P.S. Free & New CKS dumps are available on Google Drive shared by ITdumpsfree: https://drive.google.com/open?id=1HGLEakYMUlTXraMOt6p_VNwjfmzYRRKg
When people take the subway staring blankly, you can use Pad or cell phone to see the PDF version of the CKS study materials. While others are playing games online, you can do online CKS exam questions. We are sure that as you hard as you are, you can Pass CKS Exam easily in a very short time. While others are surprised at your achievement, you might have found a better job.
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Minimize Microservice Vulnerabilities | 20% | - Pod Security Standards - Security contexts - OPA/Gatekeeper implementation - Secret management - Isolation & multi-tenancy |
| Topic 2: Monitoring, Logging and Runtime Security | 20% | - Threat detection (Falco) - Incident investigation - Audit log configuration - Behavioral analytics - Container immutability |
| Topic 3: Supply Chain Security | 20% | - Permitted registries - Static analysis tools - Image security & scanning - Signed artifacts & verification - SBOM & CI/CD security |
| Topic 4: Cluster Hardening | 15% | - API access restriction - Service account security - RBAC configuration - Component updates & vulnerability mitigation |
| Topic 5: System Hardening | 10% | - Kernel hardening (AppArmor, seccomp) - Minimize OS attack surface - Network access control - Least privilege IAM |
| Topic 6: Cluster Setup | 15% | - Secure Ingress configuration - CIS benchmark compliance - Node metadata protection - Network security policies - Binary verification |
Our CKS guide torrent specially proposed different versions to allow you to learn not only on paper, but also to use mobile phones to learn. This greatly improves the students' availability of fragmented time. You can choose the version of CKS learning materials according to your interests and habits. And if you buy the value pack, you have all of the three versions, the price is quite preferential and you can enjoy all of the study experiences. This means you can study CKS Exam Engine anytime and anyplace for the convenience to help you pass the CKS exam.
NEW QUESTION # 25
Fix all issues via configuration and restart the affected components to ensure the new setting takes effect.
Fix all of the following violations that were found against the API server:- a. Ensure the --authorization-mode argument includes RBAC b. Ensure the --authorization-mode argument includes Node c. Ensure that the --profiling argument is set to false Fix all of the following violations that were found against the Kubelet:- a. Ensure the --anonymous-auth argument is set to false.
b. Ensure that the --authorization-mode argument is set to Webhook.
Fix all of the following violations that were found against the ETCD:-
a. Ensure that the --auto-tls argument is not set to true
Hint: Take the use of Tool Kube-Bench
Answer:
Explanation:
API server:
Ensure the --authorization-mode argument includes RBAC
Turn on Role Based Access Control. Role Based Access Control (RBAC) allows fine-grained control over the operations that different entities can perform on different objects in the cluster. It is recommended to use the RBAC authorization mode.
Fix - Buildtime
Kubernetes
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
component: kube-apiserver
tier: control-plane
name: kube-apiserver
namespace: kube-system
spec:
containers:
- command:
+ - kube-apiserver
+ - --authorization-mode=RBAC,Node
image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0
livenessProbe:
failureThreshold: 8
httpGet:
host: 127.0.0.1
path: /healthz
port: 6443
scheme: HTTPS
initialDelaySeconds: 15
timeoutSeconds: 15
name: kube-apiserver-should-pass
resources:
requests:
cpu: 250m
volumeMounts:
- mountPath: /etc/kubernetes/
name: k8s
readOnly: true
- mountPath: /etc/ssl/certs
name: certs
- mountPath: /etc/pki
name: pki
hostNetwork: true
volumes:
- hostPath:
path: /etc/kubernetes
name: k8s
- hostPath:
path: /etc/ssl/certs
name: certs
- hostPath:
path: /etc/pki
name: pki
Ensure the --authorization-mode argument includes Node
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --authorization-mode parameter to a value that includes Node.
--authorization-mode=Node,RBAC
Audit:
/bin/ps -ef | grep kube-apiserver | grep -v grep
Expected result:
'Node,RBAC' has 'Node'
Ensure that the --profiling argument is set to false
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the below parameter.
--profiling=false
Audit:
/bin/ps -ef | grep kube-apiserver | grep -v grep
Expected result:
'false' is equal to 'false'
Fix all of the following violations that were found against the Kubelet:- Ensure the --anonymous-auth argument is set to false.
Remediation: If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to false. If using executable arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
--anonymous-auth=false
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
Audit:
/bin/ps -fC kubelet
Audit Config:
/bin/cat /var/lib/kubelet/config.yaml
Expected result:
'false' is equal to 'false'
2) Ensure that the --authorization-mode argument is set to Webhook.
Audit
docker inspect kubelet | jq -e '.[0].Args[] | match("--authorization-mode=Webhook").string' Returned Value: --authorization-mode=Webhook Fix all of the following violations that were found against the ETCD:- a. Ensure that the --auto-tls argument is not set to true Do not use self-signed certificates for TLS. etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should not be available to unauthenticated clients. You should enable the client authentication via valid certificates to secure the access to the etcd service.
Fix - Buildtime
Kubernetes
apiVersion: v1
kind: Pod
metadata:
annotations:
scheduler.alpha.kubernetes.io/critical-pod: ""
creationTimestamp: null
labels:
component: etcd
tier: control-plane
name: etcd
namespace: kube-system
spec:
containers:
- command:
+ - etcd
+ - --auto-tls=true
image: k8s.gcr.io/etcd-amd64:3.2.18
imagePullPolicy: IfNotPresent
livenessProbe:
exec:
command:
- /bin/sh
- -ec
- ETCDCTL_API=3 etcdctl --endpoints=https://[192.168.22.9]:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt
--cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key get foo failureThreshold: 8 initialDelaySeconds: 15 timeoutSeconds: 15 name: etcd-should-fail resources: {} volumeMounts:
- mountPath: /var/lib/etcd
name: etcd-data
- mountPath: /etc/kubernetes/pki/etcd
name: etcd-certs
hostNetwork: true
priorityClassName: system-cluster-critical
volumes:
- hostPath:
path: /var/lib/etcd
type: DirectoryOrCreate
name: etcd-data
- hostPath:
path: /etc/kubernetes/pki/etcd
type: DirectoryOrCreate
name: etcd-certs
status: {}
Explanation:
NEW QUESTION # 26
SIMULATION
Context
You must implement auditing for the kubeadm provisioned cluster.
Task
First, reconfigure the cluster 's API server, so that:
. the basic audit policy located at
/etc/kubernetes/logpolicy/audit-policy.yaml is used,
. logs are stored at /var/log/kubernetes/audit-logs.txt,
. and a maximum of 2 logs are retained for 10 days.
The cluster uses the Docker Engine as its container runtime . If needed, use the docker command to troubleshoot running containers.
The basic policy only specifies what not to log.
Next, edit and extend the basic policy to log:
. namespaces interactions at RequestResponse level
. the request body of deployments interactions in the namespace webapps
. ConfigMap and Secret interactions in all namespaces at the Metadata level
. all other requests at the Metadata level
Make sure the API server uses the extended policy.
Failure to do so may result in a reduced score.
Answer:
Explanation:
See the Explanation below for complete solution
Explanation:
1) Connect to the correct host
ssh cks000028
sudo -i
(If hostname differs in your exam, use the one shown in the question banner.)
2) Edit the API server static pod manifest
API server is a static pod in kubeadm.
vi /etc/kubernetes/manifests/kube-apiserver.yaml
3) Configure API server to enable auditing
Inside the command: section, ensure ALL of the following flags exist
(add them if missing, modify if present).
3.1 Use the given audit policy file
- --audit-policy-file=/etc/kubernetes/logpolicy/audit-policy.yaml
3.2 Store audit logs at the required location
- --audit-log-path=/var/log/kubernetes/audit-logs.txt
3.3 Retain a maximum of 2 log files
- --audit-log-maxbackup=2
3.4 Retain logs for 10 days
- --audit-log-maxage=10
✅ Example (your file may have more flags - that's fine):
- command:
- kube-apiserver
- --audit-policy-file=/etc/kubernetes/logpolicy/audit-policy.yaml
- --audit-log-path=/var/log/kubernetes/audit-logs.txt
- --audit-log-maxbackup=2
- --audit-log-maxage=10
Save and exit:
:wq
The API server will auto-restart (static pod).
Optional quick check:
docker ps | grep kube-apiserver
4) Edit and EXTEND the audit policy
Open the given basic policy:
vi /etc/kubernetes/logpolicy/audit-policy.yaml
The file already contains rules for what NOT to log.
You must ADD rules BELOW them (do not delete existing ones).
5) Add the required audit rules (EXACT ORDER)
Append the following rules in this order (order matters in audit policies).
5.1 Log namespaces interactions at RequestResponse
- level: RequestResponse
resources:
- group: ""
resources: ["namespaces"]
5.2 Log deployment request bodies in namespace webapps
- level: RequestResponse
namespaces: ["webapps"]
resources:
- group: "apps"
resources: ["deployments"]
5.3 Log ConfigMap and Secret interactions (all namespaces) at Metadata
- level: Metadata
resources:
- group: ""
resources: ["configmaps", "secrets"]
5.4 Log all other requests at Metadata
This must be LAST
- level: Metadata
5.5 Final audit-policy.yaml should END like this
# (existing "do not log" rules above)
- level: RequestResponse
resources:
- group: ""
resources: ["namespaces"]
- level: RequestResponse
namespaces: ["webapps"]
resources:
- group: "apps"
resources: ["deployments"]
- level: Metadata
resources:
- group: ""
resources: ["configmaps", "secrets"]
- level: Metadata
Save and exit:
:wq
6) Make sure API server uses the EXTENDED policy
Touch the manifest to guarantee reload:
touch /etc/kubernetes/manifests/kube-apiserver.yaml
Wait a few seconds.
