Linux Foundation CKS Online Practice Questions and Exam Preparation

Linux Foundation CKS Online Questions & Answers

• Question 1:

  You can switch the cluster/configuration context using the following command:

  [desk@cli] $ kubectl config use-context stage

  Context:

  A PodSecurityPolicy shall prevent the creation of privileged Pods in a specific namespace.

  Task:

  1. Create a new PodSecurityPolcy named deny-policy, which prevents the creation of privileged Pods.

  2. Create a new ClusterRole name deny-access-role, which uses the newly created PodSecurityPolicy deny-policy.

  3. Create a new ServiceAccount named psd-denial-sa in the existing namespace development.

  Finally, create a new ClusterRoleBindind named restrict-access-bind, which binds the newly created ClusterRole deny-access-role to the newly created ServiceAccount psp-denial-sa

  A. See the explanation below
  B. PlaceHolder
  A. See the explanation below

  ---

  Explanation/Reference:

  Create psp to disallow privileged container uk.co.certification.simulator.questionpool.PList@11600d40 k create sa psp-denial-sa -n development uk.co.certification.simulator.questionpool.PList@11601040 namespace: development Explanationmaster1 $ vim psp.yaml apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: deny-policy spec: privileged: false # Don't allow privileged pods! seLinux: rule: RunAsAny supplementalGroups: rule: RunAsAny runAsUser: rule: RunAsAny fsGroup: rule: RunAsAny volumes:

  -'*'

  master1 $ vim cr1.yaml

  apiVersion: rbac.authorization.k8s.io/v1

  kind: ClusterRole

  metadata:

  name: deny-access-role

  rules:

  -apiGroups: ['policy']

  resources: ['podsecuritypolicies']

  verbs: ['use']

  resourceNames:

  -"deny-policy"

  master1 $ k create sa psp-denial-sa -n developmentmaster1 $ vim cb1.yaml apiVersion: rbac.authorization.k8s.io/v1

  kind: ClusterRoleBinding

  metadata:

  name: restrict-access-bing

  roleRef:

  kind: ClusterRole

  name: deny-access-role

  apiGroup: rbac.authorization.k8s.io

  subjects:

  # Authorize specific service accounts:

  -kind: ServiceAccount

  name: psp-denial-sa

  namespace: development

• Question 2:

  A Role bound to a Pod's ServiceAccount grants overly permissive permissions. Complete the following tasks to reduce the set of permissions.

  

  Task

  Given an existing Pod named web-pod running in the namespace security.

  Edit the existing Role bound to the Pod's ServiceAccount sa-dev-1 to only allow performing watch operations, only on resources of type services.

  Create a new Role named role-2 in the namespace security, which only allows performing update

  operations, only on resources of type namespaces.

  Create a new RoleBinding named role-2-binding binding the newly created Role to the Pod's ServiceAccount.

  

  A. See the explanation below
  B. PlaceHolder
  A. See the explanation below

  ---

  Explanation/Reference:

  

  

  

• Question 3:

  CORRECT TEXT

  Task

  

  Create a NetworkPolicy named pod-access to restrict access to Pod users-service running in namespace dev-team. Only allow the following Pods to connect to Pod users-service:

  1. Pods in the namespace qa

  2. Pods with label environment: testing, in any namespace

  

  A. See explanation below.
  B. PlaceHolder
  A. See explanation below.

  ---

  Explanation/Reference:

  

  

  

  

• Question 4:

  Context:

  Cluster: gvisor

  Master node: master1

  Worker node: worker1

  You can switch the cluster/configuration context using the following command:

  [desk@cli] $ kubectl config use-context gvisor

  Context: This cluster has been prepared to support runtime handler, runsc as well as traditional one.

  Task:

  Create a RuntimeClass named not-trusted using the prepared runtime handler names runsc.

  Update all Pods in the namespace server to run on newruntime.

  A. See the explanation below
  B. PlaceHolder
  A. See the explanation below

  ---

  Explanation/Reference:

  

  [desk@cli] $vim runtime.yaml

  1. apiVersion: node.k8s.io/v1

  2. kind: RuntimeClass

  3. metadata:

  4. name: not-trusted

  5. handler: runsc

  [desk@cli] $ k apply -f runtime.yaml

  [desk@cli] $ k get pods

  1. NAME READY STATUS RESTARTS AGE

  2. nginx-6798fc88e8-chp6r 1/1 Running 0 11m

  3. nginx-6798fc88e8-fs53n 1/1 Running 0 11m

  4. nginx-6798fc88e8-ndved 1/1 Running 0 11m

  [desk@cli] $ k get deploy

  1. NAME READY UP-TO-DATE AVAILABLE AGE

  2. nginx 3/3 11 3 5m

  [desk@cli] $ k edit deploy nginx

  

• Question 5:

  Fix all issues via configuration and restart the affected components to ensure the new setting takes effect. Fix all of the following violations that were found against the API server:

  1. Ensure that the RotateKubeletServerCertificate argument is set to true.

  2. Ensure that the admission control plugin PodSecurityPolicy is set.

  3. Ensure that the --kubelet-certificate-authority argument is set as appropriate. Fix all of the following violations that were found against the Kubelet:

  1. Ensure the --anonymous-auth argument is set to false.

  2. Ensure that the --authorization-mode argument is set to Webhook. Fix all of the following violations that were found against the ETCD:

  1. Ensure that the --auto-tls argument is not set to true

  2. Ensure that the --peer-auto-tls argument is not set to true

  Hint: Take the use of Tool Kube-Bench

  A. See the below.
  B. PlaceHolder
  A. See the below.

  ---

  Explanation/Reference:

  Fix all of the following violations that were found against the API server:

  a. Ensure that the RotateKubeletServerCertificate argument is set to true.

  apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers:

  -command:

  -kube-controller-manager + - --feature-gates=RotateKubeletServerCertificate=true image: gcr.io/google_containers/kubelet-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kubelet resources: requests: cpu: 250m volumeMounts:

  -mountPath: /etc/kubernetes/ name: k8s readOnly: true

  -mountPath: /etc/ssl/certs name: certs

  -mountPath: /etc/pki name: pki hostNetwork: true volumes:

  -hostPath: path: /etc/kubernetes name: k8s

  -hostPath: path: /etc/ssl/certs name: certs

  -hostPath: path: /etc/pki name: pki

  b.

  Ensure that the admission control plugin PodSecurityPolicy is set.

  audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"

  tests:

  test_items:

  -flag: "--enable-admission-plugins"

  compare:

  op: has

  value: "PodSecurityPolicy"

  set: true

  remediation: |

  Follow the documentation and create Pod Security Policy objects as per your environment.

  Then, edit the API server pod specification file $apiserverconf

  on the master node and set the --enable-admission-plugins parameter to a

  value that includes PodSecurityPolicy :

  --enable-admission-plugins=...,PodSecurityPolicy,...

  Then restart the API Server.

  scored: true

  c. Ensure that the --kubelet-certificate-authority argument is set as appropriate. audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"

  tests: test_items:

  -flag: "--kubelet-certificate-authority"

  set: true

  remediation: |

  Follow the Kubernetes documentation and setup the TLS connection between the

  apiserver and kubelets. Then, edit the API server pod specification file

  $apiserverconf on the master node and set the --kubelet-certificate-authority

  parameter to the path to the cert file for the certificate authority.

  --kubelet-certificate-authority=

  scored: true

  Fix all of the following violations that were found against the ETCD:

  a. Ensure that the --auto-tls argument is not set to true Edit the etcd pod specification file $etcdconf on the masternode and either remove the -- auto-tls parameter or set it to false.--auto-tls=false

  b. Ensure that the --peer-auto-tls argument is not set to true

  Edit the etcd pod specification file $etcdconf on the masternode and either remove the -- peer-auto-tls parameter or set it to false.--peer-auto-tls=false

• Question 6:

  CORRECT TEXT

  

  A PodSecurityPolicy shall prevent the creation of privileged Pods in a specific namespace.

  Task

  Create a new PodSecurityPolicy named prevent-psp-policy,which prevents the creation of privileged Pods.

  Create a new ClusterRole named restrict-access-role, which uses the newly created PodSecurityPolicy prevent-psp-policy.

  Create a new ServiceAccount named psp-restrict-sa in the existing namespace staging.

  Finally, create a new ClusterRoleBinding named restrict-access-bind, which binds the newly created ClusterRole restrict-access-role to the newly created ServiceAccount psp- restrict-sa.

  

  A. See explanation below.
  B. PlaceHolder
  A. See explanation below.

  ---

  Explanation/Reference:

  

  

  

  

  

  

  

  

  

  

  

  

  

• Question 7:

  Context:

  Cluster: prod

  Master node: master1

  Worker node: worker1

  You can switch the cluster/configuration context using the following command:

  [desk@cli] $ kubectl config use-context prod

  Task:

  Analyse and edit the given Dockerfile (based on the ubuntu:18:04 image)

  /home/cert_masters/Dockerfile fixing two instructions present in the file being prominent security/best-practice issues.

  Analyse and edit the given manifest file

  /home/cert_masters/mydeployment.yaml fixing two fields present in the file being prominent security/best-practice issues.

  Note: Don't add or remove configuration settings; only modify the existing configuration settings, so that two configuration settings each are no longer security/best-practice concerns.

  Should you need an unprivileged user for any of the tasks, use user nobody with user id 65535

  A. See the explanation below
  B. PlaceHolder
  A. See the explanation below

  ---

  Explanation/Reference:

  1. For Dockerfile: Fix the image version and user name in Dockerfile

  2. For mydeployment.yaml : Fix security contexts

  Explanation[desk@cli] $ vim /home/cert_masters/Dockerfile FROM ubuntu:latest # Remove this FROM ubuntu:18.04 # Add this USER root # Remove this USER nobody # Add this RUN apt get install -y lsof=4.72 wget=1.17.1 nginx=4.2 ENV ENVIRONMENT=testing USER root # Remove this USER nobody # Add this CMD ["nginx -d"]

  

