Linux Foundation CKS Online Practice Questions and Exam Preparation

Linux Foundation CKS Online Questions & Answers

• Question 31:

  Task

  

  Analyze and edit the given Dockerfile /home/candidate/KSSC00301/Docker file (based on the ubuntu:16.04 image), fixing two instructions present in the file that are prominent security/best-practice issues. Analyze and edit the given manifest file /home/candidate/KSSC00301/deployment.yaml, fixing two fields present in the file that are prominent security/best-practice issues.

  

  A. See explanation below.
  B. PlaceHolder
  A. See explanation below.

  ---

  Explanation/Reference:

  

  

  

  

• Question 32:

  Create a new ServiceAccount named backend-sa in the existing namespace default, which has the capability to list the pods inside the namespace default.

  Create a new Pod named backend-pod in the namespace default, mount the newly created sa backend-sa to the pod, and Verify that the pod is able to list pods.

  Ensure that the Pod is running.

  A. See the below:
  B. PlaceHolder
  A. See the below:

  ---

  Explanation/Reference:

  A service account provides an identity for processes that run in a Pod.

  When you (a human) access the cluster (for example, using kubectl), you are authenticated by the apiserver as a particular User Account (currently this is usually admin, unless your cluster administrator has customized your cluster). Processes in containers inside pods can also contact the apiserver. When they do, they are authenticated as a particular Service Account (for example, default).

  When you create a pod, if you do not specify a service account, it is automatically assigned the default service account in the same namespace. If you get the raw json or yaml for a pod you have created (for example, kubectl get pods/ -o yaml), you can see the spec.serviceAccountName field has been automatically set. You can access the API from inside a pod using automatically mounted service account credentials, as described in Accessing the Cluster. The API permissions of the service account depend on the authorization plugin and policy in use. In version 1.6+, you can opt out of automounting API credentials for a service account by setting automountServiceAccountToken: false on the service account:

  apiVersion: v1 kind: ServiceAccount metadata: name: build-robot automountServiceAccountToken: false

  In version 1.6+, you can also opt out of automounting API credentials for a particular pod: apiVersion: v1 kind: Pod metadata: name: my-pod spec: serviceAccountName: build-robot automountServiceAccountToken: false

  The pod spec takes precedence over the service account if both specify a automountServiceAccountToken value.

• Question 33:

  Create a PSP that will prevent the creation of privileged pods in the namespace.

  Create a new PodSecurityPolicy named prevent-privileged-policy which prevents the creation of privileged pods.

  Create a new ServiceAccount named psp-sa in the namespace default.

  Create a new ClusterRole named prevent-role, which uses the newly created Pod Security Policy prevent-privileged-policy.

  Create a new ClusterRoleBinding named prevent-role-binding, which binds the created ClusterRole prevent-role to the created SA psp-sa.

  Also, Check the Configuration is working or not by trying to Create a Privileged pod, it should get failed.

  A. See the below.
  B. PlaceHolder
  A. See the below.

  ---

  Explanation/Reference:

  Create a PSP that will prevent the creation of privileged pods in the namespace. $ cat clusterrole-use-privileged.yaml apiVersion: rbac.authorization.k8s.io/v1

  kind: ClusterRole metadata: name: use-privileged-psp rules:

  -apiGroups: ['policy']

  resources: ['podsecuritypolicies']

  verbs: ['use']

  resourceNames:

  -default-psp

  apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: privileged-role-bind namespace: psp-test roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: use-privileged-psp subjects:

  -kind: ServiceAccount name: privileged-sa $ kubectl -n psp-test apply -f clusterrole-use-privileged.yaml

  After a few moments, the privileged Pod should be created.

  Create a new PodSecurityPolicy named prevent-privileged-policy which prevents the creation of privileged pods.

  apiVersion: policy/v1beta1

  kind: PodSecurityPolicy

  metadata:

  name: example

  spec:

  privileged: false # Don't allow privileged pods!

  # The rest fills in some required fields.

  seLinux:

  rule: RunAsAny

  supplementalGroups:

  rule: RunAsAny

  runAsUser:

  rule: RunAsAny

  fsGroup:

  rule: RunAsAny

  volumes:

  -'*'

  And create it with kubectl:

  kubectl-admin create -f example-psp.yaml

  Now, as the unprivileged user, try to create a simple pod:

  kubectl-user create -f- <

  apiVersion: v1

  kind: Pod

  metadata:

  name: pause

  spec:

  containers:

  -name: pause

  image: k8s.gcr.io/pause

  EOF

  The output is similar to this:

  Error from server (Forbidden): error when creating "STDIN": pods "pause" is forbidden:

  unable to validate against any pod security policy: []

  Create a new ServiceAccount named psp-sa in the namespace default.

  $ cat clusterrole-use-privileged.yaml

  apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: use-privileged-psp rules:

  -apiGroups: ['policy']

  resources: ['podsecuritypolicies']

  verbs: ['use']

  resourceNames:

  -default-psp

  apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: privileged-role-bind namespace: psp-test roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: use-privileged-psp subjects:

  -kind: ServiceAccount name: privileged-sa $ kubectl -n psp-test apply -f clusterrole-use-privileged.yaml After a few moments, the privileged Pod should be created.

  Create a new ClusterRole named prevent-role, which uses the newly created Pod Security Policy prevent-privileged-policy.

  apiVersion: policy/v1beta1

  kind: PodSecurityPolicy

  metadata:

  name: example

  spec:

  privileged: false # Don't allow privileged pods!

  # The rest fills in some required fields.

  seLinux:

  rule: RunAsAny

  supplementalGroups:

  rule: RunAsAny

  runAsUser:

  rule: RunAsAny

  fsGroup:

  rule: RunAsAny

  volumes:

  -'*'

  And create it with kubectl:

  kubectl-admin create -f example-psp.yaml

  Now, as the unprivileged user, try to create a simple pod:

  kubectl-user create -f- <

  apiVersion: v1

  kind: Pod

  metadata:

  name: pause

  spec:

  containers:

  -name: pause

  image: k8s.gcr.io/pause

  EOF

  The output is similar to this:

  Error from server (Forbidden): error when creating "STDIN": pods "pause" is forbidden:

  unable to validate against any pod security policy: []

  Create a new ClusterRoleBinding named prevent-role-binding, which binds the created ClusterRole prevent-role to the created SA psp-sa.

  apiVersion: rbac.authorization.k8s.io/v1

  # This role binding allows "jane" to read pods in the "default" namespace. # You need to already have a Role named "pod-reader" in that namespace.

  kind: RoleBinding

  metadata:

  name: read-pods

  namespace: default

  subjects:

  # You can specify more than one "subject"

  -kind: User name: jane # "name" is case sensitive apiGroup: rbac.authorization.k8s.io roleRef: # "roleRef" specifies the binding to a Role / ClusterRole kind: Role #this must be Role or ClusterRole name: pod-reader # this must match the name of the Role or ClusterRole you wish to bind to apiGroup: rbac.authorization.k8s.io

  apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: namespace: default name: pod-reader rules:

  - apiGroups: [""] # "" indicates the core API group resources: ["pods"] verbs: ["get", "watch", "list"]

• Question 34:

  Service is running on port 389 inside the system, find the process-id of the process, and stores the names of all the open-files inside the /candidate/KH77539/files.txt, and also delete the binary.

  A. See explanation below.
  B. PlaceHolder
  A. See explanation below.

  ---

  Explanation/Reference:

  root# netstat -ltnup

  Active Internet connections (only servers)

  Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name

  tcp 0 0 127.0.0.1:17600 0.0.0.0:* LISTEN 1293/dropbox

  tcp 0 0 127.0.0.1:17603 0.0.0.0:* LISTEN 1293/dropbox

  tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 575/sshd

  tcp 0 0 127.0.0.1:9393 0.0.0.0:* LISTEN 900/perl

  tcp 0 0 :::80 :::* LISTEN 9583/docker-proxy

  tcp 0 0 :::443 :::* LISTEN 9571/docker-proxy

  udp 0 0 0.0.0.0:68 0.0.0.0:* 8822/dhcpcd

  root# netstat -ltnup | grep ':22'

  tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 575/sshd

  The ss command is the replacement of the netstat command.

  Now let's see how to use the ss command to see which process is listening on port 22:

  root# ss -ltnup 'sport = :22'

  Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port

  tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:("sshd",pid=575,fd=3))

• Question 35:

  Create a RuntimeClass named untrusted using the prepared runtime handler named runsc.

  Create a Pods of image alpine:3.13.2 in the Namespace default to run on the gVisor runtime class.

  A. See the explanation below:
  B. PlaceHolder
  A. See the explanation below:

  ---

  Explanation/Reference:

  

• Question 36:

  A CIS Benchmark tool was run against the kubeadm-created cluster and found multiple issues that must be addressed immediately.

