ちなみに、Pass4Test CKSの一部をクラウドストレージからダウンロードできます：https://drive.google.com/open?id=1Jiuf2VF1OtasrDJi7F_3v6xga7kNfOBd
Linux FoundationのCKS認定試験を受験すれば、Pass4TestのCKS問題集はあなたが試験の準備をするときに最も選択すべきツールです。この問題集はあなたが楽に試験に合格することを保証します。しかも、これは高く評判されている資料ですから、この問題集を持っていると、もうこれ以上CKS試験を心配する必要がなくなります。この問題集はあなたが試験に準備するときに会う可能性があるすべての難問を解決してあげますから。Pass4TestのCKS問題集を購入する前に、問題集の無料なサンプルをダウンロードして試用してもいいです。そうすると、問題集があなたに向いているかどうかを自分で判断することができます。
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
>> Linux Foundation CKS勉強方法 <<
Linux Foundation CKS試験材料は非常に有効的です。 あなたがCKS練習エンジンを購入した後、自分の夢を叶えます。CKS試験材料を利用すれば、あなたは間違いなくCKS試験に合格できます。CKS試験に合格した顧客が非常に多くて、合格率は98〜100％と高くなっているからです。CKS試験材料は多くのお客様に評価されています。
CKS試験は、Kubernetesクラスターで作業する個人のセキュリティスキルをテストするように設計されています。システム管理者、開発者、およびセキュリティプロフェッショナルを含む。試験は、個人がKubernetesクラスターとそれらで実行されるアプリケーションをセキュアにする能力、およびKubernetes環境をセキュアにするためのベストプラクティスを理解しているかどうかを検証することを意図しています。
質問 # 41
Create a User named john, create the CSR Request, fetch the certificate of the user after approving it.
Create a Role name john-role to list secrets, pods in namespace john
Finally, Create a RoleBinding named john-role-binding to attach the newly created role john-role to the user john in the namespace john.
To Verify: Use the kubectl auth CLI command to verify the permissions.
正解：
解説：
se kubectl to create a CSR and approve it.
Get the list of CSRs:
kubectl get csr
Approve the CSR:
kubectl certificate approve myuser
Get the certificate
Retrieve the certificate from the CSR:
kubectl get csr/myuser -o yaml
here are the role and role-binding to give john permission to create NEW_CRD resource:
kubectl apply -f roleBindingJohn.yaml --as=john
rolebinding.rbac.authorization.k8s.io/john_external-rosource-rb created kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata:
name: john_crd
namespace: development-john
subjects:
- kind: User
name: john
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: crd-creation
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: crd-creation
rules:
- apiGroups: ["kubernetes-client.io/v1"]
resources: ["NEW_CRD"]
verbs: ["create, list, get"]
質問 # 42
SIMULATION
A container image scanner is set up on the cluster.
Given an incomplete configuration in the directory
/etc/Kubernetes/confcontrol and a functional container image scanner with HTTPS endpoint https://acme.local.8081/image_policy
1. Enable the admission plugin.
2. Validate the control configuration and change it to implicit deny.
Finally, test the configuration by deploying the pod having the image tag as the latest.
正解：A
質問 # 43
You can switch the cluster/configuration context using the following command:
[desk@cli] $ kubectl config use-context dev
A default-deny NetworkPolicy avoid to accidentally expose a Pod in a namespace that doesn't have any other NetworkPolicy defined.
Task: Create a new default-deny NetworkPolicy named deny-network in the namespace test for all traffic of type Ingress + Egress The new NetworkPolicy must deny all Ingress + Egress traffic in the namespace test.
Apply the newly created default-deny NetworkPolicy to all Pods running in namespace test.
You can find a skeleton manifests file at /home/cert_masters/network-policy.yaml
正解：
解説：
master1 $ k get pods -n test --show-labels
NAME READY STATUS RESTARTS AGE LABELS
test-pod 1/1 Running 0 34s role=test,run=test-pod
testing 1/1 Running 0 17d run=testing
$ vim netpol.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-network
namespace: test
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
master1 $ k apply -f netpol.yaml
Explanation
controlplane $ k get pods -n test --show-labels
NAME READY STATUS RESTARTS AGE LABELS
test-pod 1/1 Running 0 34s role=test,run=test-pod
testing 1/1 Running 0 17d run=testing
master1 $ vim netpol1.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-network
namespace: test
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
master1 $ k apply -f netpol1.yaml Reference: https://kubernetes.io/docs/concepts/services-networking/network-policies/ Reference:
master1 $ k apply -f netpol1.yaml Reference: https://kubernetes.io/docs/concepts/services-networking/network-policies/ Explanation controlplane $ k get pods -n test --show-labels NAME READY STATUS RESTARTS AGE LABELS test-pod 1/1 Running 0 34s role=test,run=test-pod testing 1/1 Running 0 17d run=testing master1 $ vim netpol1.yaml apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata:
name: deny-network
namespace: test
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
master1 $ k apply -f netpol1.yaml Reference: https://kubernetes.io/docs/concepts/services-networking/network-policies/ master1 $ k apply -f netpol1.yaml Reference: https://kubernetes.io/docs/concepts/services-networking/network-policies/
質問 # 44
Your organization uses Kubernetes to run a microservice application. One of the microservices is a payment gateway that processes sensitive payment information. How would you implement security measures to protect this payment gateway microservice and minimize the risk of data breaches, considering the security requirements are very stringent?
