P.S. KaoGuTi在Google Drive上分享了免費的2026 Linux Foundation CKS考試題庫：https://drive.google.com/open?id=1CxHG_MF2tiNBJi_t-Tw8RuVjRv7NuYHT
有些網站在互聯網上為你提供高品質和最新的Linux Foundation的CKS考試學習資料，但他們沒有任何相關的可靠保證，在這裏我要說明的是這KaoGuTi一個有核心價值的問題，所有Linux Foundation的CKS考試都是非常重要的，但在個資訊化快速發展的時代，KaoGuTi只是其中一個，為什麼大多數人選擇KaoGuTi，是因為KaoGuTi所提供的考題資料一定能幫助你通過測試，，為什麼呢，因為它提供的資料都是最新的，這也是大多數考生通過實踐證明了的。
該考試是線上監考，持續兩個小時。它包含 17-20 項各種複雜性的表現型任務，測試候選人的知識、技能和保護 Kubernetes 環境的能力。該考試涵蓋多個主題，包括但不限於集群設置、容器映像、網絡、運行時環境、策略和存取控制、審計和日誌記錄，以及供應鏈安全。這些任務旨在挑戰候選人在 Kubernetes 安全的不同方面，包括如何配置 Docker 映像漏洞、保護群集網絡和強化 Kubernetes 节点等多個主題。
CKS認證考試是一個很難的考試。但是即使這個考試很難，報名參加考試的人也很多。如果要說為什麼，那當然是因為CKS考試是一個非常重要的考試。對IT職員來說，沒有取得這個資格那麼會對工作帶來不好的影響。這個考試的認證資格可以給你的工作帶來很多有益的幫助，也可以幫助你晉升。總之這是一個可以給你的職業生涯帶來重大影響的考試。这么重要的考试，你也想参加吧。
Linux Foundation CKS認證在行業中非常受重視，因為它驗證了候選人在保護容器化應用程序和Kubernetes平台方面的專業知識。對於那些希望在雲原生技術和基於Kubernetes的應用程序中推進職業生涯的專業人員來說，這是一項必不可少的認證。
CKS 認證是安全專業人員想要深化其 Kubernetes 環境知識和技能的關鍵步驟。它全面涵蓋了 Kubernetes 安全性主題，並驗證了候選人保護 Kubernetes 集群和容器化應用程序免受網絡威脅的能力。通過 CKS 認證考試的候選人展示了他們在保護 Kubernetes 應用程序方面的專業知識，在快速發展的 Kubernetes 生態系統中脫穎而出。
問題 #32
SIMULATION
Two tools are pre-installed on the cluster's worker node:
Using the tool of your choice (including any non pre-installed tool), analyze the container's behavior for at least 30 seconds, using filters that detect newly spawning and executing processes.
Store an incident file at /opt/KSRS00101/alerts/details, containing the detected incidents, one per line, in the following format:
The following example shows a properly formatted incident file:
答案：
解題說明：
See explanation below
Explanation:
問題 #33
SIMULATION
Fix all issues via configuration and restart the affected components to ensure the new setting takes effect.
Fix all of the following violations that were found against the API server:- a. Ensure the --authorization-mode argument includes RBAC b. Ensure the --authorization-mode argument includes Node c. Ensure that the --profiling argument is set to false Fix all of the following violations that were found against the Kubelet:- a. Ensure the --anonymous-auth argument is set to false.
b. Ensure that the --authorization-mode argument is set to Webhook.
Fix all of the following violations that were found against the ETCD:-
a. Ensure that the --auto-tls argument is not set to true
Hint: Take the use of Tool Kube-Bench
答案：
解題說明：
API server:
Ensure the --authorization-mode argument includes RBAC
Turn on Role Based Access Control. Role Based Access Control (RBAC) allows fine-grained control over the operations that different entities can perform on different objects in the cluster. It is recommended to use the RBAC authorization mode.
Fix - Buildtime
Kubernetes
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
component: kube-apiserver
tier: control-plane
name: kube-apiserver
namespace: kube-system
spec:
containers:
- command:
+ - kube-apiserver
+ - --authorization-mode=RBAC,Node
image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0
livenessProbe:
failureThreshold: 8
httpGet:
host: 127.0.0.1
path: /healthz
port: 6443
scheme: HTTPS
initialDelaySeconds: 15
timeoutSeconds: 15
name: kube-apiserver-should-pass
resources:
requests:
cpu: 250m
volumeMounts:
- mountPath: /etc/kubernetes/
name: k8s
readOnly: true
- mountPath: /etc/ssl/certs
name: certs
- mountPath: /etc/pki
name: pki
hostNetwork: true
volumes:
- hostPath:
path: /etc/kubernetes
name: k8s
- hostPath:
path: /etc/ssl/certs
name: certs
- hostPath:
path: /etc/pki
name: pki
Ensure the --authorization-mode argument includes Node
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --authorization-mode parameter to a value that includes Node.
--authorization-mode=Node,RBAC
Audit:
/bin/ps -ef | grep kube-apiserver | grep -v grep
Expected result:
'Node,RBAC' has 'Node'
Ensure that the --profiling argument is set to false
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the below parameter.
--profiling=false
Audit:
/bin/ps -ef | grep kube-apiserver | grep -v grep
Expected result:
'false' is equal to 'false'
Fix all of the following violations that were found against the Kubelet:- Ensure the --anonymous-auth argument is set to false.
Remediation: If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to false. If using executable arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
--anonymous-auth=false
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
Audit:
/bin/ps -fC kubelet
Audit Config:
/bin/cat /var/lib/kubelet/config.yaml
Expected result:
'false' is equal to 'false'
2) Ensure that the --authorization-mode argument is set to Webhook.
