그 외, KoreaDumps CKS 시험 문제집 일부가 지금은 무료입니다: https://drive.google.com/open?id=1CvKAHtm80qdqT0UBaTpCQGs96frjzL8o
꿈을 안고 사는 인생이 멋진 인생입니다. 고객님의 최근의 꿈은 승진이나 연봉인상이 아닐가 싶습니다. Linux Foundation인증 CKS시험은 IT인증시험중 가장 인기있는 국제승인 자격증을 취득하는데서의 필수시험과목입니다.그만큼 시험문제가 어려워 시험도전할 용기가 없다구요? 이제 이런 걱정은 버리셔도 됩니다. KoreaDumps의 Linux Foundation인증 CKS덤프는Linux Foundation인증 CKS시험에 대비한 공부자료로서 시험적중율 100%입니다.
CKS 자격증 시험은 Kubernetes 관리 경험이 최소 2년 이상이 있고 보안 원칙과 관행에 대한 견고한 이해를 갖고 있는 전문가들을 대상으로 합니다. 후보자들은 엄격한 성능 기반 시험을 통해 Kubernetes 보안 능력을 증명해야 합니다. 이 시험은 인증, 권한 부여, 네트워크 정책 및 배포 보안 등 다양한 보안 주제를 다루는 15-20개의 성능 기반 과제로 구성됩니다.
KoreaDumps덤프를 IT국제인증자격증 시험대비자료중 가장 퍼펙트한 자료로 거듭날수 있도록 최선을 다하고 있습니다. Linux Foundation CKS 덤프에는Linux Foundation CKS시험문제의 모든 범위와 유형을 포함하고 있어 시험적중율이 높아 구매한 분이 모두 시험을 패스한 인기덤프입니다.만약 시험문제가 변경되어 시험에서 불합격 받으신다면 덤프비용 전액 환불해드리기에 안심하셔도 됩니다.
Linux Foundation CKS 인증은 Kubernetes 환경 보안에 대한 전문 지식을 보여 주려는 IT 전문가에게 귀중한 자격 증명입니다. 인증 된 Kubernetes 보안 전문가는 수요가 높으며 CKS 인증은 개인이 경력을 발전시키고 수입 잠재력을 높이는 데 도움이 될 수 있습니다. 인증은 또한 조직에 자격을 갖춘 전문가가 Kubernetes 환경을 관리하고 확보하고 있다는 확신을 제공합니다.
질문 # 45
Use the kubesec docker images to scan the given YAML manifest, edit and apply the advised changes, and passed with a score of 4 points.
kubesec-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: kubesec-demo
spec:
containers:
- name: kubesec-demo
image: gcr.io/google-samples/node-hello:1.0
securityContext:
readOnlyRootFilesystem: true
정답：A
질문 # 46
You are setting up a Kubernetes cluster that requires strong security measures. You need to implement several security best practices, including.
- Pod Security Policy: Implement a default Pod Security Policy that restricts resource requests, limits privilege escalation, and disables container root access.
- Network Policy: Configure network policies to restrict communication between pods within the cluster, enforcing a principle of least privilege.
- Admission Controller: Use the 'PodSecurityPolicys admission controller to enforce the defined Pod Security Policy rules.
How would you set up a secure Kubernetes cluster, including the configuration of a default Pod Security Policy, network policies, and the 'PodSecuntyP01icy' admission controller, to enforce these security best practices?
