Linux Foundation CKS Online Practice Questions and Exam Preparation

Linux Foundation CKS Online Questions & Answers

• Question 1:

  A container image scanner is set up on the cluster.

  Given an incomplete configuration in the directory

  /etc/kubernetes/confcontrol and a functional container image scanner with HTTPS endpoint https://test-server.local.8081/image_policy

  1. Enable the admission plugin.

  2. Validate the control configuration and change it to implicit deny.

  Finally, test the configuration by deploying the pod having the image tag as latest.

  See explanation below.
  PlaceHolder

  ---

  explanation:

  Explanation/Reference:

  ssh-add ~/.ssh/tempprivate eval "$(ssh-agent -s)" cd contrib/terraform/aws vi terraform.tfvars terraform init terraform apply -var-file=credentials.tfvars ansible-playbook -i ./inventory/hosts ./cluster.yml -e ansible_ssh_user=core -e bootstrap_os=coreos -b --become-user=root --flush-cache -e ansible_user=core

  

• Question 2:

  Enable audit logs in the cluster, To Do so, enable the log backend, and ensure that

  1. logs are stored at /var/log/kubernetes-logs.txt.

  2. Log files are retained for 12 days.

  3. at maximum, a number of 8 old audit logs files are retained.

  4. set the maximum size before getting rotated to 200MB

  Edit and extend the basic policy to log:

  1. namespaces changes at RequestResponse

  2. Log the request body of secrets changes in the namespace kube-system.

  3. Log all other resources in core and extensions at the Request level.

  4. Log "pods/portforward", "services/proxy" at Metadata level.

  5. Omit the Stage RequestReceived

  All other requests at the Metadata level

  See the explanation below:
  PlaceHolder

  ---

  explanation:

  Explanation/Reference:

  Kubernetes auditing provides a security-relevant chronological set of records about a cluster. Kube-apiserver performs auditing. Each request on each stage of its execution generates an event, which is then pre-processed according to a certain policy and written to a backend. The policy determines what's recorded and the backends persist the records. You might want to configure the audit log as part of compliance with the CIS (Center for Internet Security) Kubernetes

  Benchmark controls.

  The audit log can be enabled by default using the following configuration in cluster.yml:

  services:

  kube-api:

  audit_log:

  enabled: true

  When the audit log is enabled, you should be able to see the default values at /etc/kubernetes/audit-policy.yaml

  The log backend writes audit events to a file in JSONlines format. You can configure the log audit backend using the following kube-apiserver flags:

  --audit-log-path specifies the log file path that log backend uses to write audit events. Not specifying this flag disables log backend. - means standard out --audit-log-maxage defined the maximum number of days to retain old audit log files

  --audit-log-maxbackup defines the maximum number of audit log files to retain

  --audit-log-maxsize defines the maximum size in megabytes of the audit log file before it gets rotated

  If your cluster's control plane runs the kube-apiserver as a Pod, remember to mount the hostPath to the location of the policy file and log file, so that audit records are persisted.

  For example:

  --audit-policy-file=/etc/kubernetes/audit-policy.yaml \

  --audit-log-path=/var/log/audit.log

• Question 3:

  CORRECT TEXT

  Task

  

  Create a NetworkPolicy named pod-access to restrict access to Pod users-service running in namespace dev-team. Only allow the following Pods to connect to Pod users-service:

  1. Pods in the namespace qa

  2. Pods with label environment: testing, in any namespace

  

  See explanation below.
  PlaceHolder

  ---

  explanation:

  Explanation/Reference:

  

  

  

  

• Question 4:

  Create a RuntimeClass named gvisor-rc using the prepared runtime handler named runsc.

  Create a Pods of image Nginx in the Namespace server to run on the gVisor runtime class

  See the explanation below:
  PlaceHolder

  ---

  explanation:

  Explanation/Reference:

  Install the Runtime Class for gVisor

  { # Step 1: Install a RuntimeClass cat <

  Create a Pod with the gVisor Runtime Class

  { # Step 2: Create a pod cat <

  -name: nginx image: nginx EOF }

  Verify that the Pod is running

  { # Step 3: Get the pod kubectl get pod nginx-gvisor -o wide }

• Question 5:

  CORRECT TEXT Context

  

  A default-deny NetworkPolicy avoids to accidentally expose a Pod in a namespace that doesn't have any other NetworkPolicy defined.

  Task

  Create a new default-deny NetworkPolicy named defaultdeny in the namespace testing for all traffic of type Egress.

  The new NetworkPolicy must deny all Egress traffic in the namespace testing.

  Apply the newly created default-deny NetworkPolicy to all Pods running in namespace testing.

  

  See explanation below.
  PlaceHolder

  ---

  explanation:

  Explanation/Reference:

  

  

  

• Question 6:

  CORRECT TEXT

  

  Context

  This cluster uses containerd as CRI runtime.

  Containerd's default runtime handler is runc. Containerd has been prepared to support an additional runtime handler, runsc (gVisor).

  Task

  Create a RuntimeClass named sandboxed using the prepared runtime handler named runsc.

  Update all Pods in the namespace server to run on gVisor.

  

  See the explanation below
  PlaceHolder

  ---

  explanation:

  Explanation/Reference:

  

  

  

  

  

  

  

  

  

• Question 7:

  Create a RuntimeClass named untrusted using the prepared runtime handler named runsc.

