Linux Foundation CKS Online Practice Questions and Exam Preparation

Linux Foundation CKS Online Questions & Answers

• Question 11:

  Analyze and edit the given Dockerfile

  1. FROM ubuntu:latest

  2. RUN apt-get update -y

  3. RUN apt-install nginx -y

  4. COPY entrypoint.sh /

  5. ENTRYPOINT ["/entrypoint.sh"]

  6. USER ROOT

  Fixing two instructions present in the file being prominent security best practice issues

  Analyze and edit the deployment manifest file

  1. apiVersion: v1

  2. kind: Pod

  3. metadata:

  4. name: security-context-demo-2

  5. spec:

  6. securityContext:

  7. runAsUser: 1000

  8. containers:

  9. - name: sec-ctx-demo-2 10.image: gcr.io/google-samples/node-hello:1.0 11.securityContext: 12.runAsUser: 0 13.privileged: True 14.allowPrivilegeEscalation: false

  Fixing two fields present in the file being prominent security best practice issues

  Don't add or remove configuration settings; only modify the existing configuration settings

  Whenever you need an unprivileged user for any of the tasks, use user test-user with the user id 5487

  A. See the explanation below:
  B. PlaceHolder
  A. See the explanation below:

  ---

  Explanation/Reference:

  FROM debian:latest MAINTAINER [email protected]

  # 1 - RUN RUN apt-get update andand DEBIAN_FRONTEND=noninteractive apt-get install -yq apt-utils RUN DEBIAN_FRONTEND=noninteractive apt-get install -yq htop RUN apt-get clean

  # 2 - CMD #CMD ["htop"] #CMD ["ls", "-l"]

  # 3 - WORKDIR and ENV WORKDIR /root ENV DZ version1 $ docker image build -t bogodevops/demo . Sending build context to Docker daemon 3.072kB

  Step 1/7 : FROM debian:latest ---> be2868bebaba

  Step 2/7 : MAINTAINER [email protected] ---> Using cache ---> e2eef476b3fd

  Step 3/7 : RUN apt-get update andand DEBIAN_FRONTEND=noninteractive apt-get install -yq apt-utils ---> Using cache ---> 32fd044c1356

  Step 4/7 : RUN DEBIAN_FRONTEND=noninteractive apt-get install -yq htop ---> Using cache ---> 0a5b514a209e

  Step 5/7 : RUN apt-get clean ---> Using cache ---> 5d1578a47c17

  Step 6/7 : WORKDIR /root ---> Using cache ---> 6b1c70e87675

  Step 7/7 : ENV DZ version1 ---> Using cache ---> cd195168c5c7 Successfully built cd195168c5c7 Successfully tagged bogodevops/demo:latest

• Question 12:

  You can switch the cluster/configuration context using the following command:

  [desk@cli] $ kubectl config use-context qa

  Context:

  A pod fails to run because of an incorrectly specified ServiceAccount

  Task:

  Create a new service account named backend-qa in an existing namespace qa, which must not have access to any secret.

  Edit the frontend pod yaml to use backend-qa service account

  Note: You can find the frontend pod yaml at /home/cert_masters/frontend-pod.yaml

  A. See the explanation below
  B. PlaceHolder
  A. See the explanation below

  ---

  Explanation/Reference:

  [desk@cli] $ k create sa backend-qa -n qasa/backend-qa created

  [desk@cli] $ k get role,rolebinding -n qaNo resources found in qa namespace.

  [desk@cli] $ k create role backend -n qa --resource pods,namespaces,configmaps --verb list# No access to secret

  [desk@cli] $ k create rolebinding backend -n qa --role backend --serviceaccount qa:backend-qa

  [desk@cli] $ vim /home/ cert_masters/frontend-pod.yaml uk.co.certification.simulator.questionpool.PList@120e0660

  [desk@cli] $ k apply -f /home/cert_masters/frontend-pod.yamlpod created

  [desk@cli] $ k create sa backend-qa -n qaserviceaccount/backend-qa created

  [desk@cli] $ k get role,rolebinding -n qaNo resources found in qa namespace.

  [desk@cli] $ k create role backend -n qa --resource pods,namespaces,configmaps --verb listrole.rbac.authorization.k8s.io/backend created

  [desk@cli] $ k create rolebinding backend -n qa --role backend --serviceaccount qa:backendqarolebinding.rbac.authorization.k8s.io/backend created [desk@cli] $ vim /home/cert_masters/frontend-pod.yaml apiVersion: v1 kind: Pod metadata: name: frontend spec: serviceAccountName: backend-qa # Add this image: nginx name: frontend

  [desk@cli] $ k apply -f /home/cert_masters/frontend-pod.yamlpod/frontend createdhttps://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

• Question 13:

  Enable audit logs in the cluster, To Do so, enable the log backend, and ensure that

  1. logs are stored at /var/log/kubernetes-logs.txt.

  2. Log files are retained for 12 days.

  3. at maximum, a number of 8 old audit logs files are retained.

  4. set the maximum size before getting rotated to 200MB

  Edit and extend the basic policy to log:

  1. namespaces changes at RequestResponse

  2. Log the request body of secrets changes in the namespace kube-system.

  3. Log all other resources in core and extensions at the Request level.

  4. Log "pods/portforward", "services/proxy" at Metadata level.

  5. Omit the Stage RequestReceived

  All other requests at the Metadata level

  A. See the explanation below:
  B. PlaceHolder
  A. See the explanation below:

  ---

  Explanation/Reference:

  Kubernetes auditing provides a security-relevant chronological set of records about a cluster. Kube-apiserver performs auditing. Each request on each stage of its execution generates an event, which is then pre-processed according to a certain policy and written to a backend. The policy determines what's recorded and the backends persist the records. You might want to configure the audit log as part of compliance with the CIS (Center for Internet Security) Kubernetes

  Benchmark controls.

  The audit log can be enabled by default using the following configuration in cluster.yml:

  services:

  kube-api:

  audit_log:

  enabled: true

  When the audit log is enabled, you should be able to see the default values at /etc/kubernetes/audit-policy.yaml

  The log backend writes audit events to a file in JSONlines format. You can configure the log audit backend using the following kube-apiserver flags:

  --audit-log-path specifies the log file path that log backend uses to write audit events. Not specifying this flag disables log backend. - means standard out --audit-log-maxage defined the maximum number of days to retain old audit log files

  --audit-log-maxbackup defines the maximum number of audit log files to retain

  --audit-log-maxsize defines the maximum size in megabytes of the audit log file before it gets rotated

  If your cluster's control plane runs the kube-apiserver as a Pod, remember to mount the hostPath to the location of the policy file and log file, so that audit records are persisted.

  For example:

  --audit-policy-file=/etc/kubernetes/audit-policy.yaml \

  --audit-log-path=/var/log/audit.log

• Question 14:

  CORRECT TEXT

  

  Two tools are pre-installed on the cluster's worker node:

  1. sysdig

  2. falco

  Using the tool of your choice (including any non pre-installed tool), analyze the container's behavior for at least 30 seconds, using filters that detect newly spawning and executing processes. Store an incident file at /opt/KSRS00101/alerts/

  details, containing the detected incidents, one per line, in the following format:

  

  The following example shows a properly formatted incident file:

  

  A. See the explanation below:
  B. PlaceHolder
  A. See the explanation below:

  ---

  Explanation/Reference:

  

  

  

  

  

• Question 15:

  You can switch the cluster/configuration context using the following command:

  [desk@cli] $ kubectl config use-context dev

  Context:

  A CIS Benchmark tool was run against the kubeadm created cluster and found multiple issues that must be addressed.

  Task:

  Fix all issues via configuration and restart the affected components to ensure the new settings take effect.

  Fix all of the following violations that were found against the API server:

  1.2.7 authorization-mode argument is not set to AlwaysAllow FAIL

  1.2.8 authorization-mode argument includes Node FAIL

  1.2.7 authorization-mode argument includes RBAC FAIL

  Fix all of the following violations that were found against the Kubelet:

  4.2.1 Ensure that the anonymous-auth argument is set to false FAIL

  4.2.2 authorization-mode argument is not set to AlwaysAllow FAIL (Use Webhook autumn/authz where possible)

  Fix all of the following violations that were found against etcd:

  2.2 Ensure that the client-cert-auth argument is set to true

  A. See the explanation below
  B. PlaceHolder
  A. See the explanation below

  ---

  Explanation/Reference:

  worker1 $ vim /var/lib/kubelet/config.yaml uk.co.certification.simulator.questionpool.PList@132b77a0 worker1 $ systemctl restart kubelet. # To reload kubelet configssh to master1master1 $ vim /etc/kubernetes/manifests/kube-apiserver.yaml- -- authorizationmode=Node,RBACmaster1 $ vim /etc/kubernetes/manifests/etcd.yaml- --client-cert- auth=true

  Explanationssh to worker1worker1 $ vim /var/lib/kubelet/config.yaml apiVersion: kubelet.config.k8s.io/v1beta1 authentication: anonymous: enabled: true #Delete this enabled: false #Replace by this webhook: cacheTTL: 0s enabled: true x509: clientCAFile: /etc/kubernetes/pki/ca.crt authorization: mode: AlwaysAllow #Delete this mode: Webhook #Replace by this webhook: cacheAuthorizedTTL: 0s cacheUnauthorizedTTL: 0s cgroupDriver: systemd clusterDNS:

  -10.96.0.10 clusterDomain: cluster.local cpuManagerReconcilePeriod: 0s evictionPressureTransitionPeriod: 0s fileCheckFrequency: 0s healthzBindAddress: 127.0.0.1 healthzPort: 10248 httpCheckFrequency: 0s imageMinimumGCAge: 0s kind: KubeletConfiguration logging: {} nodeStatusReportFrequency: 0s nodeStatusUpdateFrequency: 0s resolvConf: /run/systemd/resolve/resolv.conf rotateCertificates: true runtimeRequestTimeout: 0s staticPodPath: /etc/kubernetes/manifests streamingConnectionIdleTimeout: 0s syncFrequency: 0s volumeStatsAggPeriod: 0s worker1 $ systemctl restart kubelet. # To reload kubelet configssh to master1master1 $ vim /etc/kubernetes/manifests/kube-apiserver.yaml

  

  master1 $ vim /etc/kubernetes/manifests/etcd.yaml

• Question 16:

  Create a RuntimeClass named gvisor-rc using the prepared runtime handler named runsc.

  Create a Pods of image Nginx in the Namespace server to run on the gVisor runtime class

  A. See the explanation below:
  B. PlaceHolder
  A. See the explanation below:

  ---

  Explanation/Reference:

  Install the Runtime Class for gVisor

  { # Step 1: Install a RuntimeClass cat <

  Create a Pod with the gVisor Runtime Class

  { # Step 2: Create a pod cat <

  -name: nginx image: nginx EOF }

  Verify that the Pod is running

  { # Step 3: Get the pod kubectl get pod nginx-gvisor -o wide }

• Question 17:

  You can switch the cluster/configuration context using the following command:

  [desk@cli] $ kubectl config use-context test-account

  Task: Enable audit logs in the cluster.

  To do so, enable the log backend, and ensure that:

  1. logs are stored at /var/log/Kubernetes/logs.txt

  2. log files are retained for 5 days

  3. at maximum, a number of 10 old audit log files are retained

  A basic policy is provided at /etc/Kubernetes/logpolicy/audit-policy.yaml. It only specifies what not to log.

  Note: The base policy is located on the cluster's master node.

  Edit and extend the basic policy to log:

  1. Nodes changes at RequestResponse level

  2. The request body of persistentvolumes changes in the namespace frontend

  3. ConfigMap and Secret changes in all namespaces at the Metadata level

  Also, add a catch-all rule to log all other requests at the Metadata level Note: Don't forget to apply the modified policy.

  A. See the explanation below
  B. PlaceHolder
  A. See the explanation below

  ---

  Explanation/Reference:

  $ vim /etc/kubernetes/log-policy/audit-policy.yaml

  uk.co.certification.simulator.questionpool.PList@11602760

  $ vim /etc/kubernetes/manifests/kube-apiserver.yamlAdd these uk.co.certification.simulator.questionpool.PList@11602c70

  - --audit-log-maxbackup=10

  [desk@cli] $ ssh master1[master1@cli] $ vim /etc/kubernetes/log-policy/audit-policy.yaml

  apiVersion: audit.k8s.io/v1 # This is required.

  kind: Policy

  # Don't generate audit events for all requests in RequestReceived stage.

  omitStages:

  -"RequestReceived"

  rules:

  # Don't log watch requests by the "system:kube-proxy" on endpoints or services

  -level: None

  users: ["system:kube-proxy"]

  verbs: ["watch"]

  resources:

  -group: "" # core API group

  resources: ["endpoints", "services"]

  # Don't log authenticated requests to certain non-resource URL paths.

  -level: None

  userGroups: ["system:authenticated"]

  nonResourceURLs:

  -"/api*" # Wildcard matching.

  -"/version"

  # Add your changes below

  -

  level: RequestResponse userGroups: ["system:nodes"] # Block for nodes

  -

  level: Request resources:

  -group: "" # core API group resources: ["persistentvolumes"] # Block for persistentvolumes namespaces: ["frontend"] # Block for persistentvolumes of frontend ns

  -level: Metadata resources:

  -group: "" # core API group resources: ["configmaps", "secrets"] # Block for configmaps and secrets

  -level: Metadata # Block for everything else

  [master1@cli] $ vim /etc/kubernetes/manifests/kube-apiserver.yaml apiVersion: v1

  kind: Pod

  metadata:

  annotations:

  kubeadm.kubernetes.io/kube-apiserver.advertise-address.endpoint: 10.0.0.5:6443 labels:

  component: kube-apiserver

  tier: control-plane name: kube-apiserver namespace: kube-system spec: containers:

  -command:

  -kube-apiserver - --advertise-address=10.0.0.5 - --allow-privileged=true - --authorization-mode=Node,RBAC - --audit-policy-file=/etc/kubernetes/log-policy/audit-policy.yaml #Add this - --audit-log-path=/var/log/kubernetes/logs.txt #Add this - --audit-log-maxage=5 #Add this - --audit-log-maxbackup=10 #Add this

  output truncated

• Question 18:

  AppArmor is enabled on the cluster's worker node. An AppArmor profile is prepared, but not enforced yet.

  

  Task

  On the cluster's worker node, enforce the prepared AppArmor profile located at /etc/apparmor.d/nginx_apparmor.

  Edit the prepared manifest file located at /home/candidate/KSSH00401/nginx-pod.yaml to apply the AppArmor profile.

  Finally, apply the manifest file and create the Pod specified in it.

  A. See the explanation below
  B. PlaceHolder
  A. See the explanation below

  ---

  Explanation/Reference:

  

  

  

• Question 19:

  You can switch the cluster/configuration context using the following command:

  [desk@cli] $ kubectl config use-context prod-account

  Context:

  A Role bound to a Pod's ServiceAccount grants overly permissive permissions. Complete the following tasks to reduce the set of permissions.

  Task:

  Given an existing Pod named web-pod running in the namespace database.

  1. Edit the existing Role bound to the Pod's ServiceAccount test-sa to only allow performing get operations, only on resources of type Pods.

  2. Create a new Role named test-role-2 in the namespace database, which only allows performing update operations, only on resources of type statuefulsets.

  3. Create a new RoleBinding named test-role-2-bind binding the newly created Role to the Pod's ServiceAccount. Note: Don't delete the existing RoleBinding.

  A. See the explanation below
  B. PlaceHolder
  A. See the explanation below

  ---

  Explanation/Reference:

  

  

  

• Question 20:

  Secrets stored in the etcd is not secure at rest, you can use the etcdctl command utility to find the secret value for e.g:ETCDCTL_API=3 etcdctl get /registry/secrets/default/cks-secret --cacert="ca.crt" -- cert="server.crt" --key="server.key" Output

  

  Using the Encryption Configuration, Create the manifest, which secures the resource secrets using the provider AES-CBC and identity, to encrypt the secret-data at rest and ensure all secrets are encrypted with the new configuration.

  A. See explanation below.
  B. PlaceHolder
  A. See explanation below.

  ---

  Explanation/Reference:

  1. ETCD secret encryption can be verified with the help of etcdctl command line utility.

  2. ETCD secrets are stored at the path /registry/secrets/$namespace/$secret on the master node.

  3. The below command can be used to verify if the particular ETCD secret is encrypted or not.

  # ETCDCTL_API=3 etcdctl get /registry/secrets/default/secret1 [...] | hexdump -C