7) Verify auditing is working
7.1 Check audit log file exists
ls -l /var/log/kubernetes/audit-logs.txt
7.2 Generate test activity
kubectl get namespaces
kubectl get configmaps -A
7.3 Confirm logs are written
tail -n 20 /var/log/kubernetes/audit-logs.txt
You should see audit entries.
NEW QUESTION # 27
You are deploying a microservice application on Kubernetes, and you are concerned about the potential for one microservice to compromise the security of other microservices in the cluster. How can you use Kubernetes features to implement isolation between your microservices and minimize this risk?
Answer:
Explanation:
Solution (Step by Step) :
1. Namespaces: Use Kubernetes namespaces to logically separate your microservices. Each namespace can have its own set of resources, security
policies, and network configurations.
- Example: You could create namespaces for "user-service", "order-service", "payment-service", etc.
2. Network Policies: Define network policies to control communication between pods within and across namespaces.
- Example:
3. Pod Security Policies (PSPs): Use PSPs to restrict the capabilities and resources that pods can use. - Example:
4. Service Accounts: Create separate service accounts for each microservice and restrict their permissions. - Example: Use RBAC (Role-Based Access Control) to define roles and bindings for each service account 5. Resource Quotas: Limit the resources (CPU, memory, etc.) that each microservice can consume. This helps prevent one microservice from ovenvhelming the cluster and impacting others. 6. Security Context: Use the 'securitycontext field in pod definitions to apply security restrictions to individual pods. - Example:
7. Pod Disruption Budgets (PDB): Set up PD8s to ensure that a minimum number of pods remain running for each microservice, even during upgrades or disruptions. 8. Least Privilege: Follow the principle of least privilege, only granting each microservice the minimum access it needs to perform its function.
NEW QUESTION # 28
SIMULATION
Task
Create a NetworkPolicy named pod-access to restrict access to Pod users-service running in namespace dev-team.
Only allow the following Pods to connect to Pod users-service:
Answer:
Explanation:
NEW QUESTION # 29
You are running a critical application within a Kubernetes cluster. Your application relies on a base image with several unnecessary packages installed. These packages increase the attack surface of your application and make it more vulnerable to exploits. You want to minimize the base image footprint to enhance the security posture of your application. Explain how you can achieve this in a production environment.
Answer:
Explanation:
Solution (Step by Step) :
1. Identify unnecessary Packages:
- Use tools like 'alpine-pkg-info' or 'dpkg -l' to list installed packages within the base image.
- Analyze the package list to identify packages that are not strictly required for your application's functionality.
- Example: If you are running a Node.js application, you might identity development tools like 'gcc' or 'make' as unnecessary.
2. Create a Custom Base Image:
- Docker-file: Start by creating a Dockefflle that inherits from a minimal base image like 'alpine:latest or 'ubuntu:latest' (depending on your application's requirements).
- Install Essential Packages: Include only the absolutely necessary packages for your application in the Dockerfile. Use the 'apt-get install' (for Debian/lJbuntu) or 'apk add' (for Alpine) commands to install these packages.
- Example Dockerfile:
FROM alpine:latest
# Install necessary packages
RIJN apk add --no-cache bash openssl curl nodejs npm
# Copy your application code
COPY _ /app
# Set working directory and execute start script
WORKDIR 'app
CMD ["npm", "start"]
3. Test the Custom Image:
- Build the custom image using 'docker build -t custom-base-image
- Create a container from the custom image and run your application to ensure everything works correctly. This step is critical to catch any compatibility issues before deploying to your Kubernetes cluster.
4. Update Your Deployments:
- Modify your Deployment YAML files to use the custom base image instead of the original image. Update the 'image' field to reference the custom base image tag.
- Example:
5. Deploy the Updated Application: - Use 'kubectl apply -f deployment_yaml to update your deployment with the new image- - Monitor the deployment to ensure a successful rollout with your minimal base image. 6. Regular - Periodically review your application's requirements and ensure that the base image still meets your needs. -As you add new features or update dependencies, you might need to add additional packages to the base image. - Keep the image as minimal as possible and use the least-privilege principle when selecting packages.
NEW QUESTION # 30
......
It is known to us that passing the CKS exam is very difficult for a lot of people. Choosing the correct study materials is so important that all people have to pay more attention to the study materials. If you have any difficulty in choosing the correct CKS preparation materials, here comes a piece of good news for you. The CKS Prep Guide designed by a lot of experts and professors from company are very useful for all people to pass the practice exam and help them get the Linux Foundation certification in the shortest time. And our pass rate is high as more than 98%.
CKS Latest Materials: https://www.itdumpsfree.com/CKS-exam-passed.html
P.S. Free & New CKS dumps are available on Google Drive shared by ITdumpsfree: https://drive.google.com/open?id=1HGLEakYMUlTXraMOt6p_VNwjfmzYRRKg