Free CKS Exam Dumps PDF Preview

Question 1

Lab simulation

A CIS Benchmark tool was run against the kubeadm-created cluster and found multiple issues that must be addressed immediately.

Fix all issues via configuration and restart the affected components to ensure the new settings take effect.

Fix all of the following violations that were found against the API server:

Fix all of the following violations that were found against the Kubelet:

Fix all of the following violations that were found against etcd:

Reveal model answer Close model answer

Question 2

Lab simulation

Simulation

Use the kubesec docker images to scan the given YAML manifest, edit and apply the advised changes, and passed with a score of 4 points.

kubesec-test.yaml

1. apiVersion: v1
2. kind: Pod
3. metadata:
4. name: kubesec-demo
5. spec:
6. containers:
7. - name: kubesec-demo
8. image: gcr.io/google-samples/node-hello:1.0
9. securityContext:
10. readOnlyRootFilesystem: true

Hint: docker run -i kubesec/kubesec:512c5e0 scan /dev/stdin < kubesec-test.yaml

Reveal model answer Close model answer

kubesec scan k8s-deployment.yaml cat <<EOF > kubesec-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: kubesec-demo
spec:
containers:
- name: kubesec-demo
image: gcr.io/google-samples/node-hello:1.0
securityContext:
readOnlyRootFilesystem: true
EOF kubesec scan kubesec-test.yaml

docker run -i kubesec/kubesec:512c5e0 scan /dev/stdin < kubesec-test.yaml kubesec http 8080 &
[1] 12345
{"severity":"info","timestamp":"2019-05-
12T11:58:34.662+0100","caller":"server/server.go:69","message":"Starting HTTP server on port 8080"} curl -sSX POST --data-binary @test/asset/score-0-cap-sys-admin.yml
http://localhost:8080/scan
[
{
"object": "Pod/security-context-demo.default",
"valid": true,
"message": "Failed with a score of -30 points",
"score": -30,
"scoring": {
"critical": [
{
"selector": "containers[] .securityContext .capabilities .add == SYS_ADMIN", "reason": "CAP_SYS_ADMIN is the most privileged capability and should always be avoided" },
{
"selector": "containers[] .securityContext .runAsNonRoot == true", "reason": "Force the running image to run as a non-root user to ensure least privilege" }, // ...

Question 3

Lab simulation

Simulation

Secrets stored in the etcd is not secure at rest, you can use the etcdctl command utility to find the secret value

for e.g:-

ETCDCTL_API=3 etcdctl get /registry/secrets/default/cks-secret --cacert="ca.crt" -- cert="server.crt" --
key="server.key"

Output

Using the Encryption Configuration, Create the manifest, which secures the resource secrets using the provider AES-CBC and identity, to encrypt the secret-data at rest and ensure all secrets are encrypted with the new configuration.

Reveal model answer Close model answer

1. ETCD secret encryption can be verified with the help of etcdctl command line utility.
2. ETCD secrets are stored at the path /registry/secrets/$namespace/$secret on the master node.
3. The below command can be used to verify if the particular ETCD secret is encrypted or not.

# ETCDCTL_API=3 etcdctl get /registry/secrets/default/secret1 [...] | hexdump -C

Question 4

Lab simulation

Simulation

You can switch the cluster/configuration context using the following command:

[desk@cli] $ kubectl config use-context dev

A default-deny NetworkPolicy avoid to accidentally expose a Pod in a namespace that doesn't have any other NetworkPolicy defined.

Task: Create a new default-deny NetworkPolicy named deny-network in the namespace test for all traffic of type Ingress + Egress

The new NetworkPolicy must deny all Ingress + Egress traffic in the namespace test.

Apply the newly created default-deny NetworkPolicy to all Pods running in namespace test.

You can find a skeleton manifests file at /home/cert_masters/network-policy.yaml

Reveal model answer Close model answer

master1 $ k get pods -n test --show-labels uk.co.certification.simulator.questionpool.PList@132b47c0 $ vim netpol.yaml
uk.co.certification.simulator.questionpool.PList@132b4af0 master1 $ k apply -f netpol.yaml controlplane $ k get pods -n test --show-labels NAME READY STATUS RESTARTS AGE LABELS
test-pod 1/1 Running 0 34s role=test,run=test-pod testing 1/1 Running 0 17d run=testing
master1 $ vim netpol1.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-network
namespace: test
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress

Question 5

Lab simulation

Simulation

A container image scanner is set up on the cluster.

Given an incomplete configuration in the directory

/etc/kubernetes/confcontrol and a functional container image scanner with HTTPS endpoint https://test-server.local.8081/image_policy

1. Enable the admission plugin.
2. Validate the control configuration and change it to implicit deny.

Finally, test the configuration by deploying the pod having the image tag as latest.

Reveal model answer Close model answer

ssh-add ~/.ssh/tempprivate
eval "$(ssh-agent -s)"
cd contrib/terraform/aws
vi terraform.tfvars
terraform init terraform apply -var-file=credentials.tfvars
ansible-playbook -i ./inventory/hosts ./cluster.yml -e ansible_ssh_user=core -e bootstrap_os=coreos -b -- become-user=root --flush-cache -e ansible_user=core

Question 6

Lab simulation

Simulation

Documentation

ServiceAccount, Deployment, Projected Volumes

You must connect to the correct host. Failure to do so may result in a zero score.

