BONUS!!! Download part of PDFTorrent CKS dumps for free: https://drive.google.com/open?id=1ojCe7WapPCVFN6ESetDfSNqJ20XgifPF
In fact, sticking to a resolution will boost your sense of self-esteem and self-control. So our CKS exam materials can become your new aim. Our CKS study materials could make a difference to your employment prospects. Getting rewards need to create your own value to your company. However, your capacity for work directly proves your value. As long as you get your CKS Certification with our CKS practice braindumps, you will have a better career for sure.
| Section | Weight | Objectives |
|---|---|---|
| Cluster Hardening | 15% | - API access restriction - Component updates & vulnerability mitigation - Service account security - RBAC configuration |
| Monitoring, Logging and Runtime Security | 20% | - Threat detection (Falco) - Audit log configuration - Behavioral analytics - Container immutability - Incident investigation |
| Supply Chain Security | 20% | - Signed artifacts & verification - SBOM & CI/CD security - Permitted registries - Static analysis tools - Image security & scanning |
| System Hardening | 10% | - Network access control - Least privilege IAM - Kernel hardening (AppArmor, seccomp) - Minimize OS attack surface |
| Minimize Microservice Vulnerabilities | 20% | - Secret management - Pod Security Standards - Security contexts - OPA/Gatekeeper implementation - Isolation & multi-tenancy |
| Cluster Setup | 15% | - CIS benchmark compliance - Node metadata protection - Secure Ingress configuration - Network security policies - Binary verification |
Information about Linux Foundation CKS Exam: Visit PDFTorrent and find out the best features of updated Linux Foundation CKS exam dumps that is available in three user-friendly formats. We guarantee that you will be able to ace the CKS examination on the first attempt by studying with our actual CKS exam questions.
NEW QUESTION # 17
You are responsible for securing the Kubernetes clusters supply chain. You want to ensure that only images from trusted registries are allowed to be deployed to the cluster. How would you configure Kubernetes to restrict deployments to only images from specific registries?
Answer:
Explanation:
Solution (Step by Step) :
1. Create a Pod Security Policy (PSP):
- A PSP is a policy that enforces security restrictions on pods. You can define the allowed registries for image pulls within the PSP
- create a PSP YAML file:
2. Define Allowed Registries: - Within the 'spec' of your PSP, create a field 'seLinux' and then define the allowed registries within the 'seLinux' field. - Example:
3. Apply the PSP: - Apply the PSP to your cluster using 'kubectl apply -f restricted-registry-psp.yaml' 4. Create a Service Account: - Create a service account that will be allowed to run pods with this PSP:
5. Bind the PSP to the Service Account: - Add the 'securityContext' field to your deployment and specify the PSP you just created:
- Apply the deployment: bash kubectl apply -f deploymentyaml - Now, the deployment will only be able to pull images from the specified registry.
NEW QUESTION # 18
Use the kubesec docker images to scan the given YAML manifest, edit and apply the advised changes, and passed with a score of 4 points.
kubesec-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: kubesec-demo
spec:
containers:
- name: kubesec-demo
image: gcr.io/google-samples/node-hello:1.0
securityContext:
readOnlyRootFilesystem: true
Hint: docker run -i kubesec/kubesec:512c5e0 scan /dev/stdin < kubesec-test.yaml
Answer:
Explanation:
kubesec scan k8s-deployment.yaml
cat <<EOF > kubesec-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: kubesec-demo
spec:
containers:
- name: kubesec-demo
image: gcr.io/google-samples/node-hello:1.0
securityContext:
readOnlyRootFilesystem: true
EOF
kubesec scan kubesec-test.yaml
docker run -i kubesec/kubesec:512c5e0 scan /dev/stdin < kubesec-test.yaml kubesec http 8080 &
[1] 12345
{"severity":"info","timestamp":"2019-05-12T11:58:34.662+0100","caller":"server/server.go:69","message":"Starting HTTP server on port 8080"} curl -sSX POST --data-binary @test/asset/score-0-cap-sys-admin.yml http://localhost:8080/scan
[
{
"object": "Pod/security-context-demo.default",
"valid": true,
"message": "Failed with a score of -30 points",
"score": -30,
"scoring": {
"critical": [
{
"selector": "containers[] .securityContext .capabilities .add == SYS_ADMIN",
"reason": "CAP_SYS_ADMIN is the most privileged capability and should always be avoided"
},
{
"selector": "containers[] .securityContext .runAsNonRoot == true",
"reason": "Force the running image to run as a non-root user to ensure least privilege"
},
// ...
