BONUS!!! Download part of PrepAwayExam CKS dumps for free: https://drive.google.com/open?id=10egRDLnBIMJQJ5KJm5R315jBwmymD_jt
PrepAwayExam offers authentic and actual CKS dumps that every candidate can rely on for good preparation. Our top priority is to give you the most reliable prep material that helps you pass the CKS Exam on the first attempt. In addition, we offer up to three months of free Certified Kubernetes Security Specialist (CKS) questions updates.
| Certification Vendor: | Linux Foundation |
|---|---|
| Exam Name: | Certified Kubernetes Security Specialist (CKS) Exam |
| Exam Number: | CKS |
| Certificate Validity Period: | 2 years |
| Exam Format: | Terminal-based tasks, Hands-on lab (Kubernetes environment), Performance-based exam |
| Passing Score: | Not publicly disclosed |
| Exam Price: | USD 395 |
| Related Certifications: | Certified Kubernetes Administrator (CKA) Certified Kubernetes Application Developer (CKAD) |
| Real Exam Qty: | Performance-based tasks (no fixed number) |
| Exam Duration: | 120 minutes |
| Available Languages: | English |
| Recommended Training: | CKS Exam Preparation Course Kubernetes Security Essentials (Linux Foundation Training) |
| Exam Registration: | Linux Foundation Candidate Handbook Linux Foundation Certification Page |
| Sample Questions: | Linux Foundation CKS Sample Questions |
| Exam Way: | Online, proctored, remote performance-based exam |
| Pre Condition: | Valid Certified Kubernetes Administrator (CKA) certification is required |
| Official Syllabus URL: | https://training.linuxfoundation.org/certification/certified-kubernetes-security-specialist/ |
PrepAwayExam is a reliable platform to provide candidates with effective study braindumps that have been praised by all users. For find a better job, so many candidate study hard to prepare the Certified Kubernetes Security Specialist (CKS), it is not an easy thing for most people to pass the CKS Exam, therefore, our website can provide you with efficient and convenience learning platform, so that you can obtain as many certificates as possible in the shortest time.
Achieving the CKS Certification is a valuable asset for IT professionals who are responsible for securing Kubernetes clusters. Certified Kubernetes Security Specialist (CKS) certification demonstrates that a candidate has the knowledge and skills to effectively manage the security risks associated with Kubernetes clusters, and can take proactive measures to prevent security breaches. Additionally, the certification can help professionals differentiate themselves in a competitive job market and increase their earning potential.
NEW QUESTION # 34
You have a Kubernetes cluster with a deployment named 'myapp' that serves a web application. You want to secure the application by implementing HTTPS using Ingress and TLS certificates. You have Obtained a TLS certificate from Let's Encrypt and stored it in a Kubernetes secret named 'Ietsencrypt-cert'. Configure an Ingress resource to expose the application on the domain 'myapp.example.com' with HTTPS enabled, using the 'letsencrypt-celt' secret.
Answer:
Explanation:
Solution (Step by Step) :
1. Create a Kubernetes secret for the Let's Encrypt certificate:
- Replace and with the actual certificate and private key data, respectively. 2. Create an Ingress resource:
- Replace 'myapp-service' and '80' with the actual service name and pod number of your application. 3. Apply the Ingress and Secret resources: bash kubectl apply -f letsencrypt-cen.yaml kubectl apply -f myapp-ingress.yaml 4. Verify the Ingress configuration: bash kubectl get ingress myapp-ingress - Check that the Ingress resource has been created and the status is "Ready". 5. Access the application through HTTPS: - You can now access the web application securely through HTTPS using the domain 'myapp.example.com' Note: - Ensure that the 'myapp-service' is created and running before applying the Ingress resource. - Make sure that your cluster has the 'Ingress' controller installed. - If you are using a different Certificate Authority, modify the 'secretName' in the Ingress resource accordingly.
NEW QUESTION # 35
SIMULATION
Fix all issues via configuration and restart the affected components to ensure the new setting takes effect.
Fix all of the following violations that were found against the API server:- a. Ensure that the RotateKubeletServerCertificate argument is set to true.
b. Ensure that the admission control plugin PodSecurityPolicy is set.
c. Ensure that the --kubelet-certificate-authority argument is set as appropriate.
Fix all of the following violations that were found against the Kubelet:- a. Ensure the --anonymous-auth argument is set to false.
b. Ensure that the --authorization-mode argument is set to Webhook.
