Übrigens, Sie können die vollständige Version der ZertPruefung CKS Prüfungsfragen aus dem Cloud-Speicher herunterladen: https://drive.google.com/open?id=1IuqjxikgkjZjHKhiOAjmPRlfrjSmdhjx
Im ZertPruefung können Sie Dumps zur Linux Foundation CKS Zertifizierungsprüfung herunterladen, so dass Sie unsere Produkte ohne Risiko kaufen können. Das ist die Version der Übungen. Und Sie können die Qualität der Produkte und den Wert vorm Kauf sehen. Wir sind selbtsicher, dass Sie mit unseren Produkten zur Linux Foundation CKS Zertifizierungsprüfung zufrieden sein würden. Um Ihre Interessen zu schützen, versprechen wir Ihnen, dass wir Ihnen eine Rückerstattung geben für den Durchfall in der Prüfung würden. Unser Ziel liegt nicht nur darin, Ihnen zu helfen, die Linux Foundation CKS Prüfung zu bestehen, sondern auch ein reales IT-Expert zu werden. So können Sie mehr Vorteile im Beruf haben, eine entsprechende technische Position finden und ganz einfach ein hohes Gehalt unter den IT-Angestellten erhalten.
| Section | Weight | Objectives |
|---|---|---|
| Supply Chain Security | 20% | - Sign container images and verify signatures - Use static analysis tools to detect vulnerabilities - Understand the container build process - Use image admission controllers to prevent use of untrusted images - Minimize base image footprint - Understand image security scanning and its workflow - Understand the software supply chain best practices - Use distroless images for static workload |
| Minimize Microservice Vulnerabilities | 20% | - Use OPA Gatekeeper to enforce security controls - Set appropriate security contexts for pods and containers - Understand the principle of immutable containers - Use AppArmor or seccomp profiles to constrain container behavior - Configure network policies for namespace isolation - Use PSP to enforce security controls |
| Monitoring, Logging, and Runtime Security | 20% | - Minimize the attack surface using container health indicators - Audit and detect logs and events for anomalies - Perform behavioral analytics to detect malicious activity - Detect threats at the container level - Falco - container security monitoring and threat detection - Understand and monitor network traffic |
| Cluster Setup | 10% | - Understand the security implications of embedding cloud provider flags - Manage sensitive information in clusters - Use Pod Security Policies to control security-related pod behaviors - Use Cis benchmarks to check Kubernetes cluster settings - Implement Pod-to-Pod encryption using mTLS or WireGuard - Use role-based access control (RBAC) to minimize exposure - Configure TLS certificates and minimum version for etcd |
| Cluster Hardening | 15% | - Minimize admission of containers with FlexVolume volumes - Minimize admission of containers without AppArmor profile - Minimize admission of containers with capabilities assigned - Minimize admission of containers with hostPath volumes - Minimize admission of containers with raw block devices - Minimize admission of privileged containers - Minimize admission of containers that allow host namespaces - Minimize admission of containers without seccomp profiles - Minimize admission of containers with added capabilities - Minimize admission of containers with allowPrivilegeEscalation - Minimize admission of containers with sharing the host network namespace - Minimize admission of containers with sharing the host IPC namespace - Minimize admission of containers with sharing the host process namespace - Minimize admission of containers without a security context |
| System Hardening | 15% | - Understand the concept of OPA (Open Policy Agent) and Gatekeeper - Kernel defaults and parameters using sysctl - Enable audit logging - Modify host components to improve security |
Es ist unrealistisch, beim Lernen der relevanten Bücher diese Linux Foundation CKS Prüfung zu bestehen. Es ist besser für Sie, einige wertvolle Prüfungsfragen zu machen, statt alle Kenntnisse für die Prüfung ziellos auswendig zu lernen. Die hocheffektive Dumps sind das beste Vorbereitungsgerät. So Kaufen Sie bitte schnell die Linux Foundation CKS Dumps von ZertPruefung. Das ist Dumps mit höher Hit-Rate. Und es ist wirksamer als alle andere Lernmethoden. Die sind die Unterlagen, womit Sie einmaligen Erfolg machen können.
11. Frage
You are running a Kubernetes cluster with a deployment named "my-app" that uses a container image from a public registry. You suspect that a recent deployment update may have introduced a vulnerability in one of the containers. You want to apply a security patch to the container image Without rebuilding it. Explain now you would implement this using a container patching tool like 'kpatch' and update the deployment.
