Welcome to KillTest.com

TOP Exams

Want to practice some free The Linux Foundation CKS exam questions? You can study the following The Linux Foundation CKS exam online questions. Killtest provides 44 Q&As for The Linux Foundation CKS exam, which has been proven effective in the CKS exam preparation. Besides, you can get full payment fee refund if you fail CKS exam by using Killtest CKS practice exam questions. Ready? Go!

 Get CKS with 44 Q&As

The Linux Foundation CKS Online Practice Exam Questions

The questions of CKS were last updated on May 23,2022 .

Viewing page 1 out of 5 pages.

Viewing questions 1 out of 27 questions

Question#1

Create the Pod using this manifest

A. [[email protected]] $ ssh worker1[[email protected]] $apparmor_parser -q /etc/apparmor.d/nginx[[email protected]] $aa-status | grep nginxnginx-profile-1[[email protected]] $ logout[[email protected]] $vim nginx-deploy.yamlAdd these lines under metadata:annotations: # Add this line container.apparmor.security.beta.kubernetes.io/<container-name>: localhost/nginx-profile-1[[email protected]] $kubectl apply -f nginx-deploy.yaml
Explanation[[email protected]] $ ssh worker1[[email protected]] $apparmor_parser -q /etc/apparmor.d/nginx[[email protected]] $aa-status | grep nginxnginx-profile-1[[email protected]] $ logout[[email protected]] $vim nginx-deploy.yaml



Text
Description automatically generated

Question#2

CORRECT TEXT
Fix all issues via configuration and restart the affected components to ensure the new setting takes effect.
Fix all of the following violations that were found against the API server:-
✑ a. Ensure that the RotateKubeletServerCertificate argumentissettotrue.
✑ b. Ensure that the admission control plugin PodSecurityPolicyisset.
✑ c. Ensure that the --kubelet-certificate-authority argumentissetasappropriate.
Fix all of the following violations that were found against the Kubelet:-
✑ a. Ensure the --anonymous-auth argumentissettofalse.
✑ b. Ensure that the --authorization-mode argumentissetto Webhook.
Fix all of the following violations that were found against the ETCD:-
✑ a. Ensure that the --auto-tls argumentisnotsettotrue
✑ b. Ensure that the --peer-auto-tls argumentisnotsettotrue
Hint: Take the use of Tool Kube-Bench

A. Fix all of thefollowing violations that were found against the API server:-
✑ a. Ensure that the RotateKubeletServerCertificate argumentissettotrue.
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
component:kubelet
tier: control-plane
name: kubelet
namespace: kube-system
spec:
containers:
- command:
- kube-controller-manager
+ - --feature-gates=RotateKubeletServerCertificate=true image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe:
failureThreshold: 8 httpGet:
host: 127.0.0.1
path: /healthz
port: 6443
scheme: HTTPS
initialDelaySeconds: 15
timeoutSeconds: 15
name:kubelet
resources:
requests:
cpu: 250m
volumeMounts:
- mountPath: /etc/kubernetes/ name: k8s
readOnly: true
- mountPath: /etc/ssl/certs name: certs
- mountPath: /etc/pki name:pki hostNetwork: true volumes:
- hostPath:
path: /etc/kubernetes
name: k8s
- hostPath:
path: /etc/ssl/certs
name: certs
- hostPath: path: /etc/pki name: pki
✑ b. Ensure that theadmission control plugin PodSecurityPolicyisset.
audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
tests:
test_items:
- flag: "--enable-admission-plugins"
compare:
op: has
value:"PodSecurityPolicy"
set: true
remediation: |
Follow the documentation and create Pod Security Policy objects as per your environment. Then, edit the API server pod specification file $apiserverconf
on themaster node and set the --enable-admission-plugins parameter to a
value that includes PodSecurityPolicy :
--enable-admission-plugins=...,PodSecurityPolicy,...
Then restart the API Server.
scored: true
✑ c. Ensure thatthe --kubelet-certificate-authority argumentissetasappropriate.
audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
tests:
test_items:
- flag: "--kubelet-certificate-authority" set: true
remediation: |
Follow the Kubernetes documentation and setup the TLS connection between the apiserver and kubelets. Then, edit the API server pod specification file $apiserverconf on the master node and set the --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. --kubelet-certificate-authority=<ca-string>
scored: true
Fix all of the following violations that were found against the ETCD:-
✑ a. Ensurethat the --auto-tls argumentisnotsettotrue
Edit the etcd pod specification file $etcdconf on the masternode and either remove the -- auto-tls parameter or set it to false.--auto-tls=false
✑ b. Ensure that the --peer-auto-tls argumentisnotsettotrue
Edit the etcd pod specification file $etcdconf on the masternode and either remove the -- peer-auto-tls parameter or set it to false.--peer-auto-tls=false

Question#3

sysdig
Tools are pre-installed on the worker1 node only.
Analyse the container’s behaviour for at least 40 seconds, using filters that detect newly spawning and executing processes.
Store an incident file at /home/cert_masters/report, in the following format:
[timestamp],[uid],[processName]
Note: Make sure to store incident file on the cluster's worker node, don't move it to master node.

A. $vim /etc/falco/falco_rules.local.yaml
[email protected] $kill -1 <PID of falco>
Explanation[[email protected]] $ ssh node01[[email protected]] $ vim /etc/falco/falco_rules.yamlsearch for Container Drift Detected & paste in falco_rules.local.yaml[[email protected]] $ vim /etc/falco/falco_rules.local.yaml
- rule: Container Drift Detected (open+create)
desc: New executable created in a container due to open+create
condition: >
evt.type in (open,openat,creat) and
evt.is_open_exec=true and
container and
not runc_writing_exec_fifo and
not runc_writing_var_lib_docker and
not user_known_container_drift_activities and
evt.rawres>=0
output: >
%evt.time,%user.uid,%proc.name # Add this/Refer falco documentation priority: ERROR
[[email protected]] $ vim /etc/falco/falco.yaml

Question#4

CORRECT TEXT
On the Cluster worker node, enforce the prepared AppArmor profile
✑ #include<tunables/global>

✑ profilenginx-deny flags=(attach_disconnected) {
✑ #include<abstractions/base>

✑ file,

✑ # Deny all file writes.
✑ deny/** w,
✑ }
✑ EOF'
Edit the prepared manifest file to include the AppArmor profile.
✑ apiVersion: v1
✑ kind: Pod
✑ metadata:
✑ name:apparmor-pod
✑ spec:
✑ containers:
✑ - name: apparmor-pod
✑ image: nginx
Finally, apply the manifests files and create the Pod specified on it.
Verify: Try to make a file inside the directory which is restricted.

A. Send us your Feedback on this.

Question#5

CORRECT TEXT
Cluster: scanner
Master node: controlplane
Worker node: worker1
You can switch the cluster/configuration context using the following command:
[[email protected]] $ kubectl config use-context scanner
Given:
You may use Trivy's documentation.
Task:
Use the Trivy open-source container scanner to detect images with severe vulnerabilities used by Pods in the namespace nato.
Look for images with High or Critical severity vulnerabilities and delete the Pods that use those images.
Trivy is pre-installed on the cluster's master node. Use cluster's master node to use Trivy.

A. [[email protected]] $ k get pods -n nato -o yaml | grep "image: "[[email protected]] $ trivy image <image-name>[[email protected]] $ k delete pod <vulnerable-pod> -n nato
[[email protected]] $ ssh controlnode[[email protected]] $ k get pods -n nato
NAME READY STATUS RESTARTS AGE
alohmora 1/1 Running 0 3m7s
c3d3 1/1 Running 0 2m54s
neon-pod 1/1 Running 0 2m11s
thor 1/1 Running 0 58s
[[email protected]] $ k get pods -n nato -o yaml | grep "image: "



Text
Description automatically generated[[email protected]] $ trivy image <image-name>



Text
Description automatically generated



Text



Description automatically generated
Text
Description automatically generatedNote: As there are 2 images have vulnerability with severity Hight & Critical. Delete containers for nginx:latest & alpine:3.7 [[email protected]] $ k delete pod thor -n nato

Exam Code: CKS
Q & A: 44 Q&As
Updated:  May 23,2022

 Get CKS Full Version

KILLTEST CONTACT INFO

[email protected]

GMT+8: Mon-Sat 8:00-18:00

GMT: Mon-Sat 0:00-10:00