Real Linux Foundation CKS Exam Questions Study Guide [Q34-Q53]

Real Linux Foundation CKS Exam Questions Study Guide

Updated and Accurate CKS Questions for passing the exam Quickly

The CKS exam is a valuable certification program for professionals who are responsible for securing Kubernetes environments. It provides a comprehensive evaluation of an individual's knowledge and skills in Kubernetes security and validates their expertise in this area. With the growing adoption of Kubernetes, the CKS certification can help professionals stand out in the job market and advance their careers in this field.

The Certified Kubernetes Security Specialist (CKS) is the latest professional certification offered by the Linux Foundation. It is designed for Kubernetes security professionals who have extensive knowledge and experience in securing containerized applications in the Kubernetes environment. The CKS certification validates the skills needed to secure Kubernetes clusters and containerized applications, including working with Kubernetes APIs, securing Kubernetes resources, and using Kubernetes authentication and authorization systems.

NEW QUESTION # 34
You are running a multi-tenant Kubernetes cluster where different teams manage their own applications. You want to ensure that each team's applications are isolated from each other to prevent potential security risks.
How would you use Network Policies to achieve this isolation?

Answer:

Explanation:
Solution (Step by Step) :
1. Create separate namespaces for each team: This is the foundation for network isolation.
2. Define Network Policies for each namespace:
Restrict inbound traffic: Only allow specific protocols and ports from trusted sources to access the namespace.
Control outbound traffic: Limit outbound connections from pods within the namespace to specific destinations.
Example Network Policy (ingress):

3. Apply the Network Policies: bash kubectl apply -f team-a-ingress-yaml kubectl apply -f team-b-ingress.yaml # Apply policies for other namespaces Example Scenario: Team A: Runs a web application accessible only from within its namespace. Team B: Runs a database service that can be accessed by Team A's application but not by other teams. Network Policies: Team A Network Policy: Ingress: Only allow traffic from Team B's database service- Egress Allow outbound traffic to the internet for updates and dependencies. Team B Network Policy: Ingress: Allow traffic from Team A's web application Egress Limit outbound traffic to specific servers for backups and maintenance. Note: Network Policies are a powerful tool for achieving network isolation in Kubernetes. They allow you to fine-tune the communication patterns between pods and namespaces, enhancing security and mitigating potential risks.

NEW QUESTION # 35
Task
Analyze and edit the given Dockerfile /home/candidate/KSSC00301/Docker file (based on the ubuntu:16.04 image), fixing two instructions present in the file that are prominent security/best-practice issues.
Analyze and edit the given manifest file /home/candidate/KSSC00301/deployment.yaml, fixing two fields present in the file that are prominent security/best-practice issues.

Answer:

Explanation:

NEW QUESTION # 36
You are managing a Kubernetes cluster with a deployment named 'database-deployment' running 3 replicas of a PostgreSQL database container. You need to implement a security policy that restricts the database pods from accessing the internet, allowing them to only communicate with each other and with specific external services. The allowed external services include a dedicated monitoring service at 'monitoring-example-com:8080' and a logging service at 'logging-example-com:514'. Additionally, you want to enforce this policy using NetworkPolicy.

Answer:

Explanation:
Solution (Step by Step) :
1. Create a NetworkPolicy for database pods:
- Create a YAML file named "database-networkpolicy.yamr with the following contents:

NEW QUESTION # 37
Secrets stored in the etcd is not secure at rest, you can use the etcdctl command utility to find the secret value for e.g:-

A. ETCDCTL_API=3 etcdctl get /registry/secrets/default/cks-secret --cacert="ca.crt" --cert="server.crt" --key="server.key"

Answer: A

Explanation:
Output

Using the Encryption Configuration, Create the manifest, which secures the resource secrets using the provider AES-CBC and identity, to encrypt the secret-data at rest and ensure all secrets are encrypted with the new configuration.

NEW QUESTION # 38
You have a Kubernetes cluster with a service account named 'default. This service account is used by multiple applications within the cluster, each requiring different access levels. Currently, 'default' has broad permissions, granting it access to manage deployments, secrets, and even perform cluster-wide operations. This poses a security risk.
How would you implement a strategy to restrict 'default's access to a minimal set of permissions while maintaining functionality for existing applications? Ensure you are using a principle of least privilege approach and demonstrate how you would test your implementation.

