さらに、GoShiken CKSダンプの一部が現在無料で提供されています：https://drive.google.com/open?id=10-e_g2JjUdFHb_acObtC7zInLJp1MZxU
さまざまな人々がさまざまな学習習慣を持っているという事実を踏まえて、3つのCKSトレーニング質問バージョンをご案内します。さらに、CKS学習教材のデモを自由にダウンロードして検討することもできます。そのような試用に追加料金は発生しないことをお約束します。逆に、CKS試験問題のデモを試して、十分な内容を選択することを心からお勧めします。 CKSトレーニングガイドは、時間とお金をかけて購入する価値があります。
| Section | Weight | Objectives |
|---|---|---|
| System Hardening | 15% | - Modify host components to improve security - Understand the concept of OPA (Open Policy Agent) and Gatekeeper - Kernel defaults and parameters using sysctl - Enable audit logging |
| Monitoring, Logging, and Runtime Security | 20% | - Perform behavioral analytics to detect malicious activity - Audit and detect logs and events for anomalies - Minimize the attack surface using container health indicators - Detect threats at the container level - Understand and monitor network traffic - Falco - container security monitoring and threat detection |
| Supply Chain Security | 20% | - Sign container images and verify signatures - Use image admission controllers to prevent use of untrusted images - Use distroless images for static workload - Understand the software supply chain best practices - Minimize base image footprint - Understand the container build process - Understand image security scanning and its workflow - Use static analysis tools to detect vulnerabilities |
| Cluster Hardening | 15% | - Minimize admission of containers with sharing the host process namespace - Minimize admission of containers with raw block devices - Minimize admission of containers without AppArmor profile - Minimize admission of containers with hostPath volumes - Minimize admission of privileged containers - Minimize admission of containers without seccomp profiles - Minimize admission of containers with capabilities assigned - Minimize admission of containers with allowPrivilegeEscalation - Minimize admission of containers with added capabilities - Minimize admission of containers without a security context - Minimize admission of containers with sharing the host network namespace - Minimize admission of containers with sharing the host IPC namespace - Minimize admission of containers that allow host namespaces - Minimize admission of containers with FlexVolume volumes |
| Minimize Microservice Vulnerabilities | 20% | - Set appropriate security contexts for pods and containers - Use OPA Gatekeeper to enforce security controls - Use PSP to enforce security controls - Understand the principle of immutable containers - Use AppArmor or seccomp profiles to constrain container behavior - Configure network policies for namespace isolation |
| Cluster Setup | 10% | - Understand the security implications of embedding cloud provider flags - Manage sensitive information in clusters - Implement Pod-to-Pod encryption using mTLS or WireGuard - Use Cis benchmarks to check Kubernetes cluster settings - Use role-based access control (RBAC) to minimize exposure - Configure TLS certificates and minimum version for etcd - Use Pod Security Policies to control security-related pod behaviors |
Linux Foundationより多くのCKS質問トレントを入手して最新のトレンドをフォローするために、タイムリーで無料のアップデートを提供します。 CKS試験トレントは、経験豊富な専門家によってまとめられており、非常に価値があります。それらを素早く簡単に習得できます。選択できるさまざまなバージョンを提供しており、CKS試験材料の最適なバージョンを見つけることができます。そのため、学習者がCKSの問題トレントを習得して、短時間でCKS試験に合格すると便利です。
質問 # 58
SIMULATION
Documentation Ingress, Service, NGINX Ingress Controller
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh cks000032
Context
You must expose a web application using HTTPS routes.
Task
Create an Ingress resource named web in the prod namespace and configure it as follows:
. Route traffic for host web.k8s.local and all paths to the existing Service web
. Enable TLS termination using the existing Secret web-cert.
. Redirect HTTP requests to HTTPS .
You can test your Ingress configuration with the following command:
[candidate@cks000032]$ curl -L http://web.k8s.local
正解：
解説：
See the Explanation below for complete solution
Explanation:
1) Connect to the correct host
ssh cks000032
sudo -i
2) Use admin kubeconfig
export KUBECONFIG=/etc/kubernetes/admin.conf
3) Verify prerequisites (quick check)
These should already exist per task.
kubectl -n prod get svc web
kubectl -n prod get secret web-cert
kubectl get pods -n ingress-nginx
(If the ingress controller pods exist, you're good.)
4) Create the Ingress resource
Create Ingress named web in namespace prod with:
host: web.k8s.local
all paths → Service web
TLS using Secret web-cert
HTTP → HTTPS redirect (NGINX)
cat <<EOF | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: web
namespace: prod
annotations:
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
ingressClassName: nginx
tls:
- hosts:
- web.k8s.local
secretName: web-cert
rules:
- host: web.k8s.local
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: web
port:
number: 80
EOF
5) Verify Ingress creation
kubectl -n prod get ingress web
kubectl -n prod describe ingress web
Confirm:
Host = web.k8s.local
TLS Secret = web-cert
Backend Service = web
6) Test HTTP → HTTPS redirect
curl -L http://web.k8s.local
Expected:
Redirects to https://web.k8s.local
Returns application response over HTTPS
質問 # 59
You are responsible for securing a Kubernetes cluster that runs multiple applications. You need to implement a solution that performs static analysis of the container images used in the cluster to identify potential vulnerabilities.
正解：
解説：
Solution (Step by Step):
1. Choose a vulnerability scanning tool: There are many open-source and commercial tools available, such as Trivy, Anchore, and Clair-
2. Deploy the scanning tool in your cluster: This can be done by deploying the tool as a DaemonSet, so that it runs on every node, or by using a dedicated scanning service.
3. Configure the scanning tool to scan all container images in the cluster: This can be done by configuring the tool to scan images in your container registry or by scanning images as they are deployed.
4. Integrate the scanning tool with your CI/CD pipeline: This will allow you to scan images before they are deployed to the cluster.
5. Review and address any vulnerabilities identified by the scanning tool: Analyze the output of the scanning tool and take appropriate action to remediate any identified vulnerabilities.
質問 # 60
Use the kubesec docker images to scan the given YAML manifest, edit and apply the advised changes, and passed with a score of 4 points.
kubesec-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: kubesec-demo
spec:
containers:
- name: kubesec-demo
image: gcr.io/google-samples/node-hello:1.0
securityContext:
readOnlyRootFilesystem: true
Hint: docker run -i kubesec/kubesec:512c5e0 scan /dev/stdin < kubesec-test.yaml
正解：
解説：
kubesec scan k8s-deployment.yaml
cat <<EOF > kubesec-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: kubesec-demo
spec:
containers:
- name: kubesec-demo
image: gcr.io/google-samples/node-hello:1.0
securityContext:
readOnlyRootFilesystem: true
EOF
kubesec scan kubesec-test.yaml
docker run -i kubesec/kubesec:512c5e0 scan /dev/stdin < kubesec-test.yaml kubesec http 8080 &
[1] 12345
{"severity":"info","timestamp":"2019-05-12T11:58:34.662+0100","caller":"server/server.go:69","message":"Starting HTTP server on port 8080"} curl -sSX POST --data-binary @test/asset/score-0-cap-sys-admin.yml http://localhost:8080/scan
[
{
"object": "Pod/security-context-demo.default",
"valid": true,
"message": "Failed with a score of -30 points",
"score": -30,
"scoring": {
"critical": [
{
"selector": "containers[] .securityContext .capabilities .add == SYS_ADMIN",
"reason": "CAP_SYS_ADMIN is the most privileged capability and should always be avoided"
},
{
"selector": "containers[] .securityContext .runAsNonRoot == true",
"reason": "Force the running image to run as a non-root user to ensure least privilege"
},
// ...
質問 # 61
SIMULATION
On the Cluster worker node, enforce the prepared AppArmor profile
#include <tunables/global>
profile nginx-deny flags=(attach_disconnected) {
#include <abstractions/base>
file,
# Deny all file writes.
deny /** w,
}
EOF'
Edit the prepared manifest file to include the AppArmor profile.
apiVersion: v1
kind: Pod
metadata:
name: apparmor-pod
spec:
containers:
- name: apparmor-pod
image: nginx
Finally, apply the manifests files and create the Pod specified on it.
Verify: Try to make a file inside the directory which is restricted.
正解：A
質問 # 62
Your Kubernetes cluster is configured with a default service account with broad permissions. You need to disable this default service account to enhance security and limit access to cluster resources.
正解：
解説：
Solution (Step by Step):
1. Identify Default Service Account:
- Use the command 'kubectl get serviceaccount -n default default to identify the default service account in the default namespace.
2. Remove Default Service Account:
- You need to remove the default service account using the command 'kubectl delete serviceaccount default -n default
3. Review Permissions Check your RBAC configuration and ensure that no other roles or bindings grant unnecessary permissions to any other service accounts.
4. Create Custom Service Accounts: Create new, dedicated service accounts for each application or component that requires access to the cluster.
Assign specific roles or permissions to each service account based on its requirements.
Note: This process may require changes to your applications or configurations to use the new, dedicated service accounts instead of the default service account.
質問 # 63
......
当社のCKS試験シミュレーションは、多くの専門家によって選ばれ、質問と回答を常に補完および調整します。 CKS学習教材を使用すると、いつでも必要な情報を見つけることができます。 CKS準備の質問を更新するとき、社会の変化を考慮し、ユーザーのフィードバックも引き出します。 CKS学習教材の使用に関してご意見やご意見がありましたら、お知らせください。私たちはあなたとともに成長したいと思っています。CKSトレーニングエンジンの継続的な改善は、最高品質の体験を提供することです。
CKS最新受験攻略: https://www.goshiken.com/Linux-Foundation/CKS-mondaishu.html
BONUS！！！ GoShiken CKSダンプの一部を無料でダウンロード：https://drive.google.com/open?id=10-e_g2JjUdFHb_acObtC7zInLJp1MZxU