さらに、ShikenPASS CKSダンプの一部が現在無料で提供されています：https://drive.google.com/open?id=1fnBllIzdSz8Zq0xfPAD3bQfKLfdRYRR2
私たちに知られているように、当社では世界中でCKS認定トレーニング資料のベストセールとアフターサービスがあります。当社は、過去数年にわたり、すべてのお客様に最適で最も適切なCKS最新の質問を設計するために、この分野で多くの優秀な専門家および教授を採用してきました。さらに重要なことは、当社のCKSトレーニング教材が高品質であることはすべて明白であり、CKS試験問題の品質が市場の他の学習教材よりも高いことを確認できます。
CKS認定試験は、Kubernetesクラスタをセキュアにする能力を示すために、複数の選択肢による問題と実技タスクで構成されています。この試験では、Kubernetesセキュリティの概念、Kubernetesコンポーネントのセキュリティ、コンテナイメージのセキュリティ、ネットワーク通信のセキュリティ、Kubernetesセキュリティの監視など、広範なトピックがカバーされます。CKS認定試験に合格した候補者は、デジタルバッジと証明書を受け取り、Kubernetesセキュリティの専門知識を潜在的な雇用主にアピールすることができます。CKS認定資格は、キューバネットセキュリティの専門家がキャリアを進め、業界での信頼性を高めるための貴重な資格です。
CKS準備資料で20〜30時間学習した直後に、今後の試験に自信を持つことができるという誇張はありません。数万人のお客様が弊社の試験資料の恩恵を受けて、簡単に試験に合格しました。データは、私たちのハイパス率が信じられないほど98％から100％であることを示しました。間違いなく、あなたの成功はCKSトレーニングガイドで100％保証されています。リンクをクリックするだけで概要を表示できるのが便利であり、あらゆる種類のCKSバージョンを体験できます。
CKS試験は、2時間以内に完了する必要がある15〜20のパフォーマンスベースのタスクで構成される厳格な評価です。この試験はオンラインで実施されており、候補者はKubernetesクラスターにアクセスする必要があります。また、コマンドラインツールとKubernetes APIオブジェクトの知識が必要です。この認定は2年間有効であり、再成分試験に合格するか、継続教育クレジットを獲得することで更新できます。
質問 # 26
Fix all issues via configuration and restart the affected components to ensure the new setting takes effect.
Fix all of the following violations that were found against the API server:- a. Ensure that the RotateKubeletServerCertificate argument is set to true.
b. Ensure that the admission control plugin PodSecurityPolicy is set.
c. Ensure that the --kubelet-certificate-authority argument is set as appropriate.
Fix all of the following violations that were found against the Kubelet:- a. Ensure the --anonymous-auth argument is set to false.
b. Ensure that the --authorization-mode argument is set to Webhook.
Fix all of the following violations that were found against the ETCD:-
a. Ensure that the --auto-tls argument is not set to true
b. Ensure that the --peer-auto-tls argument is not set to true
Hint: Take the use of Tool Kube-Bench
正解：
解説：
Fix all of the following violations that were found against the API server:- a. Ensure that the RotateKubeletServerCertificate argument is set to true.
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
component: kubelet
tier: control-plane
name: kubelet
namespace: kube-system
spec:
containers:
- command:
- kube-controller-manager
+ - --feature-gates=RotateKubeletServerCertificate=true
image: gcr.io/google_containers/kubelet-amd64:v1.6.0
livenessProbe:
failureThreshold: 8
httpGet:
host: 127.0.0.1
path: /healthz
port: 6443
scheme: HTTPS
initialDelaySeconds: 15
timeoutSeconds: 15
name: kubelet
resources:
requests:
cpu: 250m
volumeMounts:
- mountPath: /etc/kubernetes/
name: k8s
readOnly: true
- mountPath: /etc/ssl/certs
name: certs
- mountPath: /etc/pki
name: pki
hostNetwork: true
volumes:
- hostPath:
path: /etc/kubernetes
name: k8s
- hostPath:
path: /etc/ssl/certs
name: certs
- hostPath:
path: /etc/pki
name: pki
b. Ensure that the admission control plugin PodSecurityPolicy is set.
audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
tests:
test_items:
- flag: "--enable-admission-plugins"
compare:
op: has
value: "PodSecurityPolicy"
set: true
remediation: |
Follow the documentation and create Pod Security Policy objects as per your environment.
Then, edit the API server pod specification file $apiserverconf
on the master node and set the --enable-admission-plugins parameter to a value that includes PodSecurityPolicy :
--enable-admission-plugins=...,PodSecurityPolicy,...
Then restart the API Server.
scored: true
c. Ensure that the --kubelet-certificate-authority argument is set as appropriate.
audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
tests:
test_items:
- flag: "--kubelet-certificate-authority"
set: true
remediation: |
Follow the Kubernetes documentation and setup the TLS connection between the apiserver and kubelets. Then, edit the API server pod specification file
$apiserverconf on the master node and set the --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
--kubelet-certificate-authority=<ca-string>
scored: true
Fix all of the following violations that were found against the ETCD:-
a. Ensure that the --auto-tls argument is not set to true
Edit the etcd pod specification file $etcdconf on the master node and either remove the --auto-tls parameter or set it to false. --auto-tls=false b. Ensure that the --peer-auto-tls argument is not set to true Edit the etcd pod specification file $etcdconf on the master node and either remove the --peer-auto-tls parameter or set it to false. --peer-auto-tls=false
質問 # 27
You are working on a Kubernetes cluster with multiple teams developing and deploying applications. How would you establish a secure. supply chain process that ensures all deployed images are scanned for vulnerabilities and comply with security best practices?