  Text

  [desk@cli] $ vim /home/cert_masters/mydeployment.yaml

  apiVersion: apps/v1

  kind: Deployment

  metadata:

  creationTimestamp: null

  labels:

  app: kafka

  name: kafka

  spec:

  replicas: 1

  selector:

  matchLabels:

  app: kafka

  strategy: {}

  template:

  metadata:

  creationTimestamp: null

  labels:

  app: kafka

  spec:

  containers:

  -image: bitnami/kafka

  name: kafka

  volumeMounts:

  -

  name: kafka-vol

  mountPath: /var/lib/kafka

  securityContext:

  {"capabilities":{"add":["NET_ADMIN"],"drop":["all"]},"privileged":

  True,"readOnlyRootFilesystem": False, "runAsUser": 65535} # Delete This {"capabilities":{"add":["NET_ADMIN"],"drop":["all"]},"privileged":

  False,"readOnlyRootFilesystem": True, "runAsUser": 65535} # Add This resources: {}

  volumes:

  -

  name: kafka-vol

  emptyDir: {}

  status: {}

  Pictorial View:[desk@cli] $ vim /home/cert_masters/mydeployment.yaml

  

• Question 8:

  You must complete this task on the following cluster/nodes: Cluster: immutable-cluster

  Master node: master1

  Worker node: worker1

  You can switch the cluster/configuration context using the following command:

  [desk@cli] $ kubectl config use-context immutable-cluster

  Context: It is best practice to design containers to be stateless and immutable.

  Task:

  Inspect Pods running in namespace prod and delete any Pod that is either not stateless or not immutable.

  Use the following strict interpretation of stateless and immutable:

  1. Pods being able to store data inside containers must be treated as not stateless.

  Note: You don't have to worry whether data is actually stored inside containers or not already.

  2. Pods being configured to be privileged in any way must be treated as potentially not stateless or not immutable.

  A. See the explanation below
  B. PlaceHolder
  A. See the explanation below

  ---

  Explanation/Reference:

  

  

• Question 9:

  Create a new NetworkPolicy named deny-all in the namespace testing which denies all traffic of type ingress and egress traffic

  A. See the explanation below:
  B. PlaceHolder
  A. See the explanation below:

  ---

  Explanation/Reference:

  You can create a "default" isolation policy for a namespace by creating a NetworkPolicy that selects all pods but does not allow any ingress traffic to those pods.

  apiVersion: networking.k8s.io/v1

  kind: NetworkPolicy

  metadata:

  name: default-deny-ingress

  spec:

  podSelector: {}

  policyTypes:

  -Ingress

  You can create a "default" egress isolation policy for a namespace by creating a NetworkPolicy that selects all pods but does not allow any egress traffic from those pods.

  apiVersion: networking.k8s.io/v1

  kind: NetworkPolicy

  metadata:

  name: allow-all-egress

  spec:

  podSelector: {}

  egress:

  -{} policyTypes:

  -Egress

  Default deny all ingress and all egress traffic

  You can create a "default" policy for a namespace which prevents all ingress AND egress traffic by creating the following NetworkPolicy in that namespace.

  apiVersion: networking.k8s.io/v1

  kind: NetworkPolicy

  metadata:

  name: default-deny-all

  spec:

  podSelector: {}

  policyTypes:

  -Ingress

  -Egress

  This ensures that even pods that aren't selected by any other NetworkPolicy will not be allowed ingress or egress traffic.

• Question 10:

  You must complete this task on the following cluster/nodes:

  Cluster: trace Master node: master Worker node: worker1

  You can switch the cluster/configuration context using the following command:

  [desk@cli] $ kubectl config use-context trace

  Given: You may use Sysdig or Falco documentation.

  Task:

  Use detection tools to detect anomalies like processes spawning and executing something weird frequently in the single container belonging to Pod tomcat.

  Two tools are available to use:

  1. falco

  2. sysdig

  Tools are pre-installed on the worker1 node only.

  Analyse the container's behaviour for at least 40 seconds, using filters that detect newly spawning and executing processes.

  Store an incident file at /home/cert_masters/report, in the following format:

  [timestamp],[uid],[processName]

  Note: Make sure to store incident file on the cluster's worker node, don't move it to master node.

  A. See the explanation below
  B. PlaceHolder
  A. See the explanation below

  ---

  Explanation/Reference:

  $vim /etc/falco/falco_rules.local.yaml uk.co.certification.simulator.questionpool.PList@120e24d0 $kill -1 Explanation[desk@cli] $ ssh node01[node01@cli] $ vim /etc/falco/falco_rules.yamlsearch for Container Drift Detected and paste in falco_rules.local.yaml[node01@cli] $ vim /etc/falco/falco_rules.local.yaml

  -rule: Container Drift Detected (open+create) desc: New executable created in a container due to open+create condition: > evt.type in (open,openat,creat) and evt.is_open_exec=true and container and not runc_writing_exec_fifo and not runc_writing_var_lib_docker and not user_known_container_drift_activities and evt.rawres>=0 output: > %evt.time,%user.uid,%proc.name # Add this/Refer falco documentation priority: ERROR [node01@cli] $ vim /etc/falco/falco.yaml