Answer:

Explanation:
Solution (Step by Step) :
1. Identify and Separate Service Accounts:
- Determine the minimum set of permissions required by each application using the 'default service account.
- Create new service accounts with specific names (e.g., 'appl-sa', 'app2-sa', etc.) for each application.
2. Restrict 'default' Service Account:
- Remove unnecessary permissions from the 'default' service account.
- For example, you can restrict it to access only specific namespaces, specific resources within those namespaces, or specific operations on those resources.

3. Bind Service Accounts to Roles: - Create RoleBindings tnat associate the newly created service accounts with their respective roles.

4. Test Implementation: - Update your application deployments to use the new, restricted service accounts. - Run your applications and verify that they can access the resources they need but are prevented from unauthorized actions.

NEW QUESTION # 39
You are responsible for securing the software supply chain for your organization, which uses a GitLab CI/CD pipeline to build and deploy containerized applications. You want to implement a robust mechanism to prevent unauthorized code changes from being introduced into the production environment. How would you utilize GitLab's built-in features and best practices to achieve this goal?

Answer:

Explanation:
Solution (Step by Step) :
1. Implement Code Review:
- Configure GitLab to enforce mandatory code reviews for all changes to production branches.
- Configure a minimum number of reviewers required for each merge request.
- Use GitLab's built-in code review features to facilitate discussion and feedback-
2. Enable Branch Protection:
- Protect the production branch by configuring the following:
- Allow only specific users or groups to merge: Restrict merge rights to authorized personnel.
- Require merge requests: Prevent direct pushes to the production branch.
- Enforce minimum approval count: Mandate a specific number of approvals for each merge request
3. Utilize GitLab CIICD Security Features:
- Dependency Scanning: Integrate GitLab's dependency scanning feature to analyze your code for known vulnerabilities in external libraries.
- Container Scanning: use GitLab'S container scanning feature to check for vulnerabilities in your Docker images before deployment.
- SAST (Static Application Security Testing): Integrate a SAST tool into your CI/CD pipeline to identify potential vulnerabilities in your code.
- DAST (Dynamic Application Security Testing): Utilize a DAST tool to test your application for security flaws during runtime.
4. Enforce Access Control:
- Implement role-based access control (RBAC) within GitLab.
- Assign roles With specific permissions to users and groups based on their responsibilities.
- Audit user activity regularly to identify any suspicious behavior.
5. Utilize GitLab'S Security Integrations:
- Integrate with Vulnerability Databases: Connect your GitLab instance to vulnerability databases such as NIST NVD to receive alerts about newly
discovered vulnerabilities.
- Integrate with Security Tools: Connect GitLab with security tools like Security Information and Event Management (SIEM) systems to automate
vulnerability reporting and incident response.
6. Develop a Secure Coding Culture:
- Promote secure coding practices within your development team.
- Provide training and resources on secure coding principles.
- Conduct regular code reviews to catch potential vulnerabilities.

NEW QUESTION # 40
You are deploying a critical application Within your Kubernetes cluster. The application requires access to sensitive data stored in a secret. You want to implement a policy that ensures only authorized pods can access the secret How can you restrict access to the secret to authorized pods?

Answer:

Explanation:
Solution (Step by Step) :
1. Create a Role and RoIeBinding:
- Define a Role that grants access to the specific secret
- Create a RoleBinding that associates the Role with a ServiceAccount that will be used by authorized pods.
2. Example Implementation:
-

3. Granting Access to a Specific Secret: - If you need to restrict access to a specific secret, add a resourceNameS field to the Role definition. 4. Fine-Grained Access Control: - To control access even more granularly, you can define custom RBAC resources using CRDs and custom validation logic.

NEW QUESTION # 41
You have a Kubernetes cluster running a critical application with a Deployment named 'myapp-deployment. You suspect a recent image update has introduced a vulnerability that's causing the application to crash frequently.
You need to investigate this issue and determine the exact phase of the attack and the potential bad actor responsible. You have access to the following resources: Kubernetes audit logs: Enabled at the cluster level.
Container logs: Available for all pods associated with the 'myapp-deployments Network traffic logs: Captured by a network security solution. How would you use these resources to identify the attack phase, the potential bad actor, and the source of the vulnerability?

Answer:

Explanation:
Solution (Step by Step) :
1. Analyze Kubernetes Audit Logs:
Focus on events related to the 'myapp-deployment: Search for entries related to pod creation, deletion, image pulls, and resource updates. Look for suspicious activity: Pay attention to any unusual image updates, unauthorized access attempts, or resource changes that occurred around the time of the crashes.
Identify the user or service account responsible for the changes: This could point to a potential bad actor if the user'service account is not expected to modify the Deployment.
2. Examine Container Logs:
Search for crash messages and error codes: This will provide insights into the specific cause of the application crashes.
Identify any unusual or suspicious activity within the container: Look for signs of malicious processes, unauthorized network connections, or data exfiltration attempts.
3. Analyze Network Traffic Logs:
Identify the source of the compromised image: Network logs can reveal the IP address of the registry or repository from which the vulnerable image was pulled.
Examine network connections from the affected pods: Look for unusual or unauthorized outbound connections that could indicate malware or communication with a malicious server.
4. Correlate Findings:
Combine information from the different logs to build a comprehensive picture of the attack.
For example, if you find a suspicious image pull in the audit logs, and the container logs show signs of malware activity, you have strong evidence of malicious image vulnerability.
Example Code Snippets:
Kubernetes Audit Logs (using kubectl):
bash
kubectl logs -f -n kube-system kube-apiserver -c kube-apiserver | grep "myapp-deployment" | grep "Create" | grep "Image"
Container Logs (using kubectl):
bash
kubectl logs -f myapp-deployment-pod-name -c myapp
Network Traffic Logs (using a network security tool like Falco):
falco -f falco.yaml -o json
Note: The specific commands and tools may vary depending on your Kubernetes environment and security tools.

NEW QUESTION # 42
You have a Kubernetes cluster witn multiple namespaces. One namespace, "dev", is used for development and testing purposes. You want to prevent pods in the "dev" namespace from accessing resources in other namespaces.

Answer:

Explanation:
Solution (Step by Step):
1. Apply Namespace-Level Network Policy: Create a network policy that restricts pods within the "dev" namespace from accessing any resources outside the namespace.
- Create a YAML file for the Network Policy:

2. Deploy the Network Policy: Apply the YAML file using ' kubectl apply -f networkpolicy.yamr Note: This policy allows pods within "dev" to communicate with each other but blocks communication with pods in other namespaces.

NEW QUESTION # 43
You have an Nginx pod deployed in your Kubernetes cluster. You need to set up a PodSecurityPolicy (PSP) that allows the Nginx pod to access only specific network ports and disallows it from accessing other ports. Describe the steps you would take to implement this PSP.

Answer:

Explanation:
Solution (Step by Step) :
1. Create PodSecurityPolicy (PSP):
- Define a PodSecurityPolicy (PSP) YAML file. This file will restrict the Nginx pod's network access.
- For example, you could define a PSP that allows the Nginx pod to access ports 80 and 443 (HTTP and HTTPS) but restricts access to all other ports:

2. Apply the PSPI - Apply the PSP YAML file using 'kubectl apply -f nginx-psp.yaml' 3. Bind the PSP to the Nginx Pod: - Update the Nginx deployment or pod definition to include the 'securityContext' field with a reference to the created PSP:

4. Verify the psp: - Check that the Nginx pod is using the PSP by running 'kubectl describe pod ' . You should see the PSP name listed in the "Security Context" section. 5. Test Access: - Verity that the Nginx pod can access ports 80 and 443 but not other ports. You can use tools like 'telnet or 'nc' to test connectivity.

NEW QUESTION # 44
Create a RuntimeClass named untrusted using the prepared runtime handler named runsc.
Create a Pods of image alpine:3.13.2 in the Namespace default to run on the gVisor runtime class.

Answer:

Explanation:

NEW QUESTION # 45
You are running a critical application within a Kubernetes cluster. Your application relies on a base image with several unnecessary packages installed. These packages increase the attack surface of your application and make it more vulnerable to exploits. You want to minimize the base image footprint to enhance the security posture of your application. Explain how you can achieve this in a production environment.

Answer:

Explanation:
Solution (Step by Step) :
1. Identify unnecessary Packages:
- Use tools like 'alpine-pkg-info' or 'dpkg -l' to list installed packages within the base image.
- Analyze the package list to identify packages that are not strictly required for your application's functionality.
- Example: If you are running a Node.js application, you might identity development tools like 'gcc' or 'make' as unnecessary.
2. Create a Custom Base Image:
- Docker-file: Start by creating a Dockefflle that inherits from a minimal base image like 'alpine:latest or 'ubuntu:latest' (depending on your application's requirements).
- Install Essential Packages: Include only the absolutely necessary packages for your application in the Dockerfile. Use the 'apt-get install' (for Debian/lJbuntu) or 'apk add' (for Alpine) commands to install these packages.
- Example Dockerfile:
FROM alpine:latest
# Install necessary packages
RIJN apk add --no-cache bash openssl curl nodejs npm
# Copy your application code
COPY _ /app
# Set working directory and execute start script
WORKDIR 'app
CMD ["npm", "start"]
3. Test the Custom Image:
- Build the custom image using 'docker build -t custom-base-image
- Create a container from the custom image and run your application to ensure everything works correctly. This step is critical to catch any compatibility issues before deploying to your Kubernetes cluster.
4. Update Your Deployments:
- Modify your Deployment YAML files to use the custom base image instead of the original image. Update the 'image' field to reference the custom base image tag.
- Example:

5. Deploy the Updated Application: - Use 'kubectl apply -f deployment_yaml to update your deployment with the new image- - Monitor the deployment to ensure a successful rollout with your minimal base image. 6. Regular - Periodically review your application's requirements and ensure that the base image still meets your needs. -As you add new features or update dependencies, you might need to add additional packages to the base image. - Keep the image as minimal as possible and use the least-privilege principle when selecting packages.

NEW QUESTION # 46
You have a Kubernetes cluster with a Deployment named 'my-app' that exposes a service on port 80. You want to enforce a policy that allows only traffic from pods With a specific label to access this service.

Answer:

Explanation:
Solution (Step by Step) :
1. Create a NetworkPolicy:
- Define a NetworkPolicy resource with a 'podSelector' that matches the 'my-app' Deployment.
- Create an 'ingress' rule that allows traffic only from pods with the specific label.
- Use the 'from' field to specify the label selector.
- Ensure that the port 80 is included in the 'ports' field.

2. Apply the NetworkPolicy: - Apply the YAML file using 'kubectl apply -f my-app-label-policy-yamr 3. Verify the NetworkPolicy: - Use 'kubectl get networkpolicies' to list the available network policies. - Use 'kubectl describe networkpolicy my-app-label-policy' to view the details ot the applied policy. 4. Test the NetworkPolicy: - Deploy a pod with the label 'allowed: true' and attempt to access the service on port 80. Verify that the connection is successful. - Deploy a pod without the label 'allowed: true' and attempt to access the service on port 80. Verify that the connection is denied.

NEW QUESTION # 47
use the Trivy to scan the following images,

A. 1. amazonlinux:1

Answer: A

Explanation:
2. k8s.gcr.io/kube-controller-manager:v1.18.6
Look for images with HIGH or CRITICAL severity vulnerabilities and store the output of the same in /opt/trivy-vulnerable.txt

NEW QUESTION # 48
You are running a web application in a Kubernetes cluster using a Deployment. You want to implement a security measure to ensure that the application container only has access to the necessary system calls and files. You're worried about potential exploits that could give the container excessive privileges. Explain how you would use Seccomp profiles to achieve this, and provide an example Seccomp profile using a JSON format.

Answer:

Explanation:
Solution (Step by Step) :
1. Understand Seccomp: Seccomp (Secure Computing Mode) is a Linux kernel feature that allows you to restrict the system calls that a process can make. You can define a profile that lists the allowed system calls, effectively creating a "sandbox" for the container.
2. Create a Seccomp Profile: You can create a Seccomp profile in a JSON format. Here's an example:

3. Apply the Seccomp Profile: You can apply the Seccomp profile to your container using the 'securitycontext' field in your Deployment YAML.

4. Test and Verify: After deploying your Deployment, test your application and make sure it functions as expected. You can verity that the Seccomp profile is working by attempting to run commands within the container that are not allowed by your profile.

NEW QUESTION # 49
You are tasked with hardening a Kubernetes cluster to meet the requirements of the CIS Kubernetes Bencnmark. One of the key areas is to implement proper access control and authentication. You need to create a strong authentication mechanism that uses client certificates for authentication, while also using RBAC to define specific roles and permissions for different users.
How would you set up a strong authentication mechanism using client certificates for authentication and configure R8AC to define specific roles and permissions for different users, to comply With the CIS Kubernetes Benchmark?

Answer:

Explanation:
Solution (Step by Step) :
1. Generate Client Certificates:
- use a tool like 'ctssr to generate client certificates for each user who needs access to the cluster.
- Create a separate certificate authority (CA) to issue these Client certificates.
- For each user, create a certificate signing request (CSR) and use the CA to sign the CSR to generate the client certificate and private key.
2. Configure Kubernetes API Server:
- Modify the Kubernetes API server configuration (e.g., '/etc/kubernetes/manifests/kube-apiserver.yaml') to enable client certificate authentication:
- Set '--client-ca-file' to the path of the CA certificate.
- Set '--tls-cen-file' to the path of the API server certificate.
- Set '--tls-private-key-files to the path of the API server private key.

