從Google Drive中免費下載最新的Testpdf CKS PDF版考試題庫：https://drive.google.com/open?id=1jWs3m1NdJdh06rpXxOeYk0DX7BFP3X84
人之所以能，是相信能。Testpdf之所以能幫助每個IT人士，是因為它能證明它的能力。Testpdf Linux Foundation的CKS考試培訓資料就是能幫助你成功的培訓資料，任何限制都是從自己的內心開始的，只要你想通過t Linux Foundation的CKS考試認證，就會選擇Testpdf，其實有時候成功與不成功的距離很短，只需要後者向前走幾步，你呢，向前走了嗎，Testpdf是你成功的大門，選擇了它你不能不成功。
CKS考試旨在專為IT專業人員設計，他們對Kubernetes安全性有深刻的理解並負責設計和實施安全的Kubernetes環境。考試涵蓋廣泛的主題，包括Kubernetes安全概念、Kubernetes安全控制、Kubernetes安全最佳實踐以及安全審計和監控。
CKS 考試對於任何與 Kubernetes 一起工作並希望展示其保護這些環境的專業知識的人來說，都是一個重要的認證。通過考試，個人可以向潛在雇主證明他們具備保護 Kubernetes 集群並保護在其中運行的應用程序所需的技能和知識，使他們成為任何使用 Kubernetes 進行容器編排和部署的組織的有價值的資產。
CKS 考古題覆蓋了最新的考試指南，確保考生一次性通過 CKS 考試。Linux Foundation 認證專家根據 CKS 考試主題編訂，適合全球的考生使用，提高考生的通過率。Kubernetes Security Specialist 是一張高級網路專家認可證書，亦是全球公認的專業認證。CKS 認證主要的目的是讓網路工程師能在現今變化迅速的資訊網路環境中，都能掌握和擁有最先進的網路技術，任何時候都能保持領導地位。
CKS考試驗證候選人使用不同安全措施保護Kubernetes集群和工作負載的能力。這個認證是DevOps工程師、安全專業人員和Kubernetes管理員展示他們在保護Kubernetes環境中的能力的絕佳機會。這是一個全面性資格證書，對於目前使用Kubernetes的專業人員非常有用，因為它確認了他們需要確保Kubernetes平台安全和可靠性的知識和實踐技能。
問題 #52
You are running a Kubernetes cluster that hosts a critical database application. You need to implement a policy that prevents any unauthorized access to the database pod from other pods within the cluster.
答案：
解題說明：
Solution (Step by Step) :
1. Create a Network Policy:
- Create a NetworkPolicy in the namespace of your database pod:
2. Apply the Network Policy: - Apply the NetworkP01iCY using 'kubectl apply -f database-access-control.yaml 3. Test the Policy: - Run a pod in a different namespace or with a different label and attempt to connect to the database pod. - The NetworkPolicy should prevent any unauthorized access.
問題 #53
You can switch the cluster/configuration context using the following command: [desk@cli] $ kubectl config use-context test-account Task: Enable audit logs in the cluster.
To do so, enable the log backend, and ensure that:
1. logs are stored at /var/log/Kubernetes/logs.txt
2. log files are retained for 5 days
3. at maximum, a number of 10 old audit log files are retained
A basic policy is provided at /etc/Kubernetes/logpolicy/audit-policy.yaml. It only specifies what not to log. Note: The base policy is located on the cluster's master node.
Edit and extend the basic policy to log: 1. Nodes changes at RequestResponse level 2. The request body of persistentvolumes changes in the namespace frontend 3. ConfigMap and Secret changes in all namespaces at the Metadata level Also, add a catch-all rule to log all other requests at the Metadata level Note: Don't forget to apply the modified policy.
答案：
解題說明：
$ vim /etc/kubernetes/log-policy/audit-policy.yaml
- level: RequestResponse
userGroups: ["system:nodes"]
- level: Request
resources:
- group: "" # core API group
resources: ["persistentvolumes"]
namespaces: ["frontend"]
- level: Metadata
resources:
- group: ""
resources: ["configmaps", "secrets"]
- level: Metadata
$ vim /etc/kubernetes/manifests/kube-apiserver.yaml Add these
- --audit-policy-file=/etc/kubernetes/log-policy/audit-policy.yaml
- --audit-log-path=/var/log/kubernetes/logs.txt
- --audit-log-maxage=5
- --audit-log-maxbackup=10
Explanation
[desk@cli] $ ssh master1 [master1@cli] $ vim /etc/kubernetes/log-policy/audit-policy.yaml apiVersion: audit.k8s.io/v1 # This is required.
kind: Policy
# Don't generate audit events for all requests in RequestReceived stage.
omitStages:
- "RequestReceived"
rules:
# Don't log watch requests by the "system:kube-proxy" on endpoints or services
- level: None
users: ["system:kube-proxy"]
verbs: ["watch"]
resources:
- group: "" # core API group
resources: ["endpoints", "services"]
# Don't log authenticated requests to certain non-resource URL paths.
- level: None
userGroups: ["system:authenticated"]
nonResourceURLs:
- "/api*" # Wildcard matching.