정답：
설명：
Solution (Step by Step) :
1. Create a Default Pod Security Policy:
- Create a YAML file named 'psp.yaml' with the following content:
2. Create Network Policies: - Create separate YAML files for each network policy you need. - For example, a policy to restrict communication between pods in the 'frontend' and 'backend' namespaces could be defined as:
3. Enable the 'PodSecurityPolicy' Admission Controller: - Modify the Kubernetes API server configuration (e.g., vetc'kubernetes/manifests/kube-apiserver.yaml') to enable the 'PodSecurityPolicy' admission controller: - Add the following line: '--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,PodSecurityPolicy' 4. Apply the Configuration: - Apply the 'psp.yaml' and network policy files to the cluster using 'kubectl apply -f -yamr - Restart the Kubernetes API server for the changes to take effect. 5. Test the Configuration: - Try to create a pod that violates the Pod Security Policy rules. - You should see an error message indicating that the PodSecurityPolicy is preventing the pod creatiom - Test the network policies by attempting to communicate between pods and verifying that traffic is restricted according to the defined rules. 6. Monitor and Adjust - Monitor the cluster for any potential issues caused by the security policies. - Adjust the policies as needed based on evolving security requirements and application needs. Note: It's recommended to use a tool like 'kubectl apply -f -s to pipe the content of the YAML files to the command for applying the resources.
질문 # 47
Fix all issues via configuration and restart the affected components to ensure the new setting takes effect.
Fix all of the following violations that were found against the API server:- a. Ensure that the RotateKubeletServerCertificate argument is set to true.
b. Ensure that the admission control plugin PodSecurityPolicy is set.
c. Ensure that the --kubelet-certificate-authority argument is set as appropriate.
Fix all of the following violations that were found against the Kubelet:- a. Ensure the --anonymous-auth argument is set to false.
b. Ensure that the --authorization-mode argument is set to Webhook.
Fix all of the following violations that were found against the ETCD:-
a. Ensure that the --auto-tls argument is not set to true
b. Ensure that the --peer-auto-tls argument is not set to true
Hint: Take the use of Tool Kube-Bench
정답：
설명：
Fix all of the following violations that were found against the API server:- a. Ensure that the RotateKubeletServerCertificate argument is set to true.
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
component: kubelet
tier: control-plane
name: kubelet
namespace: kube-system
spec:
containers:
- command:
- kube-controller-manager
+ - --feature-gates=RotateKubeletServerCertificate=true
image: gcr.io/google_containers/kubelet-amd64:v1.6.0
livenessProbe:
failureThreshold: 8
httpGet:
host: 127.0.0.1
path: /healthz
port: 6443
scheme: HTTPS
initialDelaySeconds: 15
timeoutSeconds: 15
name: kubelet
resources:
requests:
cpu: 250m
volumeMounts:
- mountPath: /etc/kubernetes/
name: k8s
readOnly: true
- mountPath: /etc/ssl/certs
name: certs
- mountPath: /etc/pki
name: pki
hostNetwork: true
volumes:
- hostPath:
path: /etc/kubernetes
name: k8s
- hostPath:
path: /etc/ssl/certs
name: certs
- hostPath:
path: /etc/pki
name: pki
b. Ensure that the admission control plugin PodSecurityPolicy is set.
audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
tests:
test_items:
- flag: "--enable-admission-plugins"
compare:
op: has
value: "PodSecurityPolicy"
set: true
remediation: |
Follow the documentation and create Pod Security Policy objects as per your environment.
Then, edit the API server pod specification file $apiserverconf
on the master node and set the --enable-admission-plugins parameter to a value that includes PodSecurityPolicy :
--enable-admission-plugins=...,PodSecurityPolicy,...
Then restart the API Server.
scored: true
c. Ensure that the --kubelet-certificate-authority argument is set as appropriate.
audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
tests:
test_items:
- flag: "--kubelet-certificate-authority"
set: true
remediation: |
Follow the Kubernetes documentation and setup the TLS connection between the apiserver and kubelets. Then, edit the API server pod specification file
$apiserverconf on the master node and set the --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
--kubelet-certificate-authority=<ca-string>
scored: true
Fix all of the following violations that were found against the ETCD:-
a. Ensure that the --auto-tls argument is not set to true
Edit the etcd pod specification file $etcdconf on the master
node and either remove the --auto-tls parameter or set it to false.
--auto-tls=false
b. Ensure that the --peer-auto-tls argument is not set to true
Edit the etcd pod specification file $etcdconf on the master
node and either remove the --peer-auto-tls parameter or set it to false.