NEW QUESTION # 19
You are deploying a critical application on your Kubernetes cluster. You want to ensure that only certified and trusted container images are allowed to be deployed- How can you implement an Image Signature Verification process to ensure that all images pulled from your Docker registry are signed with a trusted key?
Answer:
Explanation:
Solution (Step by Step) :
1. Generate Key Pair: Generate a public and private key pair for signing container images.
bash
openssl genrsa -out private-key 2048
openssl rsa -pubout -in private-key -out public-key
2. Sign Container Image: use the private key to sign the container image-
bash
docker build -t my-app:latest
cosign Sign --key private.key my-app:latest
3. Push Signed Image: Push the signed image to your Docker registry.
bash
docker push my-app:latest
4. Configure Kubernetes Image Policy: Configure a Kubernetes ImagePolicyWebhook using a tool like Admission Webhook Controller to enforce image signature verification. The webhook can be configured to check for the presence of a valid signature using the public key and to reject images without a valid signature.
5. Deploy Image Policy Webhook: Deploy the ImagePolicyWebhook configuration using 'kubectl apply -f image-policy-webhook.yamr 6. Test Image Signature Verificatiom Create a new Deployment using an unsigned image. The deployment should be rejected by the webhook.
Note: This is a basic example. You can configure more advanced image signature verification policies based on your security needs and requirements. For example, you can enforce specific image signing policies, use multiple keys, and configure different failure policies.
NEW QUESTION # 20
You can switch the cluster/configuration context using the following command: [desk@cli] $ kubectl config use-context test-account Task: Enable audit logs in the cluster.
To do so, enable the log backend, and ensure that:
1. logs are stored at /var/log/Kubernetes/logs.txt
2. log files are retained for 5 days
3. at maximum, a number of 10 old audit log files are retained
A basic policy is provided at /etc/Kubernetes/logpolicy/audit-policy.yaml. It only specifies what not to log. Note: The base policy is located on the cluster's master node.
Edit and extend the basic policy to log: 1. Nodes changes at RequestResponse level 2. The request body of persistentvolumes changes in the namespace frontend 3. ConfigMap and Secret changes in all namespaces at the Metadata level Also, add a catch-all rule to log all other requests at the Metadata level Note: Don't forget to apply the modified policy.
Answer:
Explanation:
$ vim /etc/kubernetes/log-policy/audit-policy.yaml
- level: RequestResponse
userGroups: ["system:nodes"]
- level: Request
resources:
- group: "" # core API group
resources: ["persistentvolumes"]
namespaces: ["frontend"]
- level: Metadata
resources:
- group: ""
resources: ["configmaps", "secrets"]
- level: Metadata
$ vim /etc/kubernetes/manifests/kube-apiserver.yaml Add these
- --audit-policy-file=/etc/kubernetes/log-policy/audit-policy.yaml
- --audit-log-path=/var/log/kubernetes/logs.txt
- --audit-log-maxage=5
- --audit-log-maxbackup=10
Explanation
[desk@cli] $ ssh master1 [master1@cli] $ vim /etc/kubernetes/log-policy/audit-policy.yaml apiVersion: audit.k8s.io/v1 # This is required.
kind: Policy
# Don't generate audit events for all requests in RequestReceived stage.
omitStages:
- "RequestReceived"
rules:
# Don't log watch requests by the "system:kube-proxy" on endpoints or services
- level: None
users: ["system:kube-proxy"]
verbs: ["watch"]
resources:
- group: "" # core API group
resources: ["endpoints", "services"]
# Don't log authenticated requests to certain non-resource URL paths.
- level: None
userGroups: ["system:authenticated"]
nonResourceURLs:
- "/api*" # Wildcard matching.