正解：
解説：
Solution (Step by Step) :
1. Centralized Image Registry:
- Establish a centralized image registry to act as the single source of truth for all container images.
- Use a registry like Docker Hub, Harbor, or Google Container Registry (GCR), depending on your organization's needs.
2. Image Scanning Integration:
- Integrate a container image vulnerability scanner into your CI/CD pipelines.
- Utilize tools like Aqua Security, JFrog Xray, or Anchore Engine.
- Configure the scanner to run automatically during image builds and before pushing to the registry.
3. Automated Policy Enforcement:
- Implement Kubernetes policies (like Admission Controllers) to enforce security best practices.
- Define rules that block the deployment of images with:
- Unacceptable vulnerability levels (based on CVSS score or severity)
- Missing security scans (e.g., images without a "scanned" tag)
- Unauthorized image sources (restricting deployments to images from the centralized registry)
4. Image Signing:
- Implement image signing to add an extra layer of security.
- Use a trusted key to sign images in the registry.
- Configure Kubernetes to only allow images signed with the trusted key to be deployed.
- This helps prevent tampering or unauthorized modifications to images.
5. Access Control and Role-Based Access Control (RBAC):
- Implement strong access control mechanisms to limit who has access to the image registry and the Kubernetes cluster.
- Use RBAC to grant different teams specific permissions based on their responsibilities.
- For example, developers might have access to build images and push them to the registry, while deployment teams might have access to pull
images and deploy them to the cluster.
6. Security Best Practices Training:
- Educate development teams on container security best practices, such as:
- Using minimal base images
- Avoiding unnecessary dependencies
- Employing security tools like linters and analyzers
- Following secure coding practices
- Regularly review and update policies and procedures to reflect evolving security threats and industry best practices.
7. Auditing and Monitoring:
- Implement auditing and monitoring to track all image pulls, deployments, and any potential security issues.
- Use logs, security dashboards, and monitoring tools to identify and address anomalies or security breaches.
8. Continuous Improvement:
- Establish a continuous improvement process to review and refine your secure supply chain procedures.
- Regularly assess your security posture, identity areas for improvement, and implement changes to enhance your overall security.
These steps help you establish a comprehensive secure supply chain process across your Kubernetes cluster, ensuring all deployed images are scanned tor vulnerabilities, comply with security best practices, and contribute to the overall security posture of your application.
質問 # 28
You are running a Kubernetes cluster that hosts a critical database application. You need to implement a policy that prevents any unauthorized access to the database pod from other pods within the cluster.
正解：
解説：
Solution (Step by Step) :
1. Create a Network Policy:
- Create a NetworkPolicy in the namespace of your database pod:
2. Apply the Network Policy: - Apply the NetworkP01iCY using 'kubectl apply -f database-access-control.yaml 3. Test the Policy: - Run a pod in a different namespace or with a different label and attempt to connect to the database pod. - The NetworkPolicy should prevent any unauthorized access.
質問 # 29
SIMULATION
Secrets stored in the etcd is not secure at rest, you can use the etcdctl command utility to find the secret value for e.g:- ETCDCTL_API=3 etcdctl get /registry/secrets/default/cks-secret --cacert="ca.crt" --cert="server.crt" --key="server.key" Output
Using the Encryption Configuration, Create the manifest, which secures the resource secrets using the provider AES-CBC and identity, to encrypt the secret-data at rest and ensure all secrets are encrypted with the new configuration.
正解：
解説：
See the Explanation belowExplanation:
ETCD secret encryption can be verified with the help of etcdctl command line utility.
ETCD secrets are stored at the path /registry/secrets/$namespace/$secret on the master node.
The below command can be used to verify if the particular ETCD secret is encrypted or not.
# ETCDCTL_API=3 etcdctl get /registry/secrets/default/secret1 [...] | hexdump -C
質問 # 30
Your Kubernetes cluster is configured with a default service account with broad permissions. You need to disable this default service account to enhance security and limit access to cluster resources.
正解：
解説：
Solution (Step by Step):
1. Identify Default Service Account:
- Use the command 'kubectl get serviceaccount -n default default to identify the default service account in the default namespace.
2. Remove Default Service Account:
- You need to remove the default service account using the command 'kubectl delete serviceaccount default -n default
3. Review Permissions Check your RBAC configuration and ensure that no other roles or bindings grant unnecessary permissions to any other service accounts.
4. Create Custom Service Accounts: Create new, dedicated service accounts for each application or component that requires access to the cluster.
Assign specific roles or permissions to each service account based on its requirements.
Note: This process may require changes to your applications or configurations to use the new, dedicated service accounts instead of the default service account.
質問 # 31
......
CKS日本語版トレーリング: https://www.shikenpass.com/CKS-shiken.html
P.S. ShikenPASSがGoogle Driveで共有している無料かつ新しいCKSダンプ：https://drive.google.com/open?id=1fnBllIzdSz8Zq0xfPAD3bQfKLfdRYRR2