無料でクラウドストレージから最新のCertJuken CKS PDFダンプをダウンロードする：https://drive.google.com/open?id=1lwy5IO9o7oyPH5oIDJ5QtJHFnuEAkovW
CKS学習ツールの魂としての「信頼できる信用」、経営理念としての「最大限のサービス意識」により、高品質のサービスをお客様に提供するよう努めています。あなたの小さなヘルパーになり、CKS認定テストに関するご質問にお答えするサービススタッフは、すべてのユーザーとの包括的で調整された持続可能な協力関係を目指します。 CKSテストトレントに関するパズルは、タイムリーで効果的な応答を受け取ります。公式ウェブサイトにメッセージを残すか、都合の良いときにメールを送信してください。
CKS認定試験は、候補者がシミュレートされた環境でKubernetesプラットフォームとコンテナ化されたアプリケーションを保護する能力を実証する必要があるパフォーマンスベースの試験です。この試験は、Kubernetesクラスターを保護し、ネットワークセキュリティポリシーを構成し、コンテナ化されたアプリケーションにセキュリティベストプラクティスを適用する候補者の能力をテストする一連の実用的なタスクで構成されています。
CKS認定は、Kubernetesおよびコンテナ化されたアプリケーションと協力するIT専門家にとって貴重な資格です。それは、彼らの仕事における最高水準のセキュリティを維持するという候補者のコミットメントを実証し、雇用市場で競争力を提供します。認定試験は厳格で挑戦的であり、候補者はKubernetesのセキュリティベストプラクティスを強く理解する必要があります。ただし、成功した候補者はクベルネテス環境を確保し、サイバーの脅威から組織を保護するためのスキルと知識を持っているため、それはやりがいのある経験でもあります。
どうしてCertJukenのLinux FoundationのCKS試験トレーニング資料はほかのトレーニング資料よりはるかに人気があるのでしょうか。それはいくつかの理由があります。第一、CertJukenは受験生の要求をよく知っています。しかも、他のどのサイトよりも良いサービスを提供します。第二、専心すること。我々が決まったことを完璧に作るためにすべての不要な機会を諦めなければなりません。第三、我々は確かに最高の製品を持っていますが、粗悪品の方式で表示されたら、もちろん粗悪品と見られますから、我々は自分の製品を創造的かつプロの方法で見せます。CertJukenのLinux FoundationのCKS試験トレーニング資料はこんなに成功するトレーニングですから、CertJukenを選ばない理由はないです。
CKS認定試験は、雇用主によって高く評価されている業界で認識されている認定です。候補者は、コンテナ化されたアプリケーションとKubernetesプラットフォームを保護するために必要なスキルと知識を持っていることを示しており、それらをあらゆる組織にとって貴重な資産にしています。この認定は、専門家が自分の専門知識を紹介し、現場の他の人と差別化する優れた方法でもあります。
質問 # 55
SIMULATION
Documentation Ingress, Service, NGINX Ingress Controller
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh cks000032
Context
You must expose a web application using HTTPS routes.
Task
Create an Ingress resource named web in the prod namespace and configure it as follows:
. Route traffic for host web.k8s.local and all paths to the existing Service web
. Enable TLS termination using the existing Secret web-cert.
. Redirect HTTP requests to HTTPS .
You can test your Ingress configuration with the following command:
[candidate@cks000032]$ curl -L http://web.k8s.local
正解：
解説：
See the Explanation below for complete solution
Explanation:
1) Connect to the correct host
ssh cks000032
sudo -i
2) Use admin kubeconfig
export KUBECONFIG=/etc/kubernetes/admin.conf
3) Verify prerequisites (quick check)
These should already exist per task.
kubectl -n prod get svc web
kubectl -n prod get secret web-cert
kubectl get pods -n ingress-nginx
(If the ingress controller pods exist, you're good.)
4) Create the Ingress resource
Create Ingress named web in namespace prod with:
host: web.k8s.local
all paths → Service web
TLS using Secret web-cert
HTTP → HTTPS redirect (NGINX)
cat <<EOF | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: web
namespace: prod
annotations:
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
ingressClassName: nginx
tls:
- hosts:
- web.k8s.local
secretName: web-cert
rules:
- host: web.k8s.local
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: web
port:
number: 80
EOF
5) Verify Ingress creation
kubectl -n prod get ingress web
kubectl -n prod describe ingress web
Confirm:
Host = web.k8s.local
TLS Secret = web-cert
Backend Service = web
6) Test HTTP → HTTPS redirect
curl -L http://web.k8s.local
Expected:
Redirects to https://web.k8s.local
Returns application response over HTTPS
質問 # 56
SIMULATION
Context
For testing purposes, the kubeadm provisioned cluster 's API server
was configured to allow unauthenticated and unauthorized access.
Task
First, secure the cluster 's API server configuring it as follows:
. Forbid anonymous authentication
. Use authorization mode Node,RBAC
. Use admission controller NodeRestriction
The cluster uses the Docker Engine as its container runtime . If needed, use the docker command to troubleshoot running containers.
kubectl is configured to use unauthenticated and unauthorized access. You do not have to change it, but be aware that kubectl will stop working once you have secured the cluster .
You can use the cluster 's original kubectl configuration file located at etc/kubernetes/admin.conf to access the secured cluster.
Next, to clean up, remove the ClusterRoleBinding
system:anonymous.
正解：
解説：
See the Explanation below for complete solution
Explanation:
1) SSH to control-plane node
ssh cks000002
sudo -i
2) Edit API Server static pod manifest
API server in kubeadm runs as a static pod.
vi /etc/kubernetes/manifests/kube-apiserver.yaml
3) Apply required API Server security settings
3.1 Forbid anonymous authentication
Find command: section and ensure this line exists:
- --anonymous-auth=false
3.2 Use authorization mode Node,RBAC
Ensure exactly this line exists (and no AlwaysAllow):
- --authorization-mode=Node,RBAC
❌ Remove if present:
- --authorization-mode=AlwaysAllow
3.3 Enable admission controller NodeRestriction
Find --enable-admission-plugins and ensure NodeRestriction is included.
Correct example:
- --enable-admission-plugins=NodeRestriction
If other plugins already exist, append NodeRestriction, e.g.:
- --enable-admission-plugins=NamespaceLifecycle,ServiceAccount,NodeRestriction
4) Save file and let kubelet restart API server
Just save and exit (:wq)
Kubelet will automatically restart the API server pod.
5) Switch kubectl to secured config
Current kubectl will stop working after API server hardening.
export KUBECONFIG=/etc/kubernetes/admin.conf
Verify access:
kubectl get nodes
6) Remove insecure ClusterRoleBinding
Delete system:anonymous binding:
kubectl delete clusterrolebinding system:anonymous
Verify removal:
kubectl get clusterrolebinding | grep anonymous
(no output = correct)
7) Quick validation (optional but fast)
API server flags check:
grep -n "anonymous-auth" /etc/kubernetes/manifests/kube-apiserver.yaml
grep -n "authorization-mode" /etc/kubernetes/manifests/kube-apiserver.yaml grep -n "NodeRestriction" /etc/kubernetes/manifests/kube-apiserver.yaml
質問 # 57
SIMULATION
You can switch the cluster/configuration context using the following command:
[desk@cli] $ kubectl config use-context dev
A default-deny NetworkPolicy avoid to accidentally expose a Pod in a namespace that doesn't have any other NetworkPolicy defined.
Task: Create a new default-deny NetworkPolicy named deny-network in the namespace test for all traffic of type Ingress + Egress The new NetworkPolicy must deny all Ingress + Egress traffic in the namespace test.
Apply the newly created default-deny NetworkPolicy to all Pods running in namespace test.