- "/version"
# Add your changes below
- level: RequestResponse
userGroups: ["system:nodes"] # Block for nodes
- level: Request
resources:
- group: "" # core API group
resources: ["persistentvolumes"] # Block for persistentvolumes
namespaces: ["frontend"] # Block for persistentvolumes of frontend ns
- level: Metadata
resources:
- group: "" # core API group
resources: ["configmaps", "secrets"] # Block for configmaps & secrets
- level: Metadata # Block for everything else
[master1@cli] $ vim /etc/kubernetes/manifests/kube-apiserver.yaml
apiVersion: v1
kind: Pod
metadata:
annotations:
kubeadm.kubernetes.io/kube-apiserver.advertise-address.endpoint: 10.0.0.5:6443 labels:
component: kube-apiserver
tier: control-plane
name: kube-apiserver
namespace: kube-system
spec:
containers:
- command:
- kube-apiserver
- --advertise-address=10.0.0.5
- --allow-privileged=true
- --authorization-mode=Node,RBAC
- --audit-policy-file=/etc/kubernetes/log-policy/audit-policy.yaml #Add this
- --audit-log-path=/var/log/kubernetes/logs.txt #Add this
- --audit-log-maxage=5 #Add this
- --audit-log-maxbackup=10 #Add this
...
output truncated
Note: log volume & policy volume is already mounted in vim /etc/kubernetes/manifests/kube-apiserver.yaml so no need to mount it. Reference: https://kubernetes.io/docs/tasks/debug-application-cluster/audit/
NEW QUESTION # 21
You are tasked with securing a Kubernetes cluster running kube-dns. You need to enforce the CIS Kubernetes Benchmark recommendations for kube-dns. One of the key recommendations is to disable the '-bind-address-0.0.0.0' parameter from the kube-dns deployment. This parameter allows kube-dns to listen on all network interfaces, potentially exposing the DNS service to unwanted access. How would you achieve this using a ConfigMap?
Answer:
Explanation:
Solution (Step by Step) :
1. Create a ConfigMap: Create a ConfigMap named 'kube-dns-config' containing the updated configuration for kube-dns. This ConfigMap will replace the default kube-dns configuration.
2 Apply the ConfigMap: Apply the ConfigMap to the cluster using 'kubectl apply -f kube-dns-config-yaml'. This will create the ConfigMap and update the kube-dns deployment. 3. Verify the Deployment: Verify that the kube-dns deployment has been updated with the new configuration. Use 'kubectl get deployment kube-dns -o yaml' to see the deployment configuration, and Check tor the "-bind-address=127.O.O.1 ' parameter in the container's command. 4. Restart the kube-dns Pods: Restart the kube-dns pods to ensure the changes take effect This can be done using the 'kubectl rollout restart deployment kube-dns' command. This change will ensure that kube-dns is only listening on the localhost interface (127.0.0.1), mitigating the risk of unauthorized access.
NEW QUESTION # 22
......
Now it is a society of abundant capable people, and there are still a lot of industry is lack of talent, such as the IT industry is quite lack of technical talents. Linux Foundation certification CKS exam is one of testing IT technology certification exams. PDFTorrent is a website which provide you a training about Linux Foundation Certification CKS Exam related technical knowledge.
CKS Test Questions: https://www.pdftorrent.com/CKS-exam-prep-dumps.html
DOWNLOAD the newest PDFTorrent CKS PDF dumps from Cloud Storage for free: https://drive.google.com/open?id=1ojCe7WapPCVFN6ESetDfSNqJ20XgifPF