BONUS！！！ It-Passports CKSダンプの一部を無料でダウンロード：https://drive.google.com/open?id=1h2KIVjEPZ5TEGML7hC20L6Pxd7pRlvnq
CKS prepトレントは、PDF、ソフト、およびAPPバージョンの3つのバージョンをお客様に提供します。それぞれに独自の利点があります。次に、CKSテスト問題集のPDFバージョンを紹介します。 PDFバージョンが非常に便利で実用的であることはよく知られています。 CKSテストブレイン問題集のPDFバージョンは、お客様にデモを提供します。同時に、PDFバージョンを使用している場合は、PDFバージョンごとにCKS試験トレントを印刷できます。メモを取るのはとても簡単です。私たちのCKSテストブレイン問題集はあなたに大きな利便性をもたらすと信じています。
CKS認定試験は、Kubernetesセキュリティの概念とベストプラクティスに関する候補者の知識をテストするように設計されています。この試験では、クラスターのセットアップ、安全な通信、認証と承認、コンテナセキュリティ、ネットワークポリシーなど、幅広いトピックをカバーしています。この試験は、これらの概念を実際のシナリオに適用する候補者の能力をテストするように設計されています。
Linux Foundation CKS（Certified Kubernetes Security Specialist）認定試験は、Kubernetesセキュリティにおける専門知識を証明するための絶好の機会です。この試験は、Kubernetes環境におけるセキュリティ脅威を特定し、軽減する能力を試す厳しい試験です。この認定は、雇用主から高く評価され、Kubernetesセキュリティの分野でキャリアを進めるための優れた方法です。
>> Linux Foundation CKS日本語版トレーリング <<
It-PassportsはLinux FoundationのCKS認定試験にたいして短期で有効なウェブサイトでCKS認定試験に合格するのを保証したり、Linux Foundation認証試験に合格しなければ全額で返金いたします。あなたはIt-Passportsが提供したCKSの認証試験の問題集を購入するの前にインターネットで無料な試用版をダウンロードしてください。
Linux Foundation CKS（Certified Kubernetes Security Specialist）認定試験は、コンテナ化されたアプリケーションとKubernetesプラットフォームを保護するために必要なスキルと知識を検証する業界に認識された認定です。より多くの組織がコンテナオーケストレーションのためにKubernetesを採用するにつれて、認定されたKubernetesのセキュリティスペシャリストの需要が増加しました。 CKS認定は、ITの専門家がKubernetes環境を確保するための専門知識を実証するのに役立ち、雇用市場で競争力を提供します。
質問 # 56
SIMULATION
You must complete this task on the following cluster/nodes:
Cluster: trace
Master node: master
Worker node: worker1
You can switch the cluster/configuration context using the following command:
[desk@cli] $ kubectl config use-context trace
Given: You may use Sysdig or Falco documentation.
Task:
Use detection tools to detect anomalies like processes spawning and executing something weird frequently in the single container belonging to Pod tomcat.
Two tools are available to use:
1. falco
2. sysdig
Tools are pre-installed on the worker1 node only.
Analyse the container's behaviour for at least 40 seconds, using filters that detect newly spawning and executing processes.
Store an incident file at /home/cert_masters/report, in the following format:
[timestamp],[uid],[processName]
Note: Make sure to store incident file on the cluster's worker node, don't move it to master node.
正解：
解説：
See the Explanation below
Explanation:
$vim /etc/falco/falco_rules.local.yaml
- rule: Container Drift Detected (open+create)
desc: New executable created in a container due to open+create
condition: >
evt.type in (open,openat,creat) and
evt.is_open_exec=true and
container and
not runc_writing_exec_fifo and
not runc_writing_var_lib_docker and
not user_known_container_drift_activities and
evt.rawres>=0
output: >
%evt.time,%user.uid,%proc.name # Add this/Refer falco documentation
priority: ERROR
$kill -1 <PID of falco>
Explanation:
[desk@cli] $ ssh node01
[node01@cli] $ vim /etc/falco/falco_rules.yaml
search for Container Drift Detected & paste in falco_rules.local.yaml
[node01@cli] $ vim /etc/falco/falco_rules.local.yaml
- rule: Container Drift Detected (open+create)
desc: New executable created in a container due to open+create
condition: >
evt.type in (open,openat,creat) and
evt.is_open_exec=true and
container and
not runc_writing_exec_fifo and
not runc_writing_var_lib_docker and
not user_known_container_drift_activities and
evt.rawres>=0
output: >
%evt.time,%user.uid,%proc.name # Add this/Refer falco documentation
priority: ERROR
[node01@cli] $ vim /etc/falco/falco.yaml
質問 # 57
You have an application running in a Kubernetes cluster that requires access to a database hosted in a different namespace. You want to implement a secure mecnanism to allow the application to access the database witnout granting it access to all resources in the database namespace.
正解：
解説：
Solution (Step by Step) :
1. Create a Service Account in the Application Namespace:
- In the application's namespace, create a service account named 'db-access-sa'
2. Create a Role in the Database Namespace:
- In the database namespace, create a custom role named 'db-access-role' that grants only the required permissions to the database.
- For example, you might grant access to specific database tables, views, or stored procedures.
