BONUS!!! Itcertkr CKS 시험 문제집 전체 버전을 무료로 다운로드하세요: https://drive.google.com/open?id=1O-KdSfKQkVY1tPi9v7ED5L2JobpBJGSJ
Itcertkr는 저희 제품을 구매한 분들이 100%통과율을 보장해드리도록 최선을 다하고 있습니다. Itcertkr를 선택한것은 시험패스와 자격증취득을 예약한것과 같습니다. Itcertkr의 믿음직한 Linux Foundation인증 CKS덤프를 공부해보세요.
시험은 액세스 제어, 네트워크 보안, 클러스터 강화, 인증 및 권한, 그리고 모니터링 및 로깅을 포함한 Kubernetes 보안의 다양한 측면을 다룹니다. 후보자들은 실제 상황에서 보안 문제를 분석하고 해결할 수 있는 능력을 테스트하는 실무 기반 시나리오 문제의 일련의 질문을 통해 이러한 주제에 대한 지식을 증명해야 합니다.
Linux Foundation CKS (Certified Kubernetes Security Specialist) 인증 시험은 컨테이너화 된 응용 프로그램 및 Kubernetes 플랫폼 보안에 대한 개인의 기술과 지식을 검증하는 전문 인증입니다. 이 시험은 Kubernetes 및 Containization에 대한 경험이 있고 안전한 컨테이너 오케스트레이션에 대한 전문 지식을 보여줌으로써 경력을 발전시키려는 전문가를 위해 설계되었습니다.
Itcertkr전문가들은Linux Foundation CKS인증시험만을 위한 특별학습가이드를 만들었습니다.Linux Foundation CKS인증시험을 응시하려면 30분이란 시간만 투자하여 특별학습가이드로 빨리 관련지식을 장악하고,또 다시 복습하고 안전하게Linux Foundation CKS인증시험을 패스할 수 잇습니다.자격증취득 많은 시간과 돈을 투자한 분들보다 더 가볍게 이루어졌습니다
Linux Foundation CKS 인증은 Kubernetes 환경 보안에 대한 전문 지식을 보여 주려는 IT 전문가에게 귀중한 자격 증명입니다. 인증 된 Kubernetes 보안 전문가는 수요가 높으며 CKS 인증은 개인이 경력을 발전시키고 수입 잠재력을 높이는 데 도움이 될 수 있습니다. 인증은 또한 조직에 자격을 갖춘 전문가가 Kubernetes 환경을 관리하고 확보하고 있다는 확신을 제공합니다.
질문 # 49
SIMULATION
You can switch the cluster/configuration context using the following command:
[desk@cli] $ kubectl config use-context stage
Context:
A PodSecurityPolicy shall prevent the creation of privileged Pods in a specific namespace.
Task:
1. Create a new PodSecurityPolcy named deny-policy, which prevents the creation of privileged Pods.
2. Create a new ClusterRole name deny-access-role, which uses the newly created PodSecurityPolicy deny-policy.
3. Create a new ServiceAccount named psd-denial-sa in the existing namespace development.
Finally, create a new ClusterRoleBindind named restrict-access-bind, which binds the newly created ClusterRole deny-access-role to the newly created ServiceAccount psp-denial-sa
정답：
설명：
See the Explanation belowExplanation:
Create psp to disallow privileged container
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: deny-access-role
rules:
- apiGroups: ['policy']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames:
- "deny-policy"
k create sa psp-denial-sa -n development
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: restrict-access-bing
roleRef:
kind: ClusterRole
name: deny-access-role
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: psp-denial-sa
namespace: development
Explanation:
master1 $ vim psp.yaml
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: deny-policy
spec:
privileged: false # Don't allow privileged pods!
seLinux:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
runAsUser:
rule: RunAsAny
fsGroup:
rule: RunAsAny
volumes:
- '*'
master1 $ vim cr1.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: deny-access-role
rules:
- apiGroups: ['policy']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames:
- "deny-policy"
master1 $ k create sa psp-denial-sa -n development
master1 $ vim cb1.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: restrict-access-bing
roleRef:
kind: ClusterRole
name: deny-access-role
apiGroup: rbac.authorization.k8s.io
subjects:
# Authorize specific service accounts:
- kind: ServiceAccount
name: psp-denial-sa
namespace: development
master1 $ k apply -f psp.yaml
master1 $ k apply -f cr1.yaml
master1 $ k apply -f cb1.yaml
질문 # 50
You are managing a Kubernetes cluster where workloads are spread across multiple nodes- You want to configure Pod Security Policies PSPS to restrict the use of privileged containers and limit the ca abilities of containers running within your cluster.
정답：
설명：
Solution (Step by Step) :
1. Create a Pod Security Policy:
- Create a PSP YAML file named restricted-psp.ya'r:
2. Apply the Pod Security Policy: - Apply the PSP using 'kubectl apply -f restricted-psp.yaml' 3. Create a Deployment using the PSP: - Create a new deployment YAML file named 'test-deployment.yamr that specifies the 'restricted-psp' for the pod's security context:
4. Apply the Deployment: - Apply the deployment using 'kubectl apply -f test-deployment.yaml 5. Test the Restrictions: - Try creating a pod that violates the PSP, for example, using a privileged container. The pod should fail to be created due to the PSP enforcement - Try running a command within a using the deployment that uses the PSP. You should be able to run commands but may have limitations based on the capabilities allowed by the PSP.
질문 # 51
You are running a Kubernetes cluster with a deployment named "my-app" that uses a container image from a public registry. You suspect that a recent deployment update may have introduced a vulnerability in one of the containers. Describe how you can use container image scanning tools like Trivy to identify and address the vulnerability.
정답：
설명：
Solution (Step by Step) :
1. Install and Configure Trivy:
- Install Trivy on your system or Within your Kubernetes cluster. Trivy is a versatile vulnerability scanner that can scan container images, filesystems, and applications.
2. Scan the Container Image:
- Run Trivy against the container image used by the "my-app" deployment.
bash
trivy image example/nginx:latest
3. Analyze the Scan Results:
- Review the Trivy scan report, which will list any vulnerabilities detected in the container image. The report will provide information like the vulnerability's severity, description, and potential impact.
4. Address the Vulnerability:
- If vulnerabilities are discovered, take appropriate actions to mitigate the risk. This could involve:
- Updating the Container Image: If a newer version of the container image is available with the vulnerability patched, update the deployment to use the updated image.
- Implementing Security Measures: Consider implementing additional security controls within your containers, such as restricting network access, limiting container privileges, or using security-enhancing tools.
- Accepting the Risk: If the vulnerability is deemed low risk and updating or mitigating it is not feasible, you may choose to accept the risk and monitor the vulnerability closely.
5. Integrate with CI/CD Pipeline:
- Integrate Trivy into your CI/CD pipeline to automatically scan container images before they are deployed to your Kubernetes cluster. This helps to catch vulnerabilities early and prevents them from being introduced into your production environment.
질문 # 52
SIMULATION
Before Making any changes build the Dockerfile with tag base:v1
Now Analyze and edit the given Dockerfile(based on ubuntu 16:04)
Fixing two instructions present in the file, Check from Security Aspect and Reduce Size point of view.
Dockerfile:
FROM ubuntu:latest
RUN apt-get update -y
RUN apt install nginx -y
COPY entrypoint.sh /
RUN useradd ubuntu
ENTRYPOINT ["/entrypoint.sh"]
USER ubuntu
entrypoint.sh
#!/bin/bash
echo "Hello from CKS"
After fixing the Dockerfile, build the docker-image with the tag base:v2 To Verify: Check the size of the image before and after the build.
정답：A
질문 # 53
You have a Kubernetes cluster running an application with multiple deployments. You want to implement RBAC rules to ensure that only specific users can manage the deployments belonging to their respective teams. For instance, the "dev" team should only be able to manage deployments With the label 'team: dev' , while the "ops" team should only manage deployments With the label steam: 'ops'.
정답：
설명：
Solution (Step by Step) :
1. Create Role for Each Team:
- dev-role.yaml:
- ops-role_yaml:
2. Create RoleBindings for Each Team: - dev-rolebinding.yaml:
- ops-rolebinding.yaml:
3. Apply the Roles and RoleBindings: - Apply the YAML files using kubectl apply -f dev-role.yaml dev-rolebinding.yaml ops-role.yaml ops-rolebinding.yamr 4. Create Test Deployments (with Team Labels): - Create a deployment labeled with steam: devs and another labeled with 'team: ops'. You can use 'kubectl create deployment with the appropriate label. 5. Verify RBAC Permissions: - Log in as the "dev" user and attempt to manage the "dev" team deployment. - Log in as the "ops" user and attempt to manage the "ops" team deployment - The users should only be able to access the deployments belonging to their respective teams.
질문 # 54
......
CKS최고품질 덤프샘플문제: https://www.itcertkr.com/CKS_exam.html
Itcertkr CKS 최신 PDF 버전 시험 문제집을 무료로 Google Drive에서 다운로드하세요: https://drive.google.com/open?id=1O-KdSfKQkVY1tPi9v7ED5L2JobpBJGSJ