- "/version"
# Add your changes below
- level: RequestResponse
userGroups: ["system:nodes"] # Block for nodes
- level: Request
resources:
- group: "" # core API group
resources: ["persistentvolumes"] # Block for persistentvolumes
namespaces: ["frontend"] # Block for persistentvolumes of frontend ns
- level: Metadata
resources:
- group: "" # core API group
resources: ["configmaps", "secrets"] # Block for configmaps & secrets
- level: Metadata # Block for everything else
[master1@cli] $ vim /etc/kubernetes/manifests/kube-apiserver.yaml
apiVersion: v1
kind: Pod
metadata:
annotations:
kubeadm.kubernetes.io/kube-apiserver.advertise-address.endpoint: 10.0.0.5:6443 labels:
component: kube-apiserver
tier: control-plane
name: kube-apiserver
namespace: kube-system
spec:
containers:
- command:
- kube-apiserver
- --advertise-address=10.0.0.5
- --allow-privileged=true
- --authorization-mode=Node,RBAC
- --audit-policy-file=/etc/kubernetes/log-policy/audit-policy.yaml #Add this
- --audit-log-path=/var/log/kubernetes/logs.txt #Add this
- --audit-log-maxage=5 #Add this
- --audit-log-maxbackup=10 #Add this
...
output truncated
Note: log volume & policy volume is already mounted in vim /etc/kubernetes/manifests/kube-apiserver.yaml so no need to mount it. Reference: https://kubernetes.io/docs/tasks/debug-application-cluster/audit/
問題 #54
You are deploying a new application in a Kubernetes cluster that needs to access a confidential database- You want to ensure that the application container can only access the database using a dedicated service account with limited permissions. Describe how you would create and use a service account with restricted permissions for this application, ensuring the database access is secure.
答案：
解題說明：
Solution (Step by Step) :
1. Create a Service Account: Create a new service account for the application with a descriptive name like "db-access-sa"'
- Apply the YAML file to your cluster: bash kubectl apply -f db-access-sa.yaml 2. Create a Role and Role8inding: Create a Role that defines the specific permissions for the service account. This role should only grant the necessary permissions to access the database, like reading and writing.
- Create a RoIeBinding that associates the Role with the ServiceAccount
- Apply these YAML files to your cluster. 3. Configure the Application Container: Modify the Deployment or Pod definition for your application. Ensure you specify the 'serviceAccountName field to use the newly created service account.
4. Test Database Access: Deploy your application. Verify that the application container can successfully connect to the database and perform the required operations. 5. Verify Permissions: Ensure that the application container is unable to access any other resources that it's not explicitly granted permission to.
問題 #55
SIMULATION
Service is running on port 389 inside the system, find the process-id of the process, and stores the names of all the open-files inside the /candidate/KH77539/files.txt, and also delete the binary.
答案：
解題說明：
See the Explanation belowExplanation:
root# netstat -ltnup
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:17600 0.0.0.0:* LISTEN 1293/dropbox tcp 0 0 127.0.0.1:17603 0.0.0.0:* LISTEN 1293/dropbox tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 575/sshd tcp 0 0 127.0.0.1:9393 0.0.0.0:* LISTEN 900/perl tcp 0 0 :::80 :::* LISTEN 9583/docker-proxy tcp 0 0 :::443 :::* LISTEN 9571/docker-proxy udp 0 0 0.0.0.0:68 0.0.0.0:* 8822/dhcpcd
...
root# netstat -ltnup | grep ':22'
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 575/sshd
The ss command is the replacement of the netstat command.
Now let's see how to use the ss command to see which process is listening on port 22:
root# ss -ltnup 'sport = :22'
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:("sshd",pid=575,fd=3))
問題 #56
Create a RuntimeClass named gvisor-rc using the prepared runtime handler named runsc.
Create a Pods of image Nginx in the Namespace server to run on the gVisor runtime class
答案：
解題說明：
Install the Runtime Class for gVisor
{ # Step 1: Install a RuntimeClass
cat <<EOF | kubectl apply -f -
apiVersion: node.k8s.io/v1beta1
kind: RuntimeClass
metadata:
name: gvisor
handler: runsc
EOF
}
Create a Pod with the gVisor Runtime Class
{ # Step 2: Create a pod
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
name: nginx-gvisor
spec:
runtimeClassName: gvisor
containers:
- name: nginx
image: nginx
EOF
}
Verify that the Pod is running
{ # Step 3: Get the pod
kubectl get pod nginx-gvisor -o wide
}
問題 #57
......
CKS PDF: https://www.testpdf.net/CKS.html
此外，這些Testpdf CKS考試題庫的部分內容現在是免費的：https://drive.google.com/open?id=1jWs3m1NdJdh06rpXxOeYk0DX7BFP3X84