正解：
解説：
Solution (Step by Step) :
1. Isolate the Payment Gateway:
- Dedicated Namespace: Create a dedicated namespace for the payment gateway service, separated from other services.
- Network Policies: Implement strict network policies to limit communication with the payment gateway. Only allow access from authorized services and specific IP addresses-
2. Pod Security Policies (PSPs):
- Restricted Capabilities: Apply PSPs to restrict the payment gateway pods' capabilities. Disable capabilities like "NET ADMIN" (network administration) and "SYS_ADMIN" (system administration).
- Security Context: Configure the 'securitycontext' to run the payment gateway pods as a non-root user, with restricted permissions.
- Image Integrity: Use image signing and verification to ensure that the payment gateway images are trusted and haven't been tampered with.
3. Encryption:
- Data at Rest: Use strong encryption to protect the payment gateway's data at rest, including databases, files, and storage volumes.
- Data in Transit: Utilize TLS/SSL to secure communication between the payment gateway and other services, including external payment processors.
4. Strong Authentication and Authorization.
- Service Accounts: use a dedicated service account for the payment gateway, restricted to accessing only the necessary resources.
- R8AC: Implement RBAC to control access to the payment gateway service, ensuring that only authorized users and services can interact with it.
- Multi-Factor Authentication Consider using two-factor authentication for any human interaction with the payment gateway service.
5. Monitoring and Auditing:
- Log Aggregation: Implement log aggregation for the payment gateway, capturing all activities and potential security events.
- Security Monitoring: Use security monitoring tools to detect any suspicious activity related to the payment gateway, including access attempts, failed logins, and data access patterns.
- Regular Security Audits: Conduct regular security audits to identity and address potential vulnerabilities and ensure the security controls are effective.
6. Vulnerability Management:
- Regular Scanning: use vulnerability scanners to identify and patch any known vulnerabilities in the payment gateway software and dependencies.
- Security Patching: Implement a robust security patching process to apply updates and fixes promptly
7. Penetration Testing:
- Regular Penetration Testing: Perform regular penetration testing to evaluate the payment gateway's security posture from a hacker's perspective. This will help identify potential security weaknesses and ensure that your security controls are effective.
質問 # 45
You are running a Kubernetes cluster with a deployment named "my-app" that uses a container image from a public registry. The container image has a vulnerability in a library it uses. You want to apply a security patch to the container image without rebuilding it. Explain how you would implement this using a container patching tool like 'image-patcners and update the deployment.
正解：
解説：
Solution (Step by Step) :
1. Install 'image-patchers:
- Install the 'image-patcher' tool on your system or within your Kubernetes cluster. 'image-patcher' is a tool for patching container images without rebuilding thenm It allows you to modify the container image's filesystem and update libraries directly.
2. Identify the Vulnerable Library:
- Use a vulnerability scanner like Trivy to identify the specific vulnerable library within the container image.
3. Patch the Vulnerable Library:
- Use 'image-patcher' to apply the security patch to the vulnerable library within the container image.
- You can use the 'image-patcher apply' command with the patch file and tne container image name to apply the patch.
4. Create a Patched Image:
- 'image-patcher' Will generate a new, patched container image. This patched image will contain the updated library with the security fix applied.
5. Push the Patched Image to a Registry:
- Push the patched image to your private container registry for use in deployments.
6. Update the Deployment
- Update the "my-app" deployment configuration to use the newly created patched image from your private registry.
7. Validate the Patch:
- After updating the deployment, verify that the patch has been successfully applied by running a vulnerability scan on the running container.
質問 # 46
......
CKS日本語参考: https://www.pass4test.jp/CKS.html
BONUS！！！ Pass4Test CKSダンプの一部を無料でダウンロード：https://drive.google.com/open?id=1Jiuf2VF1OtasrDJi7F_3v6xga7kNfOBd