3. Define RBAC Roles: - Use 'kubectr to create RBAC roles for different user groups. - Define roles that map to specific permissions. For example. - 'admin': Full access to the cluster - 'developers: Ability to create and manage resources, but not access sensitive information. - 'viewer': Only able to view resources.

4. Bind Roles to Users: - Create RoleBindings that link the roles to the users who need access to them. - Use the client certificate and private key to authenticate as the user and bind the appropriate role. - You can bind roles to users individually or to groups. 5. Configure 'kubectr' - Configure the 'kubectr command-line tool to use client certificates for authentication. - Set the 'KI-IBECONFIG' environment variable to point to a file containing the client certificate and private key. - Run 'kubectl config set-credentials -client-key -client-certificate to configure the user with the certificate. 6. Verify Configuration: - Test that the configuration works by logging in as different users and verifying that they have the expected permissions.

NEW QUESTION # 50
On the Cluster worker node, enforce the prepared AppArmor profile
#include <tunables/global>
profile nginx-deny flags=(attach_disconnected) {
#include <abstractions/base>
file,
# Deny all file writes.
deny /** w,
}
EOF'

A. Edit the prepared manifest file to include the AppArmor profile.

Answer: A

Explanation:
apiVersion: v1
kind: Pod
metadata:
name: apparmor-pod
spec:
containers:
- name: apparmor-pod
image: nginx
Finally, apply the manifests files and create the Pod specified on it.
Verify: Try to make a file inside the directory which is restricted.

NEW QUESTION # 51
You have an application running in a Kubernetes cluster that requires access to a database hosted in a different namespace. You want to implement a secure mecnanism to allow the application to access the database witnout granting it access to all resources in the database namespace.

Answer:

Explanation:
Solution (Step by Step) :
1. Create a Service Account in the Application Namespace:
- In the application's namespace, create a service account named 'db-access-sa'
2. Create a Role in the Database Namespace:
- In the database namespace, create a custom role named 'db-access-role' that grants only the required permissions to the database.
- For example, you might grant access to specific database tables, views, or stored procedures.
- Create a custom role named 'db-access-role' in the namespace where your database is running to grant only read permissions to the database.

3. Create a ROIeBinding in the Database Namespace: - In the database namespace, create a role binding named 'db-access-binding' that associates the 'db-access-sa' service account (from the application's namespace) with the 'db-access-role'.

4. Configure Your Application: - Configure your application deployment to use the 'db-access-sa' service account. - Use the Kubernetes API to connect to the database using the provided credentials or secrets.

NEW QUESTION # 52
You have a Kubernetes cluster with a deployment named 'web-app' running a web applicatiom You suspect that a specific user with the username 'malicious-user' might be attempting unauthorized access to the cluster To investigate this, you want to use Kubernetes audit logs to identify any attempts made by this user to access resources within your namespace 'my-namespace'.
How would you configure Kubernetes audit logging and filter the logs to isolate potential malicious activity by 'malicious-user within the 'my- namespace' namespace?

Answer:

Explanation:
Solution (Step by Step):
1. Enable Kubernetes Audit Logging:
- Create a ConfigMap named 'audit-policy' with the following content:

- Apply the ConfigMap to the cluster: bash kubectl apply -f audit-policy-yaml 2 Configure the Audit Backend: - Create a ConfigMap named 'audit-sink' with the following content

- Apply the ConfigMap: bash kubectl apply -f audit-sink-yaml 3. Filter Audit Logs: - Use ' kubectl logs -f -n kube-system' to view the audit logs. - Filter tne logs for requests made by 'malicious-user' Within 'my-namespace'- bash kubectl logs -f -n kube-system I grep "user.name=malicious-user" I grep "namespace-my-namespace" - This command will display any audit log entries related to requests made by 'malicious-user' within the my-namespace' namespace. 4. Analyze the Logs: - Examine the logs for suspicious activity, such as attempts to access sensitive resources, perform unauthorized actions, or exploit vulnerabilities. - Use the information gathered from the audit logs to take appropriate security measures. Note: - The 'lever field in the audit policy can be customized to control the level ot detail in the audit logs. For example, 'Metadata' logs only the request metadata, while 'Request' logs all details of the request - The audit logs will be stored according to the configuration of the 'audit-sink' ConfigMap. - This is a basic example. You may need to adjust the filters and analysis techniques based on your specific security requirements.