etc/kubernetes/pki/ca.crt
authorization:
mode: AlwaysAllow #Delete this
mode: Webhook #Replace by this
webhook:
cacheAuthorizedTTL: 0s
cacheUnauthorizedTTL: 0s
cgroupDriver: systemd
clusterDNS:
- 10.96.0.10
clusterDomain: cluster.local
cpuManagerReconcilePeriod: 0s
evictionPressureTransitionPeriod: 0s
fileCheckFrequency: 0s
healthzBindAddress: 127.0.0.1
healthzPort: 10248
httpCheckFrequency: 0s
imageMinimumGCAge: 0s
kind: KubeletConfiguration
logging: {}
nodeStatusReportFrequency: 0s
nodeStatusUpdateFrequency: 0s
resolvConf: /run/systemd/resolve/resolv.conf
rotateCertificates: true
runtimeRequestTimeout: 0s
staticPodPath: /etc/kubernetes/manifests
streamingConnectionIdleTimeout: 0s
syncFrequency: 0s
volumeStatsAggPeriod: 0s
worker1 $ systemctl restart kubelet. # To reload kubelet config ssh to master1 master1 $ vim /etc/kubernetes/manifests/kube-apiserver.yaml
master1 $ vim /etc/kubernetes/manifests/etcd.yaml
質問 # 62
You are tasked with securing a Kubernetes cluster that runs sensitive workloads. To prevent unauthorized access, you need to ensure container immutability at runtime. How would you implement a solution that prevents any modifications to the running containers once they are launched? Provide a detailed breakdown of the steps and configurations you would use.
正解：
解説：
Solution (Step by Step) :
1. Enable Read-Only Root Filesystem:
- Configuration:
- Set the 'securityContext.readOnlyRootFilesystem' flag to 'true' in your Pod specification. This ensures that the containers root filesystem is mounted as read-only.
- Example:
2. Disable Privileged Containers: - Configuration: - Set tne 'securitycontext.privileged' flag to 'false' in your Pod specification. This prevents containers from running with escalated privileges, limiting their ability to modify the host system. - Example:
3. Implement Admission Webhook with Container Image Scanning: - Configuration: - Configure an admission webhook using tools like Open Policy Agent (OPA) or Kyverno to inspect container images before they are launched. - Use a container image scanner (e.g., Clair, Ancnore) to analyze images for vulnerabilities and ensure they adhere to your security policies. - Example COPA):
4. Use Immutable Pod Specs: - Configuration: - Utilize the field to specify the container image. - Avoid using in your pod spec. This ensures that the pod's resources are not modifiable during runtime. - Example:
5. Enforce Network Security Policies (NSPs): - Configuration: - Implement Network Security Policies to control network traffic flow between pods within the cluster. This helps prevent unauthorized communication and limits the attack surface. - Example:
Note: This approach offers a multi-layered defense-in-depth strategy for ensuring container immutability at runtime, but you should also consider implementing additional security measures such as container image signing and secure runtime environments.
質問 # 63
You are running a Kubernetes cluster with a deployment named "my-app" that uses a container image from a private registry- You suspect that a recent deployment update may have introduced a vulnerability in one of the containers. Explain how you would use pod security policies and runtime security tools like Falco to investigate and mitigate this potential security risk.
正解：
解説：
Solution (Step by Step) :
1. Enable Pod Security Policies (PSPs):
- Create a PSP that restricts the container's capabilities, resource usage, and network access. For example, limit the container's resource requests and limits, restrict access to sensitive host resources, and disallow the creation of privileged containers.
- Apply the PSP to your deployment using the 'podSecurityPolicy' field in the deployment's spec:
2. Implement Runtime Security with Falco: - Deploy Falco on your Kubernetes cluster using a Daemon set Falco uses rules to detect suspicious activity within containers. - Configure Falco rules to alert on events like: - Container privilege escalation attempts: Monitor for attempts to run containers with elevated privileges. - Suspicious network connections: Detect unexpected network connections originating from within containers- - File system modifications: Identify unauthorized modifications to files within container images. - Define a Falco rule that detects attempts to access sensitive files:
3. Investigate the Vulnerability: - Review the Falco alerts to identify specific suspicious activities related to the deployment update. - Analyze the logs and metrics of the affected container to gather further evidence of the vulnerability. - Inspect the container image for any unauthorized changes or vulnerabilities. 4. Mitigate the Vulnerability: - If a vulnerability is identified, update the container image with a fix- - Redeploy the deployment with the updated container image. - Strengthen the PSP to prevent similar vulnerabilities from arising in the future. - Review and refine the Falco rules based on the findings of the investigation to improve the overall security posture.
