Reliable CKS training materials bring you the best CKS guide exam: Certified Kubernetes Security Specialist (CKS)

tafawi

posted on 3 years ago — updated on 1 second ago

58
views

CKS Lerntipps,CKS Online Prüfungen,CKS Dumps Deutsch,CKS Testengine,CKS Antworten, Reliable CKS training materials bring you the best CKS guide exam: Certified Kubernetes Security Specialist (CKS)

Die Linux Foundation CKS Zertifizierungsunterlagen von ITZert sind unbedingt die Unterlagen für Linux Foundation CKS Zertifizierungsprüfung, an der Sie glauben können. Falls Sie nicht glauben, probieren Sie bitte persönlich, dann können Sie diese Tatsachen wissen. Klicken Sie bitte die Demo von ITZert Website. PDF-Versionen und Software-Versionen sind beide vorhanden. Probieren Sie bitte zuerst. Sie können persönlich die Qualität der Linux Foundation CKS Dumps überprüfen.

Machen Sie Sorge um die CKS von Linux Foundation Prüfung, weil Sie nur noch ein Anfänger sind? Von jetzt an wird ITZert alle Probleme für Sie lösen. Die Lernhilfe von Linux Foundation CKS Zertifizierung sind umfassend und enthalten unterschiedliche Ziele, daher können sogar die Anfänger sie leicht erfassen. Sie würden den Schlüssel für den Durchlauf der CKS Prüfung haben und Selbstsicherheit gewinnen, wenn Sie solche Lernhilfe haben. Dann warum warten Sie noch?

>> CKS Lerntipps <<

CKS Online Prüfungen & CKS Dumps Deutsch

Um der Anforderung des aktuellen realen Test gerecht zu werden, aktualisiert das Technik-Team von ITZert rechtzeitig die Fragen und Antworten zur Linux Foundation CKS Zertifizierungsprüfung. Wir akzeptieren immer Rückmeldungen von Benutzern und nehmen viele ihre Vorschläge an, was zu einer perfekten Schulungsmaterialien zur Linux Foundation CKS Prüfung macht. Dies ermöglicht ITZert, immer Produkte von bester Qualität zu besitzen.

Linux Foundation Certified Kubernetes Security Specialist (CKS) CKS Prüfungsfragen mit Lösungen (Q37-Q42):

37. Frage
SIMULATION
Enable audit logs in the cluster, To Do so, enable the log backend, and ensure that
1. logs are stored at /var/log/kubernetes-logs.txt.
2. Log files are retained for 12 days.
3. at maximum, a number of 8 old audit logs files are retained.
4. set the maximum size before getting rotated to 200MB
Edit and extend the basic policy to log:
1. namespaces changes at RequestResponse
2. Log the request body of secrets changes in the namespace kube-system.
3. Log all other resources in core and extensions at the Request level.
4. Log "pods/portforward", "services/proxy" at Metadata level.
5. Omit the Stage RequestReceived
All other requests at the Metadata level

Antwort:

Begründung:
Kubernetes auditing provides a security-relevant chronological set of records about a cluster. Kube-apiserver performs auditing. Each request on each stage of its execution generates an event, which is then pre-processed according to a certain policy and written to a backend. The policy determines what's recorded and the backends persist the records.
You might want to configure the audit log as part of compliance with the CIS (Center for Internet Security) Kubernetes Benchmark controls.
The audit log can be enabled by default using the following configuration in cluster.yml:
services:
kube-api:
audit_log:
enabled: true
When the audit log is enabled, you should be able to see the default values at /etc/kubernetes/audit-policy.yaml The log backend writes audit events to a file in JSONlines format. You can configure the log audit backend using the following kube-apiserver flags:
--audit-log-path specifies the log file path that log backend uses to write audit events. Not specifying this flag disables log backend. - means standard out
--audit-log-maxage defined the maximum number of days to retain old audit log files
--audit-log-maxbackup defines the maximum number of audit log files to retain
--audit-log-maxsize defines the maximum size in megabytes of the audit log file before it gets rotated If your cluster's control plane runs the kube-apiserver as a Pod, remember to mount the hostPath to the location of the policy file and log file, so that audit records are persisted. For example:
--audit-policy-file=/etc/kubernetes/audit-policy.yaml \
--audit-log-path=/var/log/audit.log

38. Frage
Fix all issues via configuration and restart the affected components to ensure the new setting takes effect.
Fix all of the following violations that were found against the API server:- a. Ensure the --authorization-mode argument includes RBAC b. Ensure the --authorization-mode argument includes Node c. Ensure that the --profiling argument is set to false Fix all of the following violations that were found against the Kubelet:- a. Ensure the --anonymous-auth argument is set to false.
b. Ensure that the --authorization-mode argument is set to Webhook.
Fix all of the following violations that were found against the ETCD:-
a. Ensure that the --auto-tls argument is not set to true
Hint: Take the use of Tool Kube-Bench

Antwort:

Begründung:
API server:
Ensure the --authorization-mode argument includes RBAC
Turn on Role Based Access Control. Role Based Access Control (RBAC) allows fine-grained control over the operations that different entities can perform on different objects in the cluster. It is recommended to use the RBAC authorization mode.
Fix - Buildtime
Kubernetes
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
component: kube-apiserver
tier: control-plane
name: kube-apiserver
namespace: kube-system
spec:
containers:
- command:
+ - kube-apiserver
+ - --authorization-mode=RBAC,Node
image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0
livenessProbe:
failureThreshold: 8
httpGet:
host: 127.0.0.1
path: /healthz
port: 6443
scheme: HTTPS
initialDelaySeconds: 15
timeoutSeconds: 15
name: kube-apiserver-should-pass
resources:
requests:
cpu: 250m
volumeMounts:
- mountPath: /etc/kubernetes/
name: k8s
readOnly: true
- mountPath: /etc/ssl/certs
name: certs
- mountPath: /etc/pki
name: pki
hostNetwork: true
volumes:
- hostPath:
path: /etc/kubernetes
name: k8s
- hostPath:
path: /etc/ssl/certs
name: certs
- hostPath:
path: /etc/pki
name: pki
Ensure the --authorization-mode argument includes Node
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --authorization-mode parameter to a value that includes Node.
--authorization-mode=Node,RBAC
Audit:
/bin/ps -ef | grep kube-apiserver | grep -v grep
Expected result:
'Node,RBAC' has 'Node'
Ensure that the --profiling argument is set to false
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the below parameter.
--profiling=false
Audit:
/bin/ps -ef | grep kube-apiserver | grep -v grep
Expected result:
'false' is equal to 'false'
Fix all of the following violations that were found against the Kubelet:- Ensure the --anonymous-auth argument is set to false.
Remediation: If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to false. If using executable arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
--anonymous-auth=false
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
Audit:
/bin/ps -fC kubelet
Audit Config:
/bin/cat /var/lib/kubelet/config.yaml
Expected result:
'false' is equal to 'false'
2) Ensure that the --authorization-mode argument is set to Webhook.
Audit
docker inspect kubelet | jq -e '.[0].Args[] | match("--authorization-mode=Webhook").string' Returned Value: --authorization-mode=Webhook Fix all of the following violations that were found against the ETCD:- a. Ensure that the --auto-tls argument is not set to true Do not use self-signed certificates for TLS. etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should not be available to unauthenticated clients. You should enable the client authentication via valid certificates to secure the access to the etcd service.
Fix - Buildtime
Kubernetes
apiVersion: v1
kind: Pod
metadata:
annotations:
scheduler.alpha.kubernetes.io/critical-pod: ""
creationTimestamp: null
labels:
component: etcd
tier: control-plane
name: etcd
namespace: kube-system
spec:
containers:
- command:
+ - etcd
+ - --auto-tls=true
image: k8s.gcr.io/etcd-amd64:3.2.18
imagePullPolicy: IfNotPresent
livenessProbe:
exec:
command:
- /bin/sh
- -ec
- ETCDCTL_API=3 etcdctl --endpoints=https://[192.168.22.9]:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt
--cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key get foo failureThreshold: 8 initialDelaySeconds: 15 timeoutSeconds: 15 name: etcd-should-fail resources: {} volumeMounts:
- mountPath: /var/lib/etcd
name: etcd-data
- mountPath: /etc/kubernetes/pki/etcd
name: etcd-certs
hostNetwork: true
priorityClassName: system-cluster-critical
volumes:
- hostPath:
path: /var/lib/etcd
type: DirectoryOrCreate
name: etcd-data
- hostPath:
path: /etc/kubernetes/pki/etcd
type: DirectoryOrCreate
name: etcd-certs
status: {}

39. Frage
Create a Pod name Nginx-pod inside the namespace testing, Create a service for the Nginx-pod named nginx-svc, using the ingress of your choice, run the ingress on tls, secure port.

Antwort:

Begründung:
$ kubectl get ing -n <namespace-of-ingress-resource>
NAME HOSTS ADDRESS PORTS AGE
cafe-ingress cafe.com 10.0.2.15 80 25s
$ kubectl describe ing <ingress-resource-name> -n <namespace-of-ingress-resource> Name: cafe-ingress Namespace: default Address: 10.0.2.15 Default backend: default-http-backend:80 (172.17.0.5:8080) Rules:
Host Path Backends
---- ---- --------
cafe.com
/tea tea-svc:80 (<none>)
/coffee coffee-svc:80 (<none>)
Annotations:
kubectl.kubernetes.io/last-applied-configuration: {"apiVersion":"networking.k8s.io/v1","kind":"Ingress","metadata":{"annotations":{},"name":"cafe-ingress","namespace":"default","selfLink":"/apis/networking/v1/namespaces/default/ingresses/cafe-ingress"},"spec":{"rules":[{"host":"cafe.com","http":{"paths":[{"backend":{"serviceName":"tea-svc","servicePort":80},"path":"/tea"},{"backend":{"serviceName":"coffee-svc","servicePort":80},"path":"/coffee"}]}}]},"status":{"loadBalancer":{"ingress":[{"ip":"169.48.142.110"}]}}} Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal CREATE 1m ingress-nginx-controller Ingress default/cafe-ingress
Normal UPDATE 58s ingress-nginx-controller Ingress default/cafe-ingress
$ kubectl get pods -n <namespace-of-ingress-controller>
NAME READY STATUS RESTARTS AGE
ingress-nginx-controller-67956bf89d-fv58j 1/1 Running 0 1m
$ kubectl logs -n <namespace> ingress-nginx-controller-67956bf89d-fv58j
------------------------------------------------------------------------------- NGINX Ingress controller Release: 0.14.0 Build: git-734361d Repository: https://github.com/kubernetes/ingress-nginx
-------------------------------------------------------------------------------
....

40. Frage
Fix all issues via configuration and restart the affected components to ensure the new setting takes effect.
Fix all of the following violations that were found against the API server:- a. Ensure the --authorization-mode argument includes RBAC b. Ensure the --authorization-mode argument includes Node c. Ensure that the --profiling argument is set to false Fix all of the following violations that were found against the Kubelet:- a. Ensure the --anonymous-auth argument is set to false.
b. Ensure that the --authorization-mode argument is set to Webhook.
Fix all of the following violations that were found against the ETCD:-
a. Ensure that the --auto-tls argument is not set to true
Hint: Take the use of Tool Kube-Bench

Antwort:

41. Frage
Create a Pod name Nginx-pod inside the namespace testing, Create a service for the Nginx-pod named nginx-svc, using the ingress of your choice, run the ingress on tls, secure port.

A. Send us your Feedback on this.

Antwort: A

42. Frage
......

Wir versprechen, dass alle Kandidaten, die Shunglungsunterlagen von ITZert benutzt haben, Ihre Linux Foundation CKS Prüfung 100% bestehen können, ohne Ausnahme. Wenn Sie heute ITZert wählen, fangen Sie dann mit Ihrem Training an. Sie können die nächste Linux Foundation CKS Zertifizierungsprüfung sicher bestehen und die besten Ressourcen mit der Marktkohärenz und zuverlässiger Garantie bekommen

CKS Online Prüfungen: https://www.itzert.com/CKS_valid-braindumps.html

Unsere Linux Foundation CKS Prüfungsmaterialien werden Sie am besten unterstützen, die Zertifizierungsprüfung problemlos zu bestehen, Linux Foundation CKS Lerntipps Ihre Vorbereitungsprozess der Prüfung wird deshalb bestimmt leichter, Linux Foundation CKS Lerntipps Unübertrefflicher Kundenservice, Linux Foundation CKS Lerntipps Dies kann bessere Resultate bei weniger Einsatz erzielen.

wo der Musik ihre wahre Würde, dionysischer Weltspiegel CKS Online Prüfungen zu sein, völlig entfremdet ist, so dass ihr nur übrig bleibt, als Sclavin der Erscheinung, das Formenwesen der Erscheinung nachzuahmen CKS Testengine und in dem Spiele der Linien und Proportionen eine äusserliche Ergetzung zu erregen.

Seit Neuem aktualisierte CKS Examfragen für Linux Foundation CKS Prüfung

Der Wind blies in die Segel, und im Norden sah Sam (https://www.itzert.com/CKS_valid-braindumps.html) sogar einige verstreute Sterne, darunter den Roten Wanderer, den das freie Volk den Dieb nannte, Unsere Linux Foundation CKS Prüfungsmaterialien werden Sie am besten unterstützen, die Zertifizierungsprüfung problemlos zu bestehen.

Ihre Vorbereitungsprozess der Prüfung wird deshalb bestimmt leichter, CKS Antworten Unübertrefflicher Kundenservice, Dies kann bessere Resultate bei weniger Einsatz erzielen, Nach mehr als 10-jähriger Entwicklung tun wir nach wir vor unser Bestes, um unseren Kunden qualitativ hochwertige CKS Prüfung-Dumps anzubieten und wir bleiben immer geduldig, wenn wir mit Kunden umgehen.