CKS시험대비최신버전덤프샘플시험기출문제와예상문제모음자료

wywelomy

posted on 3 years ago — updated on 1 second ago

126
views

CKS시험대비 최신버전 덤프샘플,CKS최신덤프,CKS인기자격증 시험덤프공부,CKS최신버전 인기 덤프문제,CKS인증시험공부, CKS시험대비최신버전덤프샘플시험기출문제와예상문제모음자료

Linux Foundation CKS 덤프는 Linux Foundation CKS 시험의 모든 문제를 커버하고 있어 시험적중율이 아주 높습니다. Itcertkr는 Paypal과 몇년간의 파트너 관계를 유지하여 왔으므로 신뢰가 가는 안전한 지불방법을 제공해드립니다. Linux Foundation CKS시험탈락시 제품비용 전액환불조치로 고객님의 이익을 보장해드립니다.

오픈 소스 소프트웨어 개발을 촉진하는 비영리 단체인 Linux Foundation은 CKS 인증 프로그램에 대한 책임을 지고 있습니다. Linux Foundation은 고품질의 교육 및 인증 프로그램을 제공하는 데 있어서 오픈 소스 커뮤니티에서 강한 평판을 가지고 있습니다. CKS 인증 프로그램은 Kubernetes 보안 전문가를 위한 가장 존경받고 인정받는 인증 중 하나입니다. CKS 인증을 취득함으로써 IT 전문가는 Kubernetes 보안 분야에서의 전문성을 증명하고 경쟁력 있는 취업 시장에서 두각을 나타낼 수 있습니다.

>> CKS시험대비 최신버전 덤프샘플 <<

시험패스 가능한 CKS시험대비 최신버전 덤프샘플 최신 덤프공부자료

Itcertkr는 여러분이 빠른 시일 내에Linux Foundation CKS인증시험을 효과적으로 터득할 수 있는 사이트입니다.Linux Foundation CKS덤프는 보장하는 덤프입니다. 만약 시험에서 떨어지셨다고 하면 우리는 무조건 덤프전액 환불을 약속 드립니다. 우리Itcertkr 사이트에서Linux Foundation CKS관련자료의 일부분 문제와 답 등 샘플을 제공함으로 여러분은 무료로 다운받아 체험해보실 수 있습니다. 체험 후 우리의Itcertkr에 신뢰감을 느끼게 됩니다. Itcertkr의Linux Foundation CKS덤프로 자신 있는 시험준비를 하세요.

리눅스 재단 CKS (Certified Kubernetes Security Specialist) 자격증 시험은 Kubernetes 클러스터 보안에 대한 지식과 기술을 검증하려는 전문가들을 위한 필수 자격증 프로그램입니다. 이 자격증 시험은 다양한 보안 주제를 다루며, 벤더 중립적이어서 다양한 산업에서 일하는 전문가들에게 유용한 자격증입니다. 시험은 엄격하고 성과 기반으로 진행되어, 자격증을 취득한 전문가들이 Kubernetes 환경을 효과적으로 보호하기 위해 필요한 지식과 기술을 보유하고 있음을 보장합니다.

최신 Kubernetes Security Specialist CKS 무료샘플문제 (Q38-Q43):

질문 # 38
SIMULATION
Create a PSP that will prevent the creation of privileged pods in the namespace.
Create a new PodSecurityPolicy named prevent-privileged-policy which prevents the creation of privileged pods.
Create a new ServiceAccount named psp-sa in the namespace default.
Create a new ClusterRole named prevent-role, which uses the newly created Pod Security Policy prevent-privileged-policy.
Create a new ClusterRoleBinding named prevent-role-binding, which binds the created ClusterRole prevent-role to the created SA psp-sa.
Also, Check the Configuration is working or not by trying to Create a Privileged pod, it should get failed.