  Create a Pods of image alpine:3.13.2 in the Namespace default to run on the gVisor runtime class.

  See the explanation below:
  PlaceHolder

  ---

  explanation:

  Explanation/Reference:

  

• Question 8:

  You must complete this task on the following cluster/nodes:

  Cluster: trace Master node: master Worker node: worker1

  You can switch the cluster/configuration context using the following command:

  [desk@cli] $ kubectl config use-context trace

  Given: You may use Sysdig or Falco documentation.

  Task:

  Use detection tools to detect anomalies like processes spawning and executing something weird frequently in the single container belonging to Pod tomcat.

  Two tools are available to use:

  1. falco

  2. sysdig

  Tools are pre-installed on the worker1 node only.

  Analyse the container's behaviour for at least 40 seconds, using filters that detect newly spawning and executing processes.

  Store an incident file at /home/cert_masters/report, in the following format:

  [timestamp],[uid],[processName]

  Note: Make sure to store incident file on the cluster's worker node, don't move it to master node.

  See the explanation below
  PlaceHolder

  ---

  explanation:

  Explanation/Reference:

  $vim /etc/falco/falco_rules.local.yaml uk.co.certification.simulator.questionpool.PList@120e24d0 $kill -1 Explanation[desk@cli] $ ssh node01[node01@cli] $ vim /etc/falco/falco_rules.yamlsearch for Container Drift Detected and paste in falco_rules.local.yaml[node01@cli] $ vim /etc/falco/falco_rules.local.yaml

  -rule: Container Drift Detected (open+create) desc: New executable created in a container due to open+create condition: > evt.type in (open,openat,creat) and evt.is_open_exec=true and container and not runc_writing_exec_fifo and not runc_writing_var_lib_docker and not user_known_container_drift_activities and evt.rawres>=0 output: > %evt.time,%user.uid,%proc.name # Add this/Refer falco documentation priority: ERROR [node01@cli] $ vim /etc/falco/falco.yaml

• Question 9:

  Create a User named john, create the CSR Request, fetch the certificate of the user after approving it.

  Create a Role name john-role to list secrets, pods in namespace john

  Finally, Create a RoleBinding named john-role-binding to attach the newly created role john-role to the user john in the namespace john.

  To Verify: Use the kubectl auth CLI command to verify the permissions.

  See the below.
  PlaceHolder

  ---

  explanation:

  Explanation/Reference:

  se kubectl to create a CSR and approve it.

  Get the list of CSRs:

  kubectl get csr

  Approve the CSR:

  kubectl certificate approve myuser

  Get the certificateRetrieve the certificate from the CSR:

  kubectl get csr/myuser -o yaml

  here are the role and role-binding to give john permission to create NEW_CRD resource:

  kubectl apply -f roleBindingJohn.yaml --as=john

  rolebinding.rbac.authorization.k8s.io/john_external-rosource-rb created

  kind: RoleBinding

  apiVersion: rbac.authorization.k8s.io/v1

  metadata:

  name: john_crd

  namespace: development-john

  subjects:

  -kind: User name: john apiGroup: rbac.authorization.k8s.io roleRef: kind: ClusterRole name: crd-creation

  kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: crd-creation rules:

  -apiGroups: ["kubernetes-client.io/v1"] resources: ["NEW_CRD"] verbs: ["create, list, get"]

• Question 10:

  Use the kubesec docker images to scan the given YAML manifest, edit and apply the advised changes, and passed with a score of 4 points.

  kubesec-test.yaml

  1. apiVersion: v1

  2. kind: Pod

  3. metadata:

  4. name: kubesec-demo

  5. spec:

  6. containers:

  7. - name: kubesec-demo

  8. image: gcr.io/google-samples/node-hello:1.0

  9. securityContext:

  10.readOnlyRootFilesystem: true

  Hint: docker run -i kubesec/kubesec:512c5e0 scan /dev/stdin < kubesec-test.yaml

  See explanation below.
  PlaceHolder

  ---

  explanation:

  Explanation/Reference:

  kubesec scan k8s-deployment.yaml cat < kubesec-test.yaml apiVersion: v1 kind: Pod metadata: name: kubesec-demo spec: containers:

  -name: kubesec-demo image: gcr.io/google-samples/node-hello:1.0 securityContext: readOnlyRootFilesystem: true EOF kubesec scan kubesec-test.yaml

  docker run -i kubesec/kubesec:512c5e0 scan /dev/stdin < kubesec-test.yaml

  kubesec http 8080 and

  [1] 12345 {"severity":"info","timestamp":"2019-0512T11:58:34.662+0100","caller":"server/server.go:69","message":"Starting HTTP server on port 8080"}

  curl -sSX POST --data-binary @test/asset/score-0-cap-sys-admin.yml http://localhost:8080/scan

  [

  {

  "object": "Pod/security-context-demo.default",

  "valid": true,

  "message": "Failed with a score of -30 points",

  "score": -30,

  "scoring": {

  "critical": [

  {

  "selector": "containers[] .securityContext .capabilities .add == SYS_ADMIN", "reason": "CAP_SYS_ADMIN is the most privileged capability and should always be avoided" },

  {

  "selector": "containers[] .securityContext .runAsNonRoot == true", "reason": "Force the running image to run as a non-root user to ensure least privilege" }, // ...