- Create a custom role named 'db-access-role' in the namespace where your database is running to grant only read permissions to the database.
3. Create a ROIeBinding in the Database Namespace: - In the database namespace, create a role binding named 'db-access-binding' that associates the 'db-access-sa' service account (from the application's namespace) with the 'db-access-role'.
4. Configure Your Application: - Configure your application deployment to use the 'db-access-sa' service account. - Use the Kubernetes API to connect to the database using the provided credentials or secrets.
質問 # 58
You are managing a Kubernetes cluster where you have a critical microservice called "order-processing" running in a Deployment. The service interacts with a sensitive database containing customer order information. You are concerned about the potential risk of attackers gaining access to the database credentials. How would you implement a strategy using AppArmor profiles to mitigate this risk?
正解：
解説：
Solution (Step by Step) :
1. Create an AppArmor Profile: Create a profile that specifically restricts the "order-processing" containers access to the database credentials. You
can do this by using tne 'apparmor' command-line utility.
basn
# Create an AppArmor profile for the order-processing container
sudo aa-genprof Ipath/to/order-processing/container
- The 'aa-genpror command will generate a basic profile based on the containers file system.
- You can then edit the profile to restrict access to specific files or directories.
2. Restrict Access to Credentials: Edit the generated profile and add rules to deny access to the database credentials file. For example, if the
database credentials are stored in a file named 'db_credentials-txt' at '/etc/secretsr , you would add the following line to the profile:
letc/secrets/db credentials-txt r,
- This line restricts the container from reading (r) the 'db_credentials.txt' file.
- You can also use more specific path restrictions if needed.
3. Apply tne AppArmor Profile:
- Load the profile:
bash
sudo apparmor_parser -r
- Stan or restart the container:
bash
kubectl rollout restart deployment/order-processing
- This will ensure the new AppArmor profile is loaded and applied to the "order-processing" container.
4. Test and Verify'
- Test the application: Make sure the "order-processing" service can still access the database and perform its operations.
- Check for errors: Monitor the logs ot the "order-processing" container for any errors related to AppArmor. If the container can't access the credentials file, you will see errors in the logs.
5. Monitor and Update:
- Monitor the containers AppArmor logs to identify any potential vulnerabilities or inconsistencies.
- Update the profile as needed to adjust permissions and maintain security.
質問 # 59
You are tasked With securing a Kubernetes cluster that is hosting sensitive applications. You need to implement a robust security posture, including network segmentation, secure communication, and authentication. Explain how you would leverage Pod Security Policies (PSPs) to enforce security controls for pods in the cluster. Provide a practical example of a PSP definition that enforces specific security restrictions.
正解：
解説：
Solution (Step by Step) :
1. Create a Pod Security Policy:
- Define the security policy using a YAML file.
- The file will include specific rules for the policy.
2. Apply the Pod Security Policy: - After creating the policy, you can apply it to the cluster: bash kubectl apply -f restricted-psp.yaml 3. Use the Pod Security Policy: - You can enforce the policy on a pod using the 'securityContext' field in the pod's YAML file. - For example:
4. Enforce the Policy: - The PSP will enforce the specified restrictions on pods that are created using the deployment configuration.
質問 # 60
You are tasked with securing a Kubernetes cluster where sensitive data is stored in ConfigMaps- The ConfigMaps are accessed by various applications running in pods, some of which are located in the 'default' namespace. You need to prevent unauthorized access to these ConfigMaps
How would you leverage Role-Based Access Control (R8AC) to restrict access to ConfigMaps, ensuring only authorized pods in the 'default namespace can access specific ConfigMaps?
正解：
解説：
Solution (Step by Step) :
1. Define a Role: Create a Role named 'configmap-readerw in the 'default namespace that allows access to only specific ConfigMaps:
2. Bind the Role to a ServiceAccount: Create a ServiceAccount named 'configmap-app-sa' in the 'default' namespace and bind tne 'configmap- reader Role to it:
3. Configure Pods to use the ServiceAccount: update tne POdS running in the 'defaults namespace that need access to tnese ConfigMaps to use the 'configmap-app-sa' ServiceAccount:
The 'configmap-reader' Role grants access to the specific ConfigMaps ('sensitive-data' , Sapp-config') to pods that have the associated ServiceAccount. The 'configmap-app-sa-binding' binds this Role to the 'configmap-app-sa' ServiceAccount. PodS using this ServiceAccount Will only nave access to tne allowed ContigMaps and are restricted from accessing other ConfigMaps. Note: This approach ensures that only authorized pods in the 'default namespace can access specific ConfigMaps. You should adjust the 'resourceNameS in the Role definition to include the specific ConfigMaps that you want to restrict access to. Make sure the ServiceAccount used by the pods is granted the appropriate permissions to access the ConfigMaps. This example demonstrates how to use RBAC to restrict access to ConfigMaps, ensuring only authorized pods can access sensitive data. You should adjust the permissions and service accounts as needed to meet your specific security requirements.
質問 # 61
......
CKS日本語版参考書: https://www.it-passports.com/CKS.html
さらに、It-Passports CKSダンプの一部が現在無料で提供されています：https://drive.google.com/open?id=1h2KIVjEPZ5TEGML7hC20L6Pxd7pRlvnq