質問 # 64
SIMULATION
You can switch the cluster/configuration context using the following command:
[desk@cli] $ kubectl config use-context qa
Context:
A pod fails to run because of an incorrectly specified ServiceAccount
Task:
Create a new service account named backend-qa in an existing namespace qa, which must not have access to any secret.
Edit the frontend pod yaml to use backend-qa service account
Note: You can find the frontend pod yaml at /home/cert_masters/frontend-pod.yaml
正解：
解説：
See the Explanation belowExplanation:
[desk@cli] $ k create sa backend-qa -n qa
sa/backend-qa created
[desk@cli] $ k get role,rolebinding -n qa
No resources found in qa namespace.
[desk@cli] $ k create role backend -n qa --resource pods,namespaces,configmaps --verb list
# No access to secret
[desk@cli] $ k create rolebinding backend -n qa --role backend --serviceaccount qa:backend-qa
[desk@cli] $ vim /home/cert_masters/frontend-pod.yaml
apiVersion: v1
kind: Pod
metadata:
name: frontend
spec:
serviceAccountName: backend-qa # Add this
image: nginx
name: frontend
[desk@cli] $ k apply -f /home/cert_masters/frontend-pod.yaml
pod created
[desk@cli] $ k create sa backend-qa -n qa
serviceaccount/backend-qa created
[desk@cli] $ k get role,rolebinding -n qa
No resources found in qa namespace.
[desk@cli] $ k create role backend -n qa --resource pods,namespaces,configmaps --verb list role.rbac.authorization.k8s.io/backend created
[desk@cli] $ k create rolebinding backend -n qa --role backend --serviceaccount qa:backend-qa rolebinding.rbac.authorization.k8s.io/backend created
[desk@cli] $ vim /home/cert_masters/frontend-pod.yaml
apiVersion: v1
kind: Pod
metadata:
name: frontend
spec:
serviceAccountName: backend-qa # Add this
image: nginx
name: frontend
[desk@cli] $ k apply -f /home/cert_masters/frontend-pod.yaml
pod/frontend created
https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
質問 # 65
You have a Kubernetes cluster witn a Deployment named 'my-app' that runs multiple replicas of an application. The application exposes an API endpoint on port 8080- You need to configure a network policy that allows only specific IP addresses to access this endpoint.
正解：
解説：
Solution (Step by Step) :
1. Create a Network Policy:
- Define a NetworkPoIicy resource with a 'podSeIector targeting the 'my-app' Deployment
- Specify an 'ingress' rule that allows traffic from the allowed IP addresses.
- Use the 'from' field to specify the source IP addresses. You can either provide individual IP addresses or CIDR ranges.
- Ensure that the port 8080 is allowed in the 'ports field.
2. Apply the Network Policy: - Apply the YAML file using 'kubectl apply -f my-app-network-policy.yamr 3. Verify the Network Policy: - Use 'kubectl get networkpolicies' to list the available network policies. - Use kubectl describe networkpolicy my-app-network-policy' to view the details of the applied policy. 4. Test the Network Policy: - Attempt to access the API endpoint from an allowed IP address and verify that the connection is successful. - Attempt to access the API endpoint from a blocked IP address and verity that the connection is denied.
質問 # 66
......
初めて練習を選ぶことは、ギャンブルをすることに少し似ていると思うかもしれません。 ただし、CKS学習クイズでは、参考になる無料のデモと、バックアップとしてのプロのエリートが用意されています。 彼らは、CKSトレーニング資料で発生したエラーについて妥協しない検閲エリートの集まりです。 そのため、彼らの正解率は信じられないほど高く、試験の受験者の98％以上が合格しました。 あなたのように成功することに熱心な熱心な受験者に試験の知識を伝えることで、彼らはそれを助けを提供する責任として扱います。 そのため、情報の特性に従って次のCKS学習ガイドを入手できる場合は、目覚ましい進歩を遂げてください。
CKS日本語版試験解答: https://www.it-passports.com/CKS.html
2026年It-Passportsの最新CKS PDFダンプおよびCKS試験エンジンの無料共有：https://drive.google.com/open?id=1TYM8ynPatHz8aMrz9njV-1UwdWyGShWd