Audit
docker inspect kubelet | jq -e '.[0].Args[] | match("--authorization-mode=Webhook").string' Returned Value: --authorization-mode=Webhook Fix all of the following violations that were found against the ETCD:- a. Ensure that the --auto-tls argument is not set to true Do not use self-signed certificates for TLS. etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should not be available to unauthenticated clients. You should enable the client authentication via valid certificates to secure the access to the etcd service.
Fix - Buildtime
Kubernetes
apiVersion: v1
kind: Pod
metadata:
annotations:
scheduler.alpha.kubernetes.io/critical-pod: ""
creationTimestamp: null
labels:
component: etcd
tier: control-plane
name: etcd
namespace: kube-system
spec:
containers:
- command:
+ - etcd
+ - --auto-tls=true
image: k8s.gcr.io/etcd-amd64:3.2.18
imagePullPolicy: IfNotPresent
livenessProbe:
exec:
command:
- /bin/sh
- -ec
- ETCDCTL_API=3 etcdctl --endpoints=https://[192.168.22.9]:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt
--cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key get foo failureThreshold: 8 initialDelaySeconds: 15 timeoutSeconds: 15 name: etcd-should-fail resources: {} volumeMounts:
- mountPath: /var/lib/etcd
name: etcd-data
- mountPath: /etc/kubernetes/pki/etcd
name: etcd-certs
hostNetwork: true
priorityClassName: system-cluster-critical
volumes:
- hostPath:
path: /var/lib/etcd
type: DirectoryOrCreate
name: etcd-data
- hostPath:
path: /etc/kubernetes/pki/etcd
type: DirectoryOrCreate
name: etcd-certs
status: {}
問題 #34
You are running a Kubernetes cluster with a deployment named "my-app" that uses a container image from a public registry. The container image has a vulnerability in a library it uses. You want to apply a security patch to the container image without rebuilding it. Explain how you would implement this using a container patching tool like 'image-patcners and update the deployment.
答案：
解題說明：
Solution (Step by Step) :
1. Install 'image-patchers:
- Install the 'image-patcher' tool on your system or within your Kubernetes cluster. 'image-patcher' is a tool for patching container images without rebuilding thenm It allows you to modify the container image's filesystem and update libraries directly.
2. Identify the Vulnerable Library:
- Use a vulnerability scanner like Trivy to identify the specific vulnerable library within the container image.
3. Patch the Vulnerable Library:
- Use 'image-patcher' to apply the security patch to the vulnerable library within the container image.
- You can use the 'image-patcher apply' command with the patch file and tne container image name to apply the patch.
4. Create a Patched Image:
- 'image-patcher' Will generate a new, patched container image. This patched image will contain the updated library with the security fix applied.
5. Push the Patched Image to a Registry:
- Push the patched image to your private container registry for use in deployments.
6. Update the Deployment
- Update the "my-app" deployment configuration to use the newly created patched image from your private registry.
7. Validate the Patch:
- After updating the deployment, verify that the patch has been successfully applied by running a vulnerability scan on the running container.
問題 #35
SIMULATION
Context
A PodSecurityPolicy shall prevent the creation of privileged Pods in a specific namespace.
Task
Create a new PodSecurityPolicy named prevent-psp-policy,which prevents the creation of privileged Pods.
Create a new ClusterRole named restrict-access-role, which uses the newly created PodSecurityPolicy prevent-psp-policy.
Create a new ServiceAccount named psp-restrict-sa in the existing namespace staging.
Finally, create a new ClusterRoleBinding named restrict-access-bind, which binds the newly created ClusterRole restrict-access-role to the newly created ServiceAccount psp-restrict-sa.
答案：
解題說明：
See the Explanation below
Explanation:
問題 #36
You have a Kubernetes cluster running a web application deployment named 'web-app' that uses a service account called 'web-app-sa' The 'web-app-sa' has been granted the necessary RBAC roles and permissions to access specific resources in the cluster. You want to implement a strategy to prevent the 'web-app' deployment from using unauthorized service accounts that might be accidentally created or added to the deployment spec.
答案：
解題說明：
Solution (Step by Step) :
1. Create a Service Account for the Web Applicatiom
- Create a Service Account YAML file named 'web-app-sa.yaml
2. Create a Role for the Service Account: - Create a Role YAML file named 'web-app-role.yaml to grant the necessary permissions to the 'web-app-sa':
3. Bind the Role to the Service Account: - Create a ROIeBinding YAML file named 'web-app-rolebinding.yamr to bind the 'web-app-roles to the 'web-app-sa':
4. Create tne Web Application Deployment: - Create a Deployment YAML file named 'web-app-deployment.yaml that specifies the 'web-app-sa' and any other necessary configuration:
5. Apply the Service Account, Role, RoleBinding, and Deployment: - Apply the YAML files using kubectl apply -f web-app-sa.yaml web-app-role.yaml web-app-rolebinding.yaml web-app-deployment.yaml 6. Test With unauthorized Service Accounts: - Try creating a new Service Account (e.g., 'unauthorized-sa') and adding it to the 'web-app-deployment YAML file. - Try updating the deployment. This should fail because the unauthorized service account does not have the necessary permissions. - You can also try creating a pod with the unauthorized service account to see that it cannot access resources it doesn't have permission for. By following these steps, you effectively enforce a policy that ensures the 'web-app' deployment only uses the authorized 'web-app-sa' for resource access, mitigating the risks associated with unauthorized service account usage.
問題 #37
......
CKS認證考試解析: https://www.kaoguti.com/CKS_exam-pdf.html
P.S. KaoGuTi在Google Drive上分享了免費的、最新的CKS考試題庫：https://drive.google.com/open?id=1CxHG_MF2tiNBJi_t-Tw8RuVjRv7NuYHT