[candidate@base] $ ssh cks000033

Context

A security audit has identified a Deployment improperly handling service account tokens, which could lead to security vulnerabilities.

Task

First, modify the existing ServiceAccount stats-monitor-sa in the namespace monitoring to turn off automounting of API credentials.

Next, modify the existing Deployment stats-monitor in the namespace monitoring to inject a ServiceAccount token mounted at /var/run/secrets/kubernetes.io/serviceaccount/token.

Use a Projected Volume named token to inject the ServiceAccount token and ensure that it is mounted read-only.

The Deployment’s manifest file can be found at /home/candidate/stats-monitor/deployment.yaml.

Reveal model answer Close model answer

Connect to correct host

ssh cks000033

sudo -i

export KUBECONFIG=/etc/kubernetes/admin.conf

Patch the ServiceAccount to disable automounting

Task: turn off automounting of API credentials for stats-monitor-sa in monitoring.

kubectl -n monitoring patch sa stats-monitor-sa -p ‘{“automountServiceAccountToken”: false}’

Verify:

kubectl -n monitoring get sa stats-monitor-sa -o yaml | grep -i automount

Edit the Deployment manifest file

Task says to modify the manifest at:

/home/candidate/stats-monitor/deployment.yaml

vi /home/candidate/stats-monitor/deployment.yaml

In the Deployment, ensure it uses the ServiceAccount AND inject token via Projected Volume

4.1 Make sure Deployment uses the SA

Under:

spec: → template: → spec:

ensure:

serviceAccountName: stats-monitor-sa

If it already exists, leave it; don’t add extra changes beyond requirements.

4.2 Add a projected volume named token

Under:

spec: → template: → spec: → volumes:

add (or modify existing volume if present) so it is exactly:

name: token
projected:
sources:
- serviceAccountToken:
  path: token

This creates the file token inside the mounted directory, so the final path becomes:

/var/run/secrets/kubernetes.io/serviceaccount/token

4.3 Mount the projected volume read-only at the required location

Under the target container:

spec: → template: → spec: → containers: → (your container) → volumeMounts:

Add:

name: token
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
readOnly: true

This satisfies:

Projected volume name: token

Mount path: /var/run/secrets/kubernetes.io/serviceaccount/token (file inside mount)

Mounted read-only

4.4 Important: Don’t break default token mount behavior

Because you disabled SA automounting at the ServiceAccount level, you must explicitly mount the projected token (done above). That’s the whole point of this task.

Save and exit:

:wq

Apply the updated Deployment

kubectl -n monitoring apply -f /home/candidate/stats-monitor/deployment.yaml

Wait rollout:

kubectl -n monitoring rollout status deployment/stats-monitor

Verify the token file exists in the running Pod

Get a pod name:

POD=$(kubectl -n monitoring get pods -l app=stats-monitor -o jsonpath=’{.items[0].metadata.name}’)

echo $POD

Check the token file path exists:

kubectl -n monitoring exec -it $POD - ls -l /var/run/secrets/kubernetes.io/serviceaccount/token

Optional: confirm it’s mounted read-only (usually shown by mount options):

kubectl -n monitoring exec -it $POD - mount | grep /var/run/secrets/kubernetes.io/serviceaccount

What the examiner checks:

ServiceAccount stats-monitor-sa has:

automountServiceAccountToken: false

Deployment stats-monitor mounts a projected volume named token.

Token file is at:

/var/run/secrets/kubernetes.io/serviceaccount/token

Mount is:

readOnly: true

If label selector doesn’t match (-l app=stats-monitor), use:

kubectl -n monitoring get pods

Then set:

POD=<paste-pod-name>

Question 7

Lab simulation

Simulation

You can switch the cluster/configuration context using the following command:

[desk@cli] $ kubectl config use-context stage

Context:

A PodSecurityPolicy shall prevent the creation of privileged Pods in a specific namespace.

Task:

1. Create a new PodSecurityPolcy named deny-policy, which prevents the creation of privileged Pods.
2. Create a new ClusterRole name deny-access-role, which uses the newly created PodSecurityPolicy deny-policy.
3. Create a new ServiceAccount named psd-denial-sa in the existing namespace development.

