DOWNLOAD the newest Itcertmaster CKS PDF dumps from Cloud Storage for free: https://drive.google.com/open?id=1FsFu069mvgSqw4NMR1fSNsOAt0LIiPan
Use this CKS practice material to ensure your exam preparation is successful. Mock exams at Itcertmaster are available in CKS desktop software and web-based format. Both Linux Foundation CKS self-assessment exams have similar features. They create an Linux Foundation CKS actual test-like scenario, point out your mistakes, and offer customizable sessions.
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Cluster Setup | 15% | - Hardening cluster components - Secure installation configuration |
| Topic 2: Supply Chain Security | 20% | - Secure CI/CD practices - Image scanning and verification |
| Topic 3: Monitoring, Logging and Runtime Security | 15% | - Audit logging and monitoring - Runtime threat detection |
| Topic 4: System Hardening | 15% | - Kernel and node security configuration - Host security controls |
| Topic 5: Cluster Hardening | 15% | - API server security - Authentication and authorization |
| Topic 6: Minimizing Microservice Vulnerabilities | 20% | - Pod security standards - Container isolation and security contexts |
We all know the effective diligence is in direct proportion to outcome, so by years of diligent work, our experts have collected the frequent-tested knowledge into our CKS practice materials for your reference. So our CKS training materials are triumph of their endeavor. By resorting to our CKS practice materials, we can absolutely reap more than you have imagined before. We have clear data collected from customers who chose our CKS actual tests, the passing rate is 98-100 percent. So your chance of getting success will be increased greatly by our materials.
NEW QUESTION # 40
Service is running on port 389 inside the system, find the process-id of the process, and stores the names of all the open-files inside the /candidate/KH77539/files.txt, and also delete the binary.
Answer:
Explanation:
root# netstat -ltnup
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:17600 0.0.0.0:* LISTEN 1293/dropbox tcp 0 0 127.0.0.1:17603 0.0.0.0:* LISTEN 1293/dropbox tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 575/sshd tcp 0 0 127.0.0.1:9393 0.0.0.0:* LISTEN 900/perl tcp 0 0 :::80 :::* LISTEN 9583/docker-proxy tcp 0 0 :::443 :::* LISTEN 9571/docker-proxy udp 0 0 0.0.0.0:68 0.0.0.0:* 8822/dhcpcd
...
root# netstat -ltnup | grep ':22'
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 575/sshd
The ss command is the replacement of the netstat command.
Now let's see how to use the ss command to see which process is listening on port 22:
root# ss -ltnup 'sport = :22'
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:("sshd",pid=575,fd=3))
NEW QUESTION # 41
SIMULATION
Context
A PodSecurityPolicy shall prevent the creation of privileged Pods in a specific namespace.
Task
Create a new PodSecurityPolicy named prevent-psp-policy,which prevents the creation of privileged Pods.
Create a new ClusterRole named restrict-access-role, which uses the newly created PodSecurityPolicy prevent-psp-policy.
Create a new ServiceAccount named psp-restrict-sa in the existing namespace staging.
Finally, create a new ClusterRoleBinding named restrict-access-bind, which binds the newly created ClusterRole restrict-access-role to the newly created ServiceAccount psp-restrict-sa.
Answer:
Explanation:
See the Explanation below
Explanation:
NEW QUESTION # 42
SIMULATION
Cluster: qa-cluster
Master node: master Worker node: worker1
You can switch the cluster/configuration context using the following command:
[desk@cli] $ kubectl config use-context qa-cluster
Task:
Create a NetworkPolicy named restricted-policy to restrict access to Pod product running in namespace dev.
Only allow the following Pods to connect to Pod products-service:
1. Pods in the namespace qa
2. Pods with label environment: stage, in any namespace
Answer:
Explanation:
See the Explanation belowExplanation:
NEW QUESTION # 43
You are building a custom Kubernetes distribution for your organization- Establish a secure process for building and verifying the integrity of the Kubernetes binaries included in your distribution.
Answer:
Explanation:
Solution (Step by Step):
1. Build Kubernetes from source: Build the Kubernetes binaries from the official source code repository (httpswgithub.com/kubernetes/kubernetesl
(https://wwwgoogle.com/url?sa=E&source=gmail&q=https://github.com/kubernetes/kubernetes))- Use a clean build environment and a trusted source for the source code.
2. Implement reproducible builds: Use a build system that supports reproducible builds, such as Bazel or Buildah- This ensures that the same source code always produces the same binary output.
3. Generate and verify checksums: Generate SHA-256 checksums for all built binaries and store them securely. Verity the checksums of the binaries before including them in your distribution.
4. Sign the binaries: Use a code signing certificate to sign the binaries. This allows users to verify the authenticity and integrity of the binaries-
5. Publish the binaries and signatures: Publish the binaries and corresponding signatures in a secure repository. Provide clear instructions for users to
verify the signatures before using the binaries-
6. Use a trusted CI/CD system: use a trusted and secure CI/CD system to automate the build and verification process. This helps to ensure the integrity and security of the build pipeline.
NEW QUESTION # 44
Use the kubesec docker images to scan the given YAML manifest, edit and apply the advised changes, and passed with a score of 4 points.
kubesec-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: kubesec-demo
spec:
containers:
- name: kubesec-demo
image: gcr.io/google-samples/node-hello:1.0
securityContext:
readOnlyRootFilesystem: true
Hint: docker run -i kubesec/kubesec:512c5e0 scan /dev/stdin < kubesec-test.yaml
Answer:
Explanation:
kubesec scan k8s-deployment.yaml
cat <<EOF > kubesec-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: kubesec-demo
spec:
containers:
- name: kubesec-demo
image: gcr.io/google-samples/node-hello:1.0
securityContext:
readOnlyRootFilesystem: true
EOF
kubesec scan kubesec-test.yaml
docker run -i kubesec/kubesec:512c5e0 scan /dev/stdin < kubesec-test.yaml kubesec http 8080 &
[1] 12345
{"severity":"info","timestamp":"2019-05-12T11:58:34.662+0100","caller":"server/server.go:69","message":"Starting HTTP server on port 8080"} curl -sSX POST --data-binary @test/asset/score-0-cap-sys-admin.yml http://localhost:8080/scan
[
{
"object": "Pod/security-context-demo.default",
"valid": true,
"message": "Failed with a score of -30 points",
"score": -30,
"scoring": {
"critical": [
{
"selector": "containers[] .securityContext .capabilities .add == SYS_ADMIN",
"reason": "CAP_SYS_ADMIN is the most privileged capability and should always be avoided"
},
{
"selector": "containers[] .securityContext .runAsNonRoot == true",
"reason": "Force the running image to run as a non-root user to ensure least privilege"
},
// ...
NEW QUESTION # 45
......
For further and better consolidation of your learning on our CKS exam questions, our company offers an interactive test engine-Software test engine. And this version is also popular for the advantage of silulating the real CKS exam. Please pay attention to the point that the Software version of our CKS praparation guide can only apply in the Windows system. When you are practicing with it, you will find that every time you finished the exam, the exam scores will come out.
Valid Test CKS Experience: https://www.itcertmaster.com/CKS.html
BTW, DOWNLOAD part of Itcertmaster CKS dumps from Cloud Storage: https://drive.google.com/open?id=1FsFu069mvgSqw4NMR1fSNsOAt0LIiPan