You can find a skeleton manifests file at /home/cert_masters/network-policy.yaml
正解：
解説：
See the Explanation below
Explanation:
master1 $ k get pods -n test --show-labels
NAME READY STATUS RESTARTS AGE LABELS
test-pod 1/1 Running 0 34s role=test,run=test-pod
testing 1/1 Running 0 17d run=testing
$ vim netpol.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-network
namespace: test
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
master1 $ k apply -f netpol.yaml
Explanation:
controlplane $ k get pods -n test --show-labels
NAME READY STATUS RESTARTS AGE LABELS
test-pod 1/1 Running 0 34s role=test,run=test-pod
testing 1/1 Running 0 17d run=testing
master1 $ vim netpol1.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-network
namespace: test
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
master1 $ k apply -f netpol1.yaml
Reference:
https://kubernetes.io/docs/concepts/services-networking/network-policies/ Explanation:
controlplane $ k get pods -n test --show-labels
NAME READY STATUS RESTARTS AGE LABELS
test-pod 1/1 Running 0 34s role=test,run=test-pod
testing 1/1 Running 0 17d run=testing
master1 $ vim netpol1.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-network
namespace: test
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
master1 $ k apply -f netpol1.yaml
https://kubernetes.io/docs/concepts/services-networking/network-policies/
質問 # 58
SIMULATION
a. Retrieve the content of the existing secret named default-token-xxxxx in the testing namespace.
Store the value of the token in the token.txt
b. Create a new secret named test-db-secret in the DB namespace with the following content:
username: mysql
password: password@123
Create the Pod name test-db-pod of image nginx in the namespace db that can access test-db-secret via a volume at path /etc/mysql-credentials
正解：
解説：
To add a Kubernetes cluster to your project, group, or instance:
Navigate to your:
Project's Operations > Kubernetes page, for a project-level cluster.
Group's Kubernetes page, for a group-level cluster.
Admin Area > Kubernetes page, for an instance-level cluster.
Click Add Kubernetes cluster.
Click the Add existing cluster tab and fill in the details:
Kubernetes cluster name (required) - The name you wish to give the cluster.
Environment scope (required) - The associated environment to this cluster.
API URL (required) - It's the URL that GitLab uses to access the Kubernetes API. Kubernetes exposes several APIs, we want the "base" URL that is common to all of them. For example, https://kubernetes.example.com rather than https://kubernetes.example.com/api/v1.
Get the API URL by running this command:
kubectl cluster-info | grep -E 'Kubernetes master|Kubernetes control plane' | awk '/http/ {print $NF}' CA certificate (required) - A valid Kubernetes certificate is needed to authenticate to the cluster. We use the certificate created by default.
List the secrets with kubectl get secrets, and one should be named similar to default-token-xxxxx. Copy that token name for use below.
Get the certificate by running this command:
kubectl get secret <secret name> -o jsonpath="{['data']['ca\.crt']}"
質問 # 59
Your Kubernetes cluster has a NodePort service exposing a web application on port 30080. You want to restrict access to the service from specific IP addresses, while allowing all traffic from within the cluster You need to implement this access control using a NetworkPolicy.
正解：
解説：
Solution (Step by Step) :
1. Create a NetworkP01icy:
- Define a NetworkPoIicy resource with a 'podSelector' that matches all pods in the cluster (e.g., 'matchLabeIs: {}' )
- Create an 'ingress' rule that allows traffic from the allowed IP addresses.
- Add a 'from' field to specify the allowed IP addresses.
- Ensure that the 'pot field is set to the NodePort service port (30080) and the 'protocor is 'TCP'
2. Apply the NetworkPolicy: - Apply the YAML file using 'kubectl apply -f nodeport-access-policy.yaml 3. Verify the NetworkPoIicy: - Use 'kubectl get networkpolicies' to list the available network policies. - Use 'kubectl describe networkpolicy nodeport-access-policy' to view the details of the applied policy. 4. Test the NetworkPolicy: - Attempt to access the NodePort service from an allowed IP address and verifry' that the connection is successful. - Attempt to access the NodePort service from a blocked IP address and verify that the connection is denied.
質問 # 60
......
CKS日本語問題集: https://www.certjuken.com/CKS-exam.html
さらに、CertJuken CKSダンプの一部が現在無料で提供されています：https://drive.google.com/open?id=1lwy5IO9o7oyPH5oIDJ5QtJHFnuEAkovW