Finally, create a new ClusterRoleBindind named restrict-access-bind, which binds the newly created ClusterRole deny-access-role to the newly created ServiceAccount psp-denial-sa

Reveal model answer Close model answer

Create psp to disallow privileged container uk.co.certification.simulator.questionpool.PList@11600d40 k create sa psp-denial-sa -n development
uk.co.certification.simulator.questionpool.PList@11601040 namespace: development
Explanationmaster1 $ vim psp.yaml
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: deny-policy
spec:
privileged: false # Don't allow privileged pods!
seLinux:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
runAsUser:
rule: RunAsAny
fsGroup:
rule: RunAsAny
volumes:
- '*'
master1 $ vim cr1.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: deny-access-role
rules:
- apiGroups: ['policy']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames:
- "deny-policy" master1 $ k create sa psp-denial-sa -n developmentmaster1 $ vim cb1.yaml apiVersion:
rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: restrict-access-bing
roleRef:
kind: ClusterRole

name: deny-access-role
apiGroup: rbac.authorization.k8s.io
subjects:
# Authorize specific service accounts:
- kind: ServiceAccount
name: psp-denial-sa
namespace: development

Question 8

Lab simulation

Simulation

Create a network policy named allow-np, that allows pod in the namespace staging to connect to port 80 of other pods in the same namespace.

Ensure that Network Policy:

1. Does not allow access to pod not listening on port 80.
2. Does not allow access from Pods, not in namespace staging.

Reveal model answer Close model answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: network-policy
spec:
podSelector: {} #selects all the pods in the namespace deployed policyTypes:
- Ingress
ingress:
- ports: #in input traffic allowed only through 80 port only
- protocol: TCP

port: 80

Question 9

Lab simulation

Simulation

Context

You must resolve issues that a CIS Benchmark tool found for the kubeadm provisioned cluster.

Task

Fix all issues via configuration and restart the affected components to ensure the new settings take effect.

Fix all of the following violations that were found against the kubelet:

The cluster uses the Docker Engine as its container runtime. If needed, use the docker command to troubleshoot running containers.

Ensure that the anonymous-auth argument is set to false - FAIL
Ensure that the authorization-mode argument is not set to AlwaysAllow - FAIL
Use Webhook authentication/authorization where possible.

Fix all of the following violations that were found against etcd:

Ensure that the client-cert-auth argument is set to true - FAIL

Reveal model answer Close model answer

SSH to the right node

ssh cks000002

sudo -i

Fix kubelet CIS findings

2.1 Edit kubelet config (MAIN place in kubeadm clusters)

vi /var/lib/kubelet/config.yaml

A) Set anonymous-auth to false

Find (or add) this block exactly:

authentication:
anonymous:
enabled: false

B) Use Webhook authentication (recommended by task)

Ensure this exists under authentication:

webhook:
enabled: true

C) Use Webhook authorization and NOT AlwaysAllow

Find (or add) this block exactly:

authorization:
mode: Webhook

When done, your file should contain something like this (exact structure to aim for):

authentication:
anonymous:
enabled: false
webhook:
enabled: true
x509:
clientCAFile: /etc/kubernetes/pki/ca.crt
authorization:
mode: Webhook

If the x509 section isn’t there, it’s usually already present in kubeadm; don’t panic. Only the task-required parts are: anonymous false + webhook enabled + authorization mode Webhook.

2.2 Restart kubelet (required for config.yaml changes)

systemctl daemon-reload

systemctl restart kubelet

systemctl status kubelet -no-pager

Quick confirm (optional but fast):

grep -nE “anonymous|webhook|authorization|mode” /var/lib/kubelet/config.yaml

Fix etcd CIS finding: --client-cert-auth=true

3.1 Edit etcd static pod manifest (kubeadm path)

vi /etc/kubernetes/manifests/etcd.yaml

Find the container command: args that look like:

command:

etcd
-something=…

Ensure this line exists exactly in the list:

-client-cert-auth=true

Also ensure this is present (usually already is, but add if missing):

-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt

Example snippet (what you want the args area to include):

command:

etcd
-client-cert-auth=true
-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt

3.2 Apply etcd change (auto-restart happens)

Just save the file. Kubelet will restart etcd automatically.

Watch it restart.

If Docker runtime (your task mentions Docker):

docker ps | grep etcd

If you don’t see it briefly, wait 2-5 seconds and rerun:

docker ps | grep etcd

Alternative if available:

crictl ps | grep etcd

Final quick validation (fast exam check)

Kubelet config check:

grep -n “enabled: false” /var/lib/kubelet/config.yaml | head

grep -n “webhook” /var/lib/kubelet/config.yaml

grep -n “authorization” /var/lib/kubelet/config.yaml

etcd arg check:

grep -n “client-cert-auth” /etc/kubernetes/manifests/etcd.yaml

Question 10

Lab simulation

AppArmor is enabled on the cluster's worker node. An AppArmor profile is prepared, but not enforced yet.

Task

On the cluster's worker node, enforce the prepared AppArmor profile located at /etc/apparmor.d/ nginx_apparmor.

Edit the prepared manifest file located at /home/candidate/KSSH00401/nginx-pod.yaml to apply the AppArmor profile.

Finally, apply the manifest file and create the Pod specified in it.

Reveal model answer Close model answer

Free CKS Exam Dumps Preview

Documentation

Context

Task

Context

Task

Linux Foundation Certified Kubernetes Security Specialist (CKS)

PREVIEW CONTENTS · 1 VOLUME

QUESTION 1

QUESTION 2

QUESTION 3

QUESTION 4

QUESTION 5

QUESTION 6

Documentation

Context

Task

QUESTION 7

QUESTION 8

QUESTION 9

Context

Task

QUESTION 10