2026年Japancertの最新CKS PDFダンプおよびCKS試験エンジンの無料共有：https://drive.google.com/open?id=1HEqjQufP5IyV9NPSL05zjPz7n1Q09Auo
ここ数年、CKS復習教材は、無数の受験者がCKS試験に合格するのに役立ちました。CKS認定資格証明書を取得した後、仕事機会が増え、偉大な企業家になり、専門家になった人もいました。CKS復習教材は多くのいい評価をもらいました。良い評判で、CKS復習教材を選択する人がますます増えています。
| Section | Weight | Objectives |
|---|---|---|
| Supply Chain Security | 20% | - Understand image security scanning and its workflow - Minimize base image footprint - Sign container images and verify signatures - Use static analysis tools to detect vulnerabilities - Use distroless images for static workload - Use image admission controllers to prevent use of untrusted images - Understand the container build process - Understand the software supply chain best practices |
| Monitoring, Logging, and Runtime Security | 20% | - Falco - container security monitoring and threat detection - Detect threats at the container level - Understand and monitor network traffic - Perform behavioral analytics to detect malicious activity - Audit and detect logs and events for anomalies - Minimize the attack surface using container health indicators |
| Cluster Hardening | 15% | - Minimize admission of containers without seccomp profiles - Minimize admission of containers with allowPrivilegeEscalation - Minimize admission of privileged containers - Minimize admission of containers with sharing the host process namespace - Minimize admission of containers with sharing the host network namespace - Minimize admission of containers with hostPath volumes - Minimize admission of containers without a security context - Minimize admission of containers with FlexVolume volumes - Minimize admission of containers with sharing the host IPC namespace - Minimize admission of containers with added capabilities - Minimize admission of containers with raw block devices - Minimize admission of containers that allow host namespaces - Minimize admission of containers with capabilities assigned - Minimize admission of containers without AppArmor profile |
| Cluster Setup | 10% | - Configure TLS certificates and minimum version for etcd - Use Pod Security Policies to control security-related pod behaviors - Understand the security implications of embedding cloud provider flags - Implement Pod-to-Pod encryption using mTLS or WireGuard - Use role-based access control (RBAC) to minimize exposure - Manage sensitive information in clusters - Use Cis benchmarks to check Kubernetes cluster settings |
| System Hardening | 15% | - Modify host components to improve security - Enable audit logging - Understand the concept of OPA (Open Policy Agent) and Gatekeeper - Kernel defaults and parameters using sysctl |
| Minimize Microservice Vulnerabilities | 20% | - Use OPA Gatekeeper to enforce security controls - Set appropriate security contexts for pods and containers - Use AppArmor or seccomp profiles to constrain container behavior - Configure network policies for namespace isolation - Understand the principle of immutable containers - Use PSP to enforce security controls |
実際のCKS試験では常に緊張しており、実際の試験に適応するのは難しいと感じていますか？ 「はい」と答えた場合、CKS試験クイズのソフトウェアバージョンを使用してみてください。 ソフトウェアバージョンは実際のテスト環境をシミュレートできるため、CKS試験ガイドのソフトウェアバージョンが最適です。ソフトウェアバージョンごとにCKS試験の雰囲気を事前に感じることができます。
質問 # 46
SIMULATION
Context
For testing purposes, the kubeadm provisioned cluster 's API server
was configured to allow unauthenticated and unauthorized access.
Task
First, secure the cluster 's API server configuring it as follows:
. Forbid anonymous authentication
. Use authorization mode Node,RBAC
. Use admission controller NodeRestriction
The cluster uses the Docker Engine as its container runtime . If needed, use the docker command to troubleshoot running containers.
kubectl is configured to use unauthenticated and unauthorized access. You do not have to change it, but be aware that kubectl will stop working once you have secured the cluster .
You can use the cluster 's original kubectl configuration file located at etc/kubernetes/admin.conf to access the secured cluster.
Next, to clean up, remove the ClusterRoleBinding
system:anonymous.
正解：
解説：
See the Explanation below for complete solution
Explanation:
1) SSH to control-plane node
ssh cks000002
sudo -i
2) Edit API Server static pod manifest
API server in kubeadm runs as a static pod.
vi /etc/kubernetes/manifests/kube-apiserver.yaml
3) Apply required API Server security settings
3.1 Forbid anonymous authentication
Find command: section and ensure this line exists:
- --anonymous-auth=false
3.2 Use authorization mode Node,RBAC
Ensure exactly this line exists (and no AlwaysAllow):
- --authorization-mode=Node,RBAC
❌ Remove if present:
- --authorization-mode=AlwaysAllow
3.3 Enable admission controller NodeRestriction
Find --enable-admission-plugins and ensure NodeRestriction is included.
Correct example:
- --enable-admission-plugins=NodeRestriction
If other plugins already exist, append NodeRestriction, e.g.:
- --enable-admission-plugins=NamespaceLifecycle,ServiceAccount,NodeRestriction
4) Save file and let kubelet restart API server
Just save and exit (:wq)
Kubelet will automatically restart the API server pod.
5) Switch kubectl to secured config
Current kubectl will stop working after API server hardening.
export KUBECONFIG=/etc/kubernetes/admin.conf
Verify access:
kubectl get nodes
6) Remove insecure ClusterRoleBinding
Delete system:anonymous binding:
kubectl delete clusterrolebinding system:anonymous
Verify removal:
kubectl get clusterrolebinding | grep anonymous
(no output = correct)
7) Quick validation (optional but fast)
API server flags check:
grep -n "anonymous-auth" /etc/kubernetes/manifests/kube-apiserver.yaml
grep -n "authorization-mode" /etc/kubernetes/manifests/kube-apiserver.yaml grep -n "NodeRestriction" /etc/kubernetes/manifests/kube-apiserver.yaml
質問 # 47
You are using a container image signed by a trusted entity. Describe the steps involved in verifying the signature of the image during the image pull process in Kubernetes.
正解：
解説：
Solution (Step by Step) :
1. Generate the Signature:
- The trusted entity uses a signing key and algorithm to create a signature for the container image.
- The signature is typically stored as a separate file or within a manifest file associated with the image.
2. Configure the Kubernetes Cluster:
- Enable the 'ImageSignatureVerification' feature gate in your Kubernetes cluster. This feature gate enables the cluster to verity image signatures-
- Configure the 'ImageP01icyWebh00k' to point to a custom webnook server that will handle the signature verification process.
3. Implement the Webhook Server:
- Create a custom webhook server that will be responsible for verifying the image signature.
- This server will:
- Receive tne image manifest and signature from Kubernetes.
- Validate the signature using the trusted entity's public key.
- Return a success or failure status to Kubernetes based on the verification outcome.
4. Pull the Signed Image:
- When you pull the signed image from the registry, Kubernetes will:
- Fetch the image manifest and signature.
- Send them to the 'ImagePolicyWebhooR for verification.
- If the webhook returns a success status, the image will be allowed to run.
- If the webhook returns a failure status, the image will be rejected.
5. Example Implementation:
- You can use tools like 'cosign' or 'sigstores to generate and verify image signatures.
- Implement the webhook server using a programming language like Go or Python.
# Example using cosign to verify a signature cosign verify -key
- This command will use the provided public key to verify the signature of the specified image.
6. Security Considerations:
- Ensure that the webhook server is secure and only accessible to authorized Kubernetes components.
- Use robust authentication and authorization mechanisms for the webh00k server.
- Consider implementing rate limiting to protect against potential denial-of-service attacks.
質問 # 48
Create a User named john, create the CSR Request, fetch the certificate of the user after approving it.
Create a Role name john-role to list secrets, pods in namespace john
Finally, Create a RoleBinding named john-role-binding to attach the newly created role john-role to the user john in the namespace john. To Verify: Use the kubectl auth CLI command to verify the permissions.
正解：
解説：
se kubectl to create a CSR and approve it.
Get the list of CSRs:
kubectl get csr
Approve the CSR:
kubectl certificate approve myuser
Get the certificate
Retrieve the certificate from the CSR:
kubectl get csr/myuser -o yaml
here are the role and role-binding to give john permission to create NEW_CRD resource:
kubectl apply -f roleBindingJohn.yaml --as=john
rolebinding.rbac.authorization.k8s.io/john_external-rosource-rb created kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata:
name: john_crd
namespace: development-john
subjects:
- kind: User
name: john
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: crd-creation
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: crd-creation
rules:
- apiGroups: ["kubernetes-client.io/v1"]
resources: ["NEW_CRD"]
verbs: ["create, list, get"]
質問 # 49
Cluster: dev
Master node: master1
Worker node: worker1
You can switch the cluster/configuration context using the following command:
[desk@cli] $ kubectl config use-context dev
Task:
Retrieve the content of the existing secret named adam in the safe namespace.
Store the username field in a file names /home/cert-masters/username.txt, and the password field in a file named /home/cert-masters/password.txt.