--peer-auto-tls=false
질문 # 48
SIMULATION
Analyze and edit the given Dockerfile
FROM ubuntu:latest
RUN apt-get update -y
RUN apt-install nginx -y
COPY entrypoint.sh /
ENTRYPOINT ["/entrypoint.sh"]
USER ROOT
Fixing two instructions present in the file being prominent security best practice issues Analyze and edit the deployment manifest file apiVersion: v1 kind: Pod metadata:
name: security-context-demo-2
spec:
securityContext:
runAsUser: 1000
containers:
- name: sec-ctx-demo-2
image: gcr.io/google-samples/node-hello:1.0
securityContext:
runAsUser: 0
privileged: True
allowPrivilegeEscalation: false
Fixing two fields present in the file being prominent security best practice issues Don't add or remove configuration settings; only modify the existing configuration settings Whenever you need an unprivileged user for any of the tasks, use user test-user with the user id 5487
정답：
설명：
FROM debian:latest
MAINTAINER k@bogotobogo.com
# 1 - RUN
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -yq apt-utils RUN DEBIAN_FRONTEND=noninteractive apt-get install -yq htop RUN apt-get clean
# 2 - CMD
#CMD ["htop"]
#CMD ["ls", "-l"]
# 3 - WORKDIR and ENV
WORKDIR /root
ENV DZ version1
$ docker image build -t bogodevops/demo .
Sending build context to Docker daemon 3.072kB
Step 1/7 : FROM debian:latest
---> be2868bebaba
Step 2/7 : MAINTAINER k@bogotobogo.com
---> Using cache
---> e2eef476b3fd
Step 3/7 : RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -yq apt-utils
---> Using cache
---> 32fd044c1356
Step 4/7 : RUN DEBIAN_FRONTEND=noninteractive apt-get install -yq htop
---> Using cache
---> 0a5b514a209e
Step 5/7 : RUN apt-get clean
---> Using cache
---> 5d1578a47c17
Step 6/7 : WORKDIR /root
---> Using cache
---> 6b1c70e87675
Step 7/7 : ENV DZ version1
---> Using cache
---> cd195168c5c7
Successfully built cd195168c5c7
Successfully tagged bogodevops/demo:latest
질문 # 49
You have a Kubernetes cluster that hosts a web application using a Deployment. The Deployment's service exposes the application on port 80. You want to restrict access to the web application to only authorized IP addresses, while allowing access to the Kubernetes API server from any IP address.
정답：
설명：
Solution (Step by Step) :
1. Create a Network Policy:
- Create a Network Policy that allows access to the web application only from the authorized IP addresses.
- Here's an example network policy:
- Replace '10.0.0.0/24' With the authorized IP addresses you want to allow. - This policy allows outbound traffic to any IP address. - Create the policy using 'kubectl apply -f web-app-allow-list.yaml 2. Create a Network Policy for the Kubernetes API Server: - Create a Network Policy that allows access to the Kubernetes API server from any IP address. - Here's an example network policy:
- Create the policy using 'kubectl apply -f api-server-allow-all.yaml 3. Verify the Network Policies: - Use 'kubectl get networkpolicy -n default' to verify that the 'web-app-allow-list' Network Policy is created and 'kubectl get networkpolicy -n kube- system' to verify that the 'api-server-allow-all' Network Policy is created. 4. Test the Access: - Attempt to access the web application from a machine within the authorized IP address range. You should be able to access the application. - Attempt to access the web application from a machine outside the authorized IP address range. You should be unable to access tne application. 5. Verify API Server Access: - Try to connect to the Kubernetes API server from any machine using 'kubectl'. You should be able to connect successfully. Note: This approach assumes that the web application is running in the 'default' namespace. If it's running in a different namespace, adjust the 'namespaces field in the 'web-app-allow-list' Network Policy accordingly.
질문 # 50
......
CKS퍼펙트 인증덤프자료: https://www.koreadumps.com/CKS_exam-braindumps.html
그리고 KoreaDumps CKS 시험 문제집의 전체 버전을 클라우드 저장소에서 다운로드할 수 있습니다: https://drive.google.com/open?id=1CvKAHtm80qdqT0UBaTpCQGs96frjzL8o