Fix all of the following violations that were found against the ETCD:-
a. Ensure that the --auto-tls argument is not set to true
b. Ensure that the --peer-auto-tls argument is not set to true
Hint: Take the use of Tool Kube-Bench
Answer:
Explanation:
See the Explanation belowExplanation:
Fix all of the following violations that were found against the API server:- a. Ensure that the RotateKubeletServerCertificate argument is set to true.
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
component: kubelet
tier: control-plane
name: kubelet
namespace: kube-system
spec:
containers:
- command:
- kube-controller-manager
+ - --feature-gates=RotateKubeletServerCertificate=true
image: gcr.io/google_containers/kubelet-amd64:v1.6.0
livenessProbe:
failureThreshold: 8
httpGet:
host: 127.0.0.1
path: /healthz
port: 6443
scheme: HTTPS
initialDelaySeconds: 15
timeoutSeconds: 15
name: kubelet
resources:
requests:
cpu: 250m
volumeMounts:
- mountPath: /etc/kubernetes/
name: k8s
readOnly: true
- mountPath: /etc/ssl/certs
name: certs
- mountPath: /etc/pki
name: pki
hostNetwork: true
volumes:
- hostPath:
path: /etc/kubernetes
name: k8s
- hostPath:
path: /etc/ssl/certs
name: certs
- hostPath:
path: /etc/pki
name: pki
b. Ensure that the admission control plugin PodSecurityPolicy is set.
audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
tests:
test_items:
- flag: "--enable-admission-plugins"
compare:
op: has
value: "PodSecurityPolicy"
set: true
remediation: |
Follow the documentation and create Pod Security Policy objects as per your environment.
Then, edit the API server pod specification file $apiserverconf
on the master node and set the --enable-admission-plugins parameter to a value that includes PodSecurityPolicy :
--enable-admission-plugins=...,PodSecurityPolicy,...
Then restart the API Server.
scored: true
c. Ensure that the --kubelet-certificate-authority argument is set as appropriate.
audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
tests:
test_items:
- flag: "--kubelet-certificate-authority"
set: true
remediation: |
Follow the Kubernetes documentation and setup the TLS connection between the apiserver and kubelets. Then, edit the API server pod specification file
$apiserverconf on the master node and set the --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
--kubelet-certificate-authority=<ca-string>
scored: true
Fix all of the following violations that were found against the ETCD:-
a. Ensure that the --auto-tls argument is not set to true
Edit the etcd pod specification file $etcdconf on the master
node and either remove the --auto-tls parameter or set it to false.
--auto-tls=false
b. Ensure that the --peer-auto-tls argument is not set to true
Edit the etcd pod specification file $etcdconf on the master
node and either remove the --peer-auto-tls parameter or set it to false.
--peer-auto-tls=false
NEW QUESTION # 36
You are tasked with securing the container image supply chain for your organization_ You are using a container registry that supports signing and verification of container images. You need to create a policy that ensures only signed images from a specific trusted source are deployed to your Kubernetes cluster.
Answer:
Explanation:
Solution (Step by Step) :
1. Configure the Container Registry:
- Enable Image Signing: Enable image signing functionality in your container registry (e.g., Docker Hub, Google Container Registry, etc.).
- Create a Signing Key: Generate a signing key and store it securely. This key will be used to sign images from the trusted source.
2 Create a Kubernetes Admission Controller:
- Use an Admission Controller like "Container Image Signature Validation Admission Webhook" to enforce image signature verification during deployment. This Admission Controller ensures that only signed images are allowed to be deployed to your cluster.
3. Configure the Admission Controller:
- Create a Service Account: Create a Service Account with the necessary permissions to access your container registry and verify image signatures.
- Create a Deployment for the Admission Controller: Deploy the Admission Controller with a pod using the Service Account created earlier.
- Configure the Admission Controller: Configure the Admission Controller to use your signing key to verify signatures.
4. Deploy Signed Images:
- Sign Images: Use the signing key to sign images from the trusted source before pushing them to the container registry.
- Deploy Signed Images: Deploy the signed images to your Kubernetes cluster. The Admission Controller will verity their signatures before allowing the deployment.
Example:
This example uses the 'image-signature-validator' container image available on Quay.i0. The 'config.yamr file in the ConfigMap defines the signing key and trusted image sources. Remember to replace these values with your actual information.
NEW QUESTION # 37
You are running a Kubernetes cluster with a deployment named "my-app" that has been experiencing unexpected crashes. The crash logs indicate that the container's memory consumption is exceeding the resource limits defined in the deployment YAML. Explain how you can utilize the Kubernetes resource quotas and admission controller to prevent this from happening again.
Answer:
Explanation:
Solution (Step by Step) :
1. Create a ResourceQuota:
- Define a ResourceQuota that limits the resources that can be consumed by pods in a specific namespace.
- Specify the limits for CPU, memory, storage, and other resources.
- For example, to limit memory usage to 2Gi per pod in the "my-app" namespace:
2. Enable the Resourceauota Admission Controller: - Ensure that the "Resourceauota" admission controller is enabled in your Kubernetes cluster. This can usually be done by setting the 'admissioncontror flag in the 'kube-apiserver' configuration. 3. Apply the ResourceQuota: - Apply the ResourceQuota to the "my-app" namespace using 'kubectl apply -f resource-quota_yaml 4. Update the Deployment - Modify the deployment's YAML file to specify the resource requests and limits for the container, ensuring they are within the defined ResourceQuota limits. For example:
5. Apply the updated deployment - Apply the updated deployment using 'kubectl apply -f deployment.yaml' 6. Monitor and Evaluate: - Monitor the resource consumption of pods in the "my-app" namespace and adjust the ResourceQuota limits as needed to ensure that your cluster remains stable.
NEW QUESTION # 38
SIMULATION
Documentation Deployments, Pods, bom Command Help bom-help
You must connect to the correct host. Failure to do so may result in a zero score.
[candidate@base] $ ssh cks000035
Task
The alpine Deployment in the alpine namespace has three containers that run different versions of the alpine image.
First, find out which version of the alpine image contains the libcrypto3 package at version 3.1.4-r5.
Next, use the pre-installed bom tool to create an SPDX document for the identified image version at /home/candidate/alpine.spdx.
You can find the bom tool documentation at bom.
Finally, update the alpine Deployment and remove the container that uses the idenfied image version.
The Deployment's manifest file can be found at /home/candidate/alpine-deployment.yaml.
Do not modify any other containers of the Deployment.
Answer:
Explanation:
See the Explanation below for complete solution
Explanation:
1) Connect to the correct host
ssh cks000035
sudo -i
export KUBECONFIG=/etc/kubernetes/admin.conf
2) List the 3 container names + images in the Deployment
kubectl -n alpine get deploy alpine -o jsonpath='{range .spec.template.spec.containers[*]}{.name}{"\t"}{.image}{"\n"}{end}' You'll get 3 lines like:
c1 alpine:3.xx
c2 alpine:3.yy
c3 alpine:3.zz
3) Identify which alpine image has libcrypto3 at 3.1.4-r5
Fastest reliable method (since it's Alpine, just query apk inside each image):
Run these one-by-one for each image you saw in step 2:
docker run --rm <ALPINE_IMAGE_1> sh -c 'apk info -v libcrypto3 2>/dev/null | head -n1' docker run --rm <ALPINE_IMAGE_2> sh -c 'apk info -v libcrypto3 2>/dev/null | head -n1' docker run --rm <ALPINE_IMAGE_3> sh -c 'apk info -v libcrypto3 2>/dev/null | head -n1'
✅ The correct image is the one that prints exactly:
libcrypto3-3.1.4-r5
Note that full image tag, e.g.:
IMG=alpine:3.xx
4) Create SPDX document with bom for that identified image
(Use the identified image from step 3.)
bom generate --image $IMG --format spdx --output /home/candidate/alpine.spdx Verify file exists:
ls -l /home/candidate/alpine.spdx
5) Remove ONLY the container that uses that image version
The manifest to edit is:
vi /home/candidate/alpine-deployment.yaml
In the spec.template.spec.containers: list, find the container entry whose image: equals the identified $IMG, and delete that one container block only (name/image/ports/etc for that container).
Save:
:wq
6) Apply the updated Deployment (do not change other containers)
kubectl apply -f /home/candidate/alpine-deployment.yaml
Wait rollout:
kubectl -n alpine rollout status deployment/alpine
7) Verify only 2 containers remain
kubectl -n alpine get deploy alpine -o jsonpath='{range .spec.template.spec.containers[*]}{.name}{"\t"}{.image}{"\n"}{end}' You should now see 2 lines, and the $IMG line should be gone.
If bom generate ... errors (quick fix)
Check exact syntax on that system:
bom --help
bom generate --help
Then rerun with the flags it expects, keeping:
image = $IMG
output = /home/candidate/alpine.spdx
format = spdx
NEW QUESTION # 39
......
Valid Dumps CKS Book: https://www.prepawayexam.com/Linux-Foundation/braindumps.CKS.ete.file.html
BTW, DOWNLOAD part of PrepAwayExam CKS dumps from Cloud Storage: https://drive.google.com/open?id=10egRDLnBIMJQJ5KJm5R315jBwmymD_jt