정답：

설명：
Create a PSP that will prevent the creation of privileged pods in the namespace.
$ cat clusterrole-use-privileged.yaml
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: use-privileged-psp
rules:
- apiGroups: ['policy']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames:
- default-psp
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: privileged-role-bind
namespace: psp-test
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: use-privileged-psp
subjects:
- kind: ServiceAccount
name: privileged-sa
$ kubectl -n psp-test apply -f clusterrole-use-privileged.yaml
After a few moments, the privileged Pod should be created.
Create a new PodSecurityPolicy named prevent-privileged-policy which prevents the creation of privileged pods.
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: example
spec:
privileged: false # Don't allow privileged pods!
# The rest fills in some required fields.
seLinux:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
runAsUser:
rule: RunAsAny
fsGroup:
rule: RunAsAny
volumes:
- '*'
And create it with kubectl:
kubectl-admin create -f example-psp.yaml
Now, as the unprivileged user, try to create a simple pod:
kubectl-user create -f- <<EOF
apiVersion: v1
kind: Pod
metadata:
name: pause
spec:
containers:
- name: pause
image: k8s.gcr.io/pause
EOF
The output is similar to this:
Error from server (Forbidden): error when creating "STDIN": pods "pause" is forbidden: unable to validate against any pod security policy: [] Create a new ServiceAccount named psp-sa in the namespace default.
$ cat clusterrole-use-privileged.yaml
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: use-privileged-psp
rules:
- apiGroups: ['policy']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames:
- default-psp
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: privileged-role-bind
namespace: psp-test
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: use-privileged-psp
subjects:
- kind: ServiceAccount
name: privileged-sa
$ kubectl -n psp-test apply -f clusterrole-use-privileged.yaml
After a few moments, the privileged Pod should be created.
Create a new ClusterRole named prevent-role, which uses the newly created Pod Security Policy prevent-privileged-policy.
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: example
spec:
privileged: false # Don't allow privileged pods!
# The rest fills in some required fields.
seLinux:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
runAsUser:
rule: RunAsAny
fsGroup:
rule: RunAsAny
volumes:
- '*'
And create it with kubectl:
kubectl-admin create -f example-psp.yaml
Now, as the unprivileged user, try to create a simple pod:
kubectl-user create -f- <<EOF
apiVersion: v1
kind: Pod
metadata:
name: pause
spec:
containers:
- name: pause
image: k8s.gcr.io/pause
EOF
The output is similar to this:
Error from server (Forbidden): error when creating "STDIN": pods "pause" is forbidden: unable to validate against any pod security policy: [] Create a new ClusterRoleBinding named prevent-role-binding, which binds the created ClusterRole prevent-role to the created SA psp-sa.
apiVersion: rbac.authorization.k8s.io/v1
# This role binding allows "jane" to read pods in the "default" namespace.
# You need to already have a Role named "pod-reader" in that namespace.
kind: RoleBinding
metadata:
name: read-pods
namespace: default
subjects:
# You can specify more than one "subject"
- kind: User
name: jane # "name" is case sensitive
apiGroup: rbac.authorization.k8s.io
roleRef:
# "roleRef" specifies the binding to a Role / ClusterRole
kind: Role #this must be Role or ClusterRole
name: pod-reader # this must match the name of the Role or ClusterRole you wish to bind to apiGroup: rbac.authorization.k8s.io apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata:
namespace: default
name: pod-reader
rules:
- apiGroups: [""] # "" indicates the core API group
resources: ["pods"]
verbs: ["get", "watch", "list"]

질문 # 39
Enable audit logs in the cluster, To Do so, enable the log backend, and ensure that
1. logs are stored at /var/log/kubernetes/kubernetes-logs.txt.
2. Log files are retained for 5 days.
3. at maximum, a number of 10 old audit logs files are retained.
Edit and extend the basic policy to log:
1. Cronjobs changes at RequestResponse
2. Log the request body of deployments changes in the namespace kube-system.
3. Log all other resources in core and extensions at the Request level.
4. Don't log watch requests by the "system:kube-proxy" on endpoints or

정답：

설명：

질문 # 40
use the Trivy to scan the following images,

A. 1. amazonlinux:1

정답：A

설명：
2. k8s.gcr.io/kube-controller-manager:v1.18.6
Look for images with HIGH or CRITICAL severity vulnerabilities and store the output of the same in /opt/trivy-vulnerable.txt

질문 # 41
SIMULATION
Service is running on port 389 inside the system, find the process-id of the process, and stores the names of all the open-files inside the /candidate/KH77539/files.txt, and also delete the binary.

A. Send us your feedback on it.

정답：A

질문 # 42
SIMULATION
Analyze and edit the given Dockerfile
FROM ubuntu:latest
RUN apt-get update -y
RUN apt-install nginx -y
COPY entrypoint.sh /
ENTRYPOINT ["/entrypoint.sh"]
USER ROOT
Fixing two instructions present in the file being prominent security best practice issues Analyze and edit the deployment manifest file apiVersion: v1 kind: Pod metadata:
name: security-context-demo-2
spec:
securityContext:
runAsUser: 1000
containers:
- name: sec-ctx-demo-2
image: gcr.io/google-samples/node-hello:1.0
securityContext:
runAsUser: 0
privileged: True
allowPrivilegeEscalation: false
Fixing two fields present in the file being prominent security best practice issues Don't add or remove configuration settings; only modify the existing configuration settings Whenever you need an unprivileged user for any of the tasks, use user test-user with the user id 5487