1. You must create both files; they don't exist yet.
2. Do not use/modify the created files in the following steps, create new temporary files if needed.
Create a new secret names newsecret in the safe namespace, with the following content:
Username: dbadmin
Password: moresecurepas
Finally, create a new Pod that has access to the secret newsecret via a volume:
Namespace: safe
Pod name: mysecret-pod
Container name: db-container
Image: redis
Volume name: secret-vol
Mount path: /etc/mysecret
正解：
解説：
1. Get the secret, decrypt it & save in files
k get secret adam -n safe -o yaml
2. Create new secret using --from-literal
[desk@cli] $k create secret generic newsecret -n safe --from-literal=username=dbadmin --from-literal=password=moresecurepass
3. Mount it as volume of db-container of mysecret-pod
Explanation
[desk@cli] $k create secret generic newsecret -n safe --from-literal=username=dbadmin --from-literal=password=moresecurepass secret/newsecret created
[desk@cli] $vim /home/certs_masters/secret-pod.yaml
apiVersion: v1
kind: Pod
metadata:
name: mysecret-pod
namespace: safe
labels:
run: mysecret-pod
spec:
containers:
- name: db-container
image: redis
volumeMounts:
- name: secret-vol
mountPath: /etc/mysecret
readOnly: true
volumes:
- name: secret-vol
secret:
secretName: newsecret
[desk@cli] $ k apply -f /home/certs_masters/secret-pod.yaml
pod/mysecret-pod created
[desk@cli] $ k exec -it mysecret-pod -n safe - cat /etc/mysecret/username dbadmin
[desk@cli] $ k exec -it mysecret-pod -n safe - cat /etc/mysecret/password moresecurepas
質問 # 50
SIMULATION
Context
You must resolve issues that a CIS Benchmark tool found for the kubeadm provisioned cluster.
Task
Fix all issues via configuration and restart the affected components to ensure the new settings take effect.
Fix all of the following violations that were found against the kubelet:
The cluster uses the Docker Engine os its container runtime, If needed, use the docker command to troubleshaot running containers.
Ensure that the anonymous-auth argument is set to false FAIL
Ensure that the -authorization-mode argument is not set to FAIL
AlwaysAllow
Use Webhook authentication /authorization where possible.
Fix all of the following violations that were found against ettd :
Ensure that the -client cert auth argument is set to true FAIL
正解：
解説：
See the Explanation below for complete solution
Explanation:
1) SSH to the right node
ssh cks000002
sudo -i
2) Fix kubelet CIS findings
2.1 Edit kubelet config (MAIN place in kubeadm clusters)
vi /var/lib/kubelet/config.yaml
A) Set anonymous-auth to false
Find (or add) this block exactly:
authentication:
anonymous:
enabled: false
B) Use Webhook authentication (recommended by task)
Ensure this exists under authentication:
webhook:
enabled: true
C) Use Webhook authorization and NOT AlwaysAllow
Find (or add) this block exactly:
authorization:
mode: Webhook
When done, your file should contain something like this (exact structure to aim for):
authentication:
anonymous:
enabled: false
webhook:
enabled: true
x509:
clientCAFile: /etc/kubernetes/pki/ca.crt
authorization:
mode: Webhook
If x509: section isn't there, it's usually already present in kubeadm; don't panic. Only the task-required parts are: anonymous false + webhook enabled + authorization mode Webhook.
2.2 Restart kubelet (required for config.yaml changes)
systemctl daemon-reload
systemctl restart kubelet
systemctl status kubelet --no-pager
Quick confirm (optional but fast):
grep -nE "anonymous|webhook|authorization|mode" /var/lib/kubelet/config.yaml
3) Fix etcd CIS finding: --client-cert-auth=true
3.1 Edit etcd static pod manifest (kubeadm path)
vi /etc/kubernetes/manifests/etcd.yaml
Find the container command: args that look like:
- command:
- etcd
- --something=...
Ensure this line exists exactly in the list:
- --client-cert-auth=true
Also ensure this is present (usually already is, but add if missing):
- --trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt
Example snippet (what you want the args area to include):
- command:
- etcd
- --client-cert-auth=true
- --trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt
3.2 Apply etcd change (auto-restart happens)
Just save the file. Kubelet will restart etcd automatically.
Watch it restart (pick one depending on runtime):
If Docker runtime (your task mentions Docker):
docker ps | grep etcd
If you don't see it briefly, wait 2-5 seconds and rerun:
docker ps | grep etcd
(Alternative if available)
crictl ps | grep etcd
4) Final quick validation (fast exam check)
Kubelet config check
grep -n "enabled: false" -n /var/lib/kubelet/config.yaml | head
grep -n "webhook" /var/lib/kubelet/config.yaml
grep -n "authorization" /var/lib/kubelet/config.yaml
etcd arg check
grep -n "client-cert-auth" /etc/kubernetes/manifests/etcd.yaml
質問 # 51
......
JapancertにIT業界のエリートのグループがあって、彼達は自分の経験と専門知識を使ってLinux Foundation CKS認証試験に参加する方に対して問題集を研究続けています。君が後悔しないようにもっと少ないお金を使って大きな良い成果を取得するためにJapancertを選択してください。Japancertはまた一年間に無料なサービスを更新いたします。
CKS技術内容: https://www.japancert.com/CKS.html
無料でクラウドストレージから最新のJapancert CKS PDFダンプをダウンロードする：https://drive.google.com/open?id=1HEqjQufP5IyV9NPSL05zjPz7n1Q09Auo