BONUS!!! Itcertkr CKS 시험 문제집 전체 버전을 무료로 다운로드하세요: https://drive.google.com/open?id=1O-KdSfKQkVY1tPi9v7ED5L2JobpBJGSJ
여러분이 다른 사이트에서도Linux Foundation인증CKS시험 관련덤프자료를 보셨을 것입니다 하지만 우리Itcertkr의 자료만의 최고의 전문가들이 만들어낸 제일 전면적이고 또 최신 업데이트일 것입니다.우리덤프의 문제와 답으로 여러분은 꼭 한번에Linux Foundation인증CKS시험을 패스하실 수 있습니다.
| Section | Weight | Objectives |
|---|---|---|
| System Hardening | 15% | - Enable audit logging - Modify host components to improve security - Kernel defaults and parameters using sysctl - Understand the concept of OPA (Open Policy Agent) and Gatekeeper |
| Minimize Microservice Vulnerabilities | 20% | - Configure network policies for namespace isolation - Use AppArmor or seccomp profiles to constrain container behavior - Use OPA Gatekeeper to enforce security controls - Set appropriate security contexts for pods and containers - Understand the principle of immutable containers - Use PSP to enforce security controls |
| Cluster Setup | 10% | - Understand the security implications of embedding cloud provider flags - Implement Pod-to-Pod encryption using mTLS or WireGuard - Use role-based access control (RBAC) to minimize exposure - Use Cis benchmarks to check Kubernetes cluster settings - Use Pod Security Policies to control security-related pod behaviors - Manage sensitive information in clusters - Configure TLS certificates and minimum version for etcd |
| Cluster Hardening | 15% | - Minimize admission of containers with allowPrivilegeEscalation - Minimize admission of containers with hostPath volumes - Minimize admission of containers with sharing the host process namespace - Minimize admission of containers that allow host namespaces - Minimize admission of containers without a security context - Minimize admission of containers with sharing the host network namespace - Minimize admission of containers with added capabilities - Minimize admission of containers without AppArmor profile - Minimize admission of containers with sharing the host IPC namespace - Minimize admission of containers with capabilities assigned - Minimize admission of privileged containers - Minimize admission of containers without seccomp profiles - Minimize admission of containers with raw block devices - Minimize admission of containers with FlexVolume volumes |
| Monitoring, Logging, and Runtime Security | 20% | - Detect threats at the container level - Minimize the attack surface using container health indicators - Understand and monitor network traffic - Audit and detect logs and events for anomalies - Falco - container security monitoring and threat detection - Perform behavioral analytics to detect malicious activity |
| Supply Chain Security | 20% | - Understand image security scanning and its workflow - Use static analysis tools to detect vulnerabilities - Understand the container build process - Minimize base image footprint - Use image admission controllers to prevent use of untrusted images - Use distroless images for static workload - Sign container images and verify signatures - Understand the software supply chain best practices |
Linux Foundation CKS 시험탈락시Linux Foundation CKS덤프비용전액을 환불해드릴만큼 저희 덤프자료에 자신이 있습니다. Itcertkr에서는Linux Foundation CKS덤프를 항상 최신버전이도록 보장해드리고 싶지만Linux Foundation CKS시험문제변경시점을 예측할수 없어 시험에서 불합격받을수도 간혹 있습니다. 하지만 시험에서 떨어지면 덤프비용을 전액 환불해드려 고객님의 이익을 보장해드립니다.
질문 # 40
Service is running on port 389 inside the system, find the process-id of the process, and stores the names of all the open-files inside the /candidate/KH77539/files.txt, and also delete the binary.
정답：
설명：
root# netstat -ltnup
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:17600 0.0.0.0:* LISTEN 1293/dropbox tcp 0 0 127.0.0.1:17603 0.0.0.0:* LISTEN 1293/dropbox tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 575/sshd tcp 0 0 127.0.0.1:9393 0.0.0.0:* LISTEN 900/perl tcp 0 0 :::80 :::* LISTEN 9583/docker-proxy tcp 0 0 :::443 :::* LISTEN 9571/docker-proxy udp 0 0 0.0.0.0:68 0.0.0.0:* 8822/dhcpcd
...
root# netstat -ltnup | grep ':22'
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 575/sshd
The ss command is the replacement of the netstat command.
Now let's see how to use the ss command to see which process is listening on port 22:
root# ss -ltnup 'sport = :22'
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:("sshd",pid=575,fd=3))
질문 # 41
Context
This cluster uses containerd as CRI runtime.
Containerd's default runtime handler is runc. Containerd has been prepared to support an additional runtime handler, runsc (gVisor).
Task
Create a RuntimeClass named sandboxed using the prepared runtime handler named runsc.
Update all Pods in the namespace server to run on gVisor.
정답：
설명：
질문 # 42
SIMULATION
Create a RuntimeClass named gvisor-rc using the prepared runtime handler named runsc.
Create a Pods of image Nginx in the Namespace server to run on the gVisor runtime class
정답：
설명：
Install the Runtime Class for gVisor
{ # Step 1: Install a RuntimeClass
cat <<EOF | kubectl apply -f -
apiVersion: node.k8s.io/v1beta1
kind: RuntimeClass
metadata:
name: gvisor
handler: runsc
EOF
}
Create a Pod with the gVisor Runtime Class
{ # Step 2: Create a pod
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
name: nginx-gvisor
spec:
runtimeClassName: gvisor
containers:
- name: nginx
image: nginx
EOF
}
Verify that the Pod is running
{ # Step 3: Get the pod
kubectl get pod nginx-gvisor -o wide
}
질문 # 43
SIMULATION
Context
A PodSecurityPolicy shall prevent the creation of privileged Pods in a specific namespace.
Task
Create a new PodSecurityPolicy named prevent-psp-policy,which prevents the creation of privileged Pods.
Create a new ClusterRole named restrict-access-role, which uses the newly created PodSecurityPolicy prevent-psp-policy.
Create a new ServiceAccount named psp-restrict-sa in the existing namespace staging.
Finally, create a new ClusterRoleBinding named restrict-access-bind, which binds the newly created ClusterRole restrict-access-role to the newly created ServiceAccount psp-restrict-sa.
정답：
설명：
See the Explanation below
Explanation:
질문 # 44
SIMULATION
A container image scanner is set up on the cluster.
Given an incomplete configuration in the directory
/etc/Kubernetes/confcontrol and a functional container image scanner with HTTPS endpoint https://acme.local.8081/image_policy
1. Enable the admission plugin.
2. Validate the control configuration and change it to implicit deny.
Finally, test the configuration by deploying the pod having the image tag as the latest.
정답：A
질문 # 45
......
Itcertkr는CKS시험문제가 변경되면CKS덤프업데이트를 시도합니다. 업데이트가능하면 바로 업데이트하여 업데이트된 최신버전을 무료로 제공해드리는데 시간은 1년동안입니다. CKS시험을 패스하여 자격증을 취득하고 싶은 분들은Itcertkr제품을 추천해드립니다.온라인서비스를 찾아주시면 할인해드릴게요.
CKS최신 인증시험 기출문제: https://www.itcertkr.com/CKS_exam.html
참고: Itcertkr에서 Google Drive로 공유하는 무료, 최신 CKS 시험 문제집이 있습니다: https://drive.google.com/open?id=1O-KdSfKQkVY1tPi9v7ED5L2JobpBJGSJ