Antwort:
Begründung:
Solution (Step by Step) :
1. Install 'kpatch'
- Install the 'kpatch' tool on your system or within your Kubernetes cluster. 'kpatch' is a utility for patching running Linux kernels and user-space programs without rebuilding them.
2. Identify the Vulnerable Library:
- Use a vulnerability scanner like Trivy to identify the specific vulnerable library within the container image.
3. Patch the Vulnerable Library:
- Use 'kpatch' to apply the security patch to the vulnerable library within the running container.
- You can use the 'kpatch apply' command with the patch file and the containers process ID to apply the patch.
4. Update the Deployment
- While 'kpatch' allows for patching running containers, it's important to note that the patch will be lost when the container restarts. To ensure persistence, you need to update the deployment to use a patched container image:
- Obtain a patched version of the container image from a trusted source or build your own patched image.
- Update the "my-app" deployment configuration to pull the patched image from your registry.
5. Validate the Patch:
- After updating the deployment, verify that the patch has been successfully applied by running a vulnerability scan on the running container.
12. Frage
SIMULATION
Context:
Cluster: prod
Master node: master1
Worker node: worker1
You can switch the cluster/configuration context using the following command:
[desk@cli] $ kubectl config use-context prod
Task:
Analyse and edit the given Dockerfile (based on the ubuntu:18:04 image)
/home/cert_masters/Dockerfile fixing two instructions present in the file being prominent security/best-practice issues.
Analyse and edit the given manifest file
/home/cert_masters/mydeployment.yaml fixing two fields present in the file being prominent security/best-practice issues.
Note: Don't add or remove configuration settings; only modify the existing configuration settings, so that two configuration settings each are no longer security/best-practice concerns.
Should you need an unprivileged user for any of the tasks, use user nobody with user id 65535
Antwort:
Begründung:
See the Explanation belowExplanation:
1. For Dockerfile: Fix the image version & user name in Dockerfile
2. For mydeployment.yaml : Fix security contexts
Explanation:
[desk@cli] $ vim /home/cert_masters/Dockerfile
FROM ubuntu:latest # Remove this
FROM ubuntu:18.04 # Add this
USER root # Remove this
USER nobody # Add this
RUN apt get install -y lsof=4.72 wget=1.17.1 nginx=4.2
ENV ENVIRONMENT=testing
USER root # Remove this
USER nobody # Add this
CMD ["nginx -d"]
[desk@cli] $ vim /home/cert_masters/mydeployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
creationTimestamp: null
labels:
app: kafka
name: kafka
spec:
replicas: 1
selector:
matchLabels:
app: kafka
strategy: {}
template:
metadata:
creationTimestamp: null
labels:
app: kafka
spec:
containers:
- image: bitnami/kafka
name: kafka
volumeMounts:
- name: kafka-vol
mountPath: /var/lib/kafka
securityContext:
{"capabilities":{"add":["NET_ADMIN"],"drop":["all"]},"privileged": True,"readOnlyRootFilesystem": False, "runAsUser": 65535} # Delete This
{"capabilities":{"add":["NET_ADMIN"],"drop":["all"]},"privileged": False,"readOnlyRootFilesystem": True, "runAsUser": 65535} # Add This resources: {} volumes:
- name: kafka-vol
emptyDir: {}
status: {}
Pictorial View:
[desk@cli] $ vim /home/cert_masters/mydeployment.yaml
13. Frage
SIMULATION
Fix all issues via configuration and restart the affected components to ensure the new setting takes effect.
Fix all of the following violations that were found against the API server:- a. Ensure the --authorization-mode argument includes RBAC b. Ensure the --authorization-mode argument includes Node c. Ensure that the --profiling argument is set to false Fix all of the following violations that were found against the Kubelet:- a. Ensure the --anonymous-auth argument is set to false.
b. Ensure that the --authorization-mode argument is set to Webhook.
Fix all of the following violations that were found against the ETCD:-
a. Ensure that the --auto-tls argument is not set to true
Hint: Take the use of Tool Kube-Bench
Antwort:
Begründung:
API server:
Ensure the --authorization-mode argument includes RBAC
Turn on Role Based Access Control. Role Based Access Control (RBAC) allows fine-grained control over the operations that different entities can perform on different objects in the cluster. It is recommended to use the RBAC authorization mode.
Fix - Buildtime
Kubernetes
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
component: kube-apiserver
tier: control-plane
name: kube-apiserver
namespace: kube-system
spec:
containers:
- command:
+ - kube-apiserver
+ - --authorization-mode=RBAC,Node
image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0
livenessProbe:
failureThreshold: 8
httpGet:
host: 127.0.0.1
path: /healthz
port: 6443
scheme: HTTPS
initialDelaySeconds: 15
timeoutSeconds: 15
name: kube-apiserver-should-pass
resources:
requests:
cpu: 250m
volumeMounts:
- mountPath: /etc/kubernetes/
name: k8s
readOnly: true
- mountPath: /etc/ssl/certs
name: certs
- mountPath: /etc/pki
name: pki
hostNetwork: true
volumes:
- hostPath:
path: /etc/kubernetes
name: k8s
- hostPath:
path: /etc/ssl/certs
name: certs
- hostPath:
path: /etc/pki
name: pki
Ensure the --authorization-mode argument includes Node
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --authorization-mode parameter to a value that includes Node.
--authorization-mode=Node,RBAC
Audit:
/bin/ps -ef | grep kube-apiserver | grep -v grep
Expected result:
'Node,RBAC' has 'Node'
Ensure that the --profiling argument is set to false
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the below parameter.
--profiling=false
Audit:
/bin/ps -ef | grep kube-apiserver | grep -v grep
Expected result:
'false' is equal to 'false'
Fix all of the following violations that were found against the Kubelet:- Ensure the --anonymous-auth argument is set to false.
Remediation: If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to false. If using executable arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
--anonymous-auth=false
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
Audit:
/bin/ps -fC kubelet
Audit Config:
/bin/cat /var/lib/kubelet/config.yaml
Expected result:
'false' is equal to 'false'
2) Ensure that the --authorization-mode argument is set to Webhook.
Audit
docker inspect kubelet | jq -e '.[0].Args[] | match("--authorization-mode=Webhook").string' Returned Value: --authorization-mode=Webhook Fix all of the following violations that were found against the ETCD:- a. Ensure that the --auto-tls argument is not set to true Do not use self-signed certificates for TLS. etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should not be available to unauthenticated clients. You should enable the client authentication via valid certificates to secure the access to the etcd service.
Fix - Buildtime
Kubernetes
apiVersion: v1
kind: Pod
metadata:
annotations:
scheduler.alpha.kubernetes.io/critical-pod: ""
creationTimestamp: null
labels:
component: etcd
tier: control-plane
name: etcd
namespace: kube-system
spec:
containers:
- command:
+ - etcd
+ - --auto-tls=true
image: k8s.gcr.io/etcd-amd64:3.2.18
imagePullPolicy: IfNotPresent
livenessProbe:
exec:
command:
- /bin/sh
- -ec
- ETCDCTL_API=3 etcdctl --endpoints=https://[192.168.22.9]:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt
--cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key get foo failureThreshold: 8 initialDelaySeconds: 15 timeoutSeconds: 15 name: etcd-should-fail resources: {} volumeMounts:
- mountPath: /var/lib/etcd
name: etcd-data
- mountPath: /etc/kubernetes/pki/etcd
name: etcd-certs
hostNetwork: true
priorityClassName: system-cluster-critical
volumes:
- hostPath:
path: /var/lib/etcd
type: DirectoryOrCreate
name: etcd-data
- hostPath:
path: /etc/kubernetes/pki/etcd
type: DirectoryOrCreate
name: etcd-certs
status: {}
14. Frage
You are tasked with hardening the security of your Kubernetes cluster by following the CIS Kubernetes Benchmark. You need to implement a solution for securing the etcd cluster using a strong encryption at rest configuration. Explain the steps involved, including the configuration changes required in the etcd cluster and any relevant configuration changes in the Kubernetes control plane.
Antwort:
Begründung:
Solution (Step by Step) :
1. Generate Encryption Keys:
- Create a strong encryption key using tools like 'openssr or 'gpg'
- For example, using OpenSSL:
bash
openssl genrsa -out etcd-encryption-key.pem 4096
2. Configure etcd:
- Edit tne etcd server configuration file, typically located at' /etc/etcd/etcd.conf' or a similar path depending on your setup.
- Set the '--data-dirs to the directory where you want to store the encrypted etcd data.
- Add the following lines to enable encryption at rest and specify the encryption key:
- Make sure to replace 'path/to:etcd-enctyption-key.pem' with the actual path to the encryption key file. 3. Configure Kubernetes Control Plane: - If using kubeadm, modify the 'kubeadm init or 'kubeadm joins commands to include the path to the encryption key file in tne =etcd.encryption-key' option. For example: bash kubeadm init -etcd.encryption-key=path/to/etcd-encryption-key.pem 4. Restart etcd and Control Plane Components: - Restart the etcd server and the Kubernetes control plane components like 'kube-apiserver and 'kube-controller-manager' to ensure the new configuration is loaded. 5. Verify Encryption: - After restarting the components, verify that the etcd data is encrypted by checking the directory configured as the '-data-dir' in your etcd configuration. You should see encrypted files. 6. Rotate Encryption Keys (Recommended): - For enhanced security, periodically rotate the encryption key. This involves generating a new key, updating the etcd configuration with the new key, and restarting the etcd and control plane components.
15. Frage
You must complete this task on the following cluster/nodes: Cluster: trace Master node: master Worker node: worker1 You can switch the cluster/configuration context using the following command: [desk@cli] $ kubectl config use-context trace Given: You may use Sysdig or Falco documentation. Task: Use detection tools to detect anomalies like processes spawning and executing something weird frequently in the single container belonging to Pod tomcat. Two tools are available to use: 1. falco 2. sysdig Tools are pre-installed on the worker1 node only. Analyse the container's behaviour for at least 40 seconds, using filters that detect newly spawning and executing processes. Store an incident file at /home/cert_masters/report, in the following format: [timestamp],[uid],[processName] Note: Make sure to store incident file on the cluster's worker node, don't move it to master node.
Antwort:
Begründung:
$vim /etc/falco/falco_rules.local.yaml
- rule: Container Drift Detected (open+create)
desc: New executable created in a container due to open+create
condition: >
evt.type in (open,openat,creat) and
evt.is_open_exec=true and
container and
not runc_writing_exec_fifo and
not runc_writing_var_lib_docker and
not user_known_container_drift_activities and
evt.rawres>=0
output: >
%evt.time,%user.uid,%proc.name # Add this/Refer falco documentation
priority: ERROR
$kill -1 <PID of falco>
Explanation
[desk@cli] $ ssh node01 [node01@cli] $ vim /etc/falco/falco_rules.yaml search for Container Drift Detected & paste in falco_rules.local.yaml [node01@cli] $ vim /etc/falco/falco_rules.local.yaml
- rule: Container Drift Detected (open+create)
desc: New executable created in a container due to open+create
condition: >
evt.type in (open,openat,creat) and
evt.is_open_exec=true and
container and
not runc_writing_exec_fifo and
not runc_writing_var_lib_docker and
not user_known_container_drift_activities and
evt.rawres>=0
output: >
%evt.time,%user.uid,%proc.name # Add this/Refer falco documentation
priority: ERROR
[node01@cli] $ vim /etc/falco/falco.yaml
16. Frage
......
Damit wir besser auf die derzeitigen Herausforderungen reagieren und Ihnen die Fragenkataloge zur Linux Foundation CKS Zertifizierungsprüfung von besserer Qualität bieten können, versuchen wir, unser Bestes zu tun, indem wir die IT-Elite Gruppe von ZertPruefung verändern und die Testaufgaben von der Linux Foundation CKS Zertifizierungsprüfung rechtzeitig aktualisieren. Unser Ziel liegt darin, dass Sie die Linux Foundation CKS Zertifizierungsprüfung in kürzester Zeit leicht bestehen können. Bevor Sie unsere Prüfungsmaterialien kaufen, können Sie ein paar kostenlose Prüfungsfragen und Antworten herunterladen und proben.
CKS Prüfungsfragen: https://www.zertpruefung.ch/CKS_exam.html
BONUS!!! Laden Sie die vollständige Version der ZertPruefung CKS Prüfungsfragen kostenlos herunter: https://drive.google.com/open?id=1IuqjxikgkjZjHKhiOAjmPRlfrjSmdhjx