  

  Fix all issues via configuration and restart the affected components to ensure the new settings take effect. Fix all of the following violations that were found against the API server:

  

  Fix all of the following violations that were found against the Kubelet:

  

  Fix all of the following violations that were found against etcd:

  

  A. See explanation below.
  B. PlaceHolder
  A. See explanation below.

  ---

  Explanation/Reference:

  

  

  

  

  

  

• Question 37:

  Given an existing Pod named nginx-pod running in the namespace test-system, fetch the service-account-name used and put the content in /candidate/KSC00124.txt

  Create a new Role named dev-test-role in the namespace test-system, which can perform update operations, on resources of type namespaces.

  Create a new RoleBinding named dev-test-role-binding, which binds the newly created Role to the Pod's ServiceAccount ( found in the Nginx pod running in namespace test- system).

  A. See explanation below.
  B. PlaceHolder
  A. See explanation below.

  ---

  Explanation/Reference:

  

  

  

• Question 38:

  Use the kubesec docker images to scan the given YAML manifest, edit and apply the advised changes, and passed with a score of 4 points.

  kubesec-test.yaml

  1. apiVersion: v1

  2. kind: Pod

  3. metadata:

  4. name: kubesec-demo

  5. spec:

  6. containers:

  7. - name: kubesec-demo

  8. image: gcr.io/google-samples/node-hello:1.0

  9. securityContext:

  10.readOnlyRootFilesystem: true

  Hint: docker run -i kubesec/kubesec:512c5e0 scan /dev/stdin < kubesec-test.yaml

  A. See explanation below.
  B. PlaceHolder
  A. See explanation below.

  ---

  Explanation/Reference:

  kubesec scan k8s-deployment.yaml cat < kubesec-test.yaml apiVersion: v1 kind: Pod metadata: name: kubesec-demo spec: containers:

  -name: kubesec-demo image: gcr.io/google-samples/node-hello:1.0 securityContext: readOnlyRootFilesystem: true EOF kubesec scan kubesec-test.yaml

  docker run -i kubesec/kubesec:512c5e0 scan /dev/stdin < kubesec-test.yaml

  kubesec http 8080 and

  [1] 12345 {"severity":"info","timestamp":"2019-0512T11:58:34.662+0100","caller":"server/server.go:69","message":"Starting HTTP server on port 8080"}

  curl -sSX POST --data-binary @test/asset/score-0-cap-sys-admin.yml http://localhost:8080/scan

  [

  {

  "object": "Pod/security-context-demo.default",

  "valid": true,

  "message": "Failed with a score of -30 points",

  "score": -30,

  "scoring": {

  "critical": [

  {

  "selector": "containers[] .securityContext .capabilities .add == SYS_ADMIN", "reason": "CAP_SYS_ADMIN is the most privileged capability and should always be avoided" },

  {

  "selector": "containers[] .securityContext .runAsNonRoot == true", "reason": "Force the running image to run as a non-root user to ensure least privilege" }, // ...

• Question 39:

  CORRECT TEXT Your organization's security policy includes:

  

  1. ServiceAccounts must not automount API credentials

  2. ServiceAccount names must end in "-sa"

  The Pod specified in the manifest file /home/candidate/KSCH00301 /pod-m

  nifest.yaml fails to schedule because of an incorrectly specified ServiceAccount.

  Complete the following tasks:

  Task

  1. Create a new ServiceAccount named frontend-sa in the existing namespace qa. Ensure the ServiceAccount does not automount API credentials.

  2. Using the manifest file at /home/candidate/KSCH00301 /pod-manifest.yaml, create the Pod.

  3. Finally, clean up any unused ServiceAccounts in namespace qa.

  A. See the explanation below
  B. PlaceHolder
  A. See the explanation below

  ---

  Explanation/Reference:

  

  

  

• Question 40:

  Cluster: scanner

  Master node: controlplane

  Worker node: worker1

  You can switch the cluster/configuration context using the following command:

  [desk@cli] $ kubectl config use-context scanner

  Given:

  You may use Trivy's documentation.

  Task:

  Use the Trivy open-source container scanner to detect images with severe vulnerabilities used by Pods in the namespace nato.

  Look for images with High or Critical severity vulnerabilities and delete the Pods that use those images.

  Trivy is pre-installed on the cluster's master node. Use cluster's master node to use Trivy.

  A. See the explanation below
  B. PlaceHolder
  A. See the explanation below

  ---

  Explanation/Reference: