Linux Foundation CKS Online Practice Questions and Exam Preparation

Linux Foundation CKS Online Questions & Answers

• Question 21:

  On the Cluster worker node, enforce the prepared AppArmor profile

  1. #include

  2. profile nginx-deny flags=(attach_disconnected) {

  3. #include

  4. file,

  5. # Deny all file writes.

  6. deny /** w,

  7. }

  8. EOF'

  Edit the prepared manifest file to include the AppArmor profile.

  1. apiVersion: v1

  2. kind: Pod

  3. metadata:

  4. name: apparmor-pod

  5. spec:

  6. containers:

  7. - name: apparmor-pod

  8. image: nginx

  Finally, apply the manifests files and create the Pod specified on it.

  Verify: Try to make a file inside the directory which is restricted.

  A. See explanation below.
  B. PlaceHolder
  A. See explanation below.

  ---

  Explanation/Reference:

  

  

  

• Question 22:

  1. Retrieve the content of the existing secret named default-token-xxxxx in the testing namespace.

  Store the value of the token in the token.txt

  2. Create a new secret named test-db-secret in the DB namespace with the following content:

  username: mysql password: password@123

  Create the Pod name test-db-pod of image nginx in the namespace db that can access test-db-secret via a volume at path /etc/mysql-credentials

  A. See the explanation below:
  B. PlaceHolder
  A. See the explanation below:

  ---

  Explanation/Reference:

  To add a Kubernetes cluster to your project, group, or instance:

  1. Navigate to your:

  2. Click Add Kubernetes cluster.

  3. Click the Add existing cluster tab and fill in the details:

  Get the API URL by running this command:

  kubectl cluster-info | grep -E 'Kubernetes master|Kubernetes control plane' | awk '/http/ {print $NF}'

  uk.co.certification.simulator.questionpool.PList@113e1f90

  kubectl get secret -o jsonpath="{['data']['ca\.crt']}"

• Question 23:

  Create a Pod name Nginx-pod inside the namespace testing, Create a service for the Nginx-pod named nginx-svc, using the ingress of your choice, run the ingress on tls, secure port.

  A. See explanation below.
  B. PlaceHolder
  A. See explanation below.

  ---

  Explanation/Reference:

  $ kubectl get ing -n NAME HOSTS ADDRESS PORTS AGE cafe-ingress cafe.com 10.0.2.15 80 25s

  $ kubectl describe ing -n Name: cafe-ingress Namespace: default Address: 10.0.2.15 Default backend: default-http-backend:80 (172.17.0.5:8080) Rules: Host Path Backends

  cafe.com

  /tea tea-svc:80 ()

  /coffee coffee-svc:80 ()

  Annotations:

  kubectl.kubernetes.io/last-applied-configuration:

  {"apiVersion":"networking.k8s.io/v1","kind":"Ingress","metadata":{"annotations":{},"name":"c afe-ingress","namespace":"default","selfLink":"/apis/networking/v1/namespaces/default/ingress es/cafe-ingress"},"spec":{"rules":

  [{"host":"cafe.com","http":{"paths":[{"backend":{"serviceName":"tea- svc","servicePort":80},"path":"/tea"},{"backend":{"serviceName":"coffee- svc","servicePort":80},"path":"/coffee"}]}}]},"status":{"loadBalancer":{"ingress":

  [{"ip":"169.48.142.110"}]}}}

  Events:

  Type Reason Age From Message

  Normal CREATE 1m ingress-nginx-controller Ingress default/cafe-ingress Normal UPDATE 58s ingress-nginx-controller Ingress default/cafe-ingress $ kubectl get pods -n NAME READY STATUS RESTARTS AGE ingress-nginx-controller-67956bf89d-fv58j 1/1 Running 0 1m

  $ kubectl logs -n ingress-nginx-controller-67956bf89d-fv58j ---------------------------------------------------------------------------------------------------- NGINX Ingress controller Release: 0.14.0 Build: git-734361d Repository: https://github.com/kubernetes/ingress-nginx

• Question 24:

  A container image scanner is set up on the cluster.

  Given an incomplete configuration in the directory

  /etc/kubernetes/confcontrol and a functional container image scanner with HTTPS endpoint https://test-server.local.8081/image_policy

  1. Enable the admission plugin.

  2. Validate the control configuration and change it to implicit deny.

  Finally, test the configuration by deploying the pod having the image tag as latest.

  A. See explanation below.
  B. PlaceHolder
  A. See explanation below.

  ---

  Explanation/Reference:

  ssh-add ~/.ssh/tempprivate eval "$(ssh-agent -s)" cd contrib/terraform/aws vi terraform.tfvars terraform init terraform apply -var-file=credentials.tfvars ansible-playbook -i ./inventory/hosts ./cluster.yml -e ansible_ssh_user=core -e bootstrap_os=coreos -b --become-user=root --flush-cache -e ansible_user=core

  

• Question 25:

  The kubeadm-created cluster's Kubernetes API server was, for testing purposes, temporarily configured to allow unauthenticated and unauthorized access granting the anonymous user duster-admin access.

  

  Task

  Reconfigure the cluster's Kubernetes API server to ensure that only authenticated and authorized REST requests are allowed.

  Use authorization mode Node,RBAC and admission controller NodeRestriction.

  Cleaning up, remove the ClusterRoleBinding for user system:anonymous.

  

  A. See explanation below.
  B. PlaceHolder
  A. See explanation below.

  ---

  Explanation/Reference:

  

  

  

  

  

• Question 26:

  You can switch the cluster/configuration context using the following command:

  [desk@cli] $ kubectl config use-context dev

  A default-deny NetworkPolicy avoid to accidentally expose a Pod in a namespace that doesn't have any other NetworkPolicy defined.

  Task: Create a new default-deny NetworkPolicy named deny-network in the namespace test for all traffic of type Ingress + Egress

  The new NetworkPolicy must deny all Ingress + Egress traffic in the namespace test.

  Apply the newly created default-deny NetworkPolicy to all Pods running in namespace test.

  You can find a skeleton manifests file at /home/cert_masters/network-policy.yaml

  A. See the explanation below
  B. PlaceHolder
  A. See the explanation below

  ---

  Explanation/Reference:

  master1 $ k get pods -n test --show-labels uk.co.certification.simulator.questionpool.PList@132b47c0 $ vim netpol.yaml uk.co.certification.simulator.questionpool.PList@132b4af0 master1 $ k apply -f netpol.yaml

  controlplane $ k get pods -n test --show-labels NAME READY STATUS RESTARTS AGE LABELS test-pod 1/1 Running 0 34s role=test,run=test-pod testing 1/1 Running 0 17d run=testing master1 $ vim netpol1.yaml apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-network namespace: test spec: podSelector: {} policyTypes:

  -Ingress

  -Egress

• Question 27:

  CORRECT TEXT

  

  Context

  This cluster uses containerd as CRI runtime.

  Containerd's default runtime handler is runc. Containerd has been prepared to support an additional runtime handler, runsc (gVisor).

  Task

  Create a RuntimeClass named sandboxed using the prepared runtime handler named runsc.

  Update all Pods in the namespace server to run on gVisor.

  

  A. See the explanation below
  B. PlaceHolder
  A. See the explanation below

  ---

  Explanation/Reference:

  

  

  

  

  

  

  

  

  

• Question 28:

  Cluster: qa-cluster

  Master node: master Worker node: worker1 You can switch the cluster/configuration context using the following command: [desk@cli] $ kubectl config use-context qa-cluster

  Task:

  Create a NetworkPolicy named restricted-policy to restrict access to Pod product running in namespace dev.

  Only allow the following Pods to connect to Pod products-service:

  1. Pods in the namespace qa

  2. Pods with label environment: stage, in any namespace

  A. See the below.
  B. PlaceHolder
  A. See the below.

  ---

  Explanation/Reference:

  

  

  

  

• Question 29:

  Cluster: dev Master node: master1 Worker node: worker1 You can switch the cluster/configuration context using the following command: [desk@cli] $ kubectl config use-context dev Task:

  Retrieve the content of the existing secret named adam in the safe namespace.

  Store the username field in a file names /home/cert-masters/username.txt, and the password field in a file named /home/cert-masters/password.txt.

  1. You must create both files; they don't exist yet.

  2. Do not use/modify the created files in the following steps, create new temporary files if needed.

  Create a new secret names newsecret in the safe namespace, with the following content:

  Username: dbadmin Password: moresecurepas

  Finally, create a new Pod that has access to the secret newsecret via a volume:

  Namespace:safe Pod name:mysecret-pod Container name:db-container Image:redis Volume name:secret-vol Mount path:/etc/mysecret

  A. See the explanation below
  B. PlaceHolder
  A. See the explanation below

  ---

  Explanation/Reference:

  

  

  

  

• Question 30:

  CORRECT TEXT Context

  

  A default-deny NetworkPolicy avoids to accidentally expose a Pod in a namespace that doesn't have any other NetworkPolicy defined.

  Task

  Create a new default-deny NetworkPolicy named defaultdeny in the namespace testing for all traffic of type Egress.

  The new NetworkPolicy must deny all Egress traffic in the namespace testing.

  Apply the newly created default-deny NetworkPolicy to all Pods running in namespace testing.

  

  A. See explanation below.
  B. PlaceHolder
  A. See explanation below.

  ---

  Explanation/Reference: