1. Home
  2. Linux Foundation
  3. CKS Exam Questions

Free CKS Exam Questions - Linux Foundation CKS Exam

Linux Foundation CKS Exam

Certified Kubernetes Security Specialist

Total Questions: 44

Based on Official Syllabus Topics of Actual Linux Foundation CKS Exam

During the preparation, you can be confused about Linux Foundation exam question types, exam pattern, and allocated time to attempt questions of the Linux Foundation Kubernetes Security Specialist certification exam. Study4Exam helps you to remove these doubts with 3 formats of its Linux Foundation CKS exam preparation. We ensure that you will easily pass the Linux Foundation Certified Kubernetes Security Specialist exam either by using CKS PDF questions or taking the practice exam is web-based and desktop formats. You can prepare CKS practice questions in PDF format at any time and from any place with smartphones, laptops, or tablets. Preparation evaluation is very helpful to remove mistakes and successfully prepare for the Linux Foundation Kubernetes Security Specialist CKS exam. The Linux Foundation Kubernetes Security Specialist CKS practice exam is one of the key steps of your exam preparation plan to identify your preparation mistakes, strengthen weaker areas of the preparation, and get familiar with the actual exam environment. Web-based and desktop Linux Foundation CKS practice exams are available to help you do self-assessment.

How these Free Questions can help you Prepare for the actual Linux Foundation CKS Exam?

Understand the Actual CKS Exam Syllabus, Format, and Question Types

Get official information about the syllabus and format of the exam to set an effective study plan. This information helps you to know what type of questions and topics will appear in the Linux Foundation CKS exam. Don’t waste your time and concentrate on such learning content which is expected in the actual exam.

Self-Asses your preparation for the actual Linux Foundation Certified Kubernetes Security Specialist Exam

Manage your daily routine to ensure that you have the proper time to study for the Linux Foundation Certified Kubernetes Security Specialist exam every day. Sit in a calm environment and do hard work daily to cover the entire CKS exam syllabus. It is not possible to study one morning and pass the CKS exam the next day. If you want to get passing marks on the first attempt, prepare for the Linux Foundation CKS exam daily.

Linux Foundation CKS Questions

Q1.

Context:

Cluster:prod

Master node:master1

Worker node:worker1

You can switch the cluster/configuration context using the following command:

[desk@cli] $kubectl config use-context prod

Task:

Analyse and edit the given Dockerfile (based on theubuntu:18:04image)

/home/cert_masters/Dockerfilefixing two instructions present in the file being prominent security/best-practice issues.

Analyse and edit the given manifest file

/home/cert_masters/mydeployment.yamlfixing two fields present in the file being prominent security/best-practice issues.

Note:Don't add or remove configuration settings; only modify the existing configuration settings, so that two configuration settings each are no longer security/best-practice concerns.

Should you need an unprivileged user for any of the tasks, use usernobodywith user id65535

Q2.

You can switch the cluster/configuration context using the following command:

[desk@cli] $kubectl config use-context stage

Context:

A PodSecurityPolicy shall prevent the creation of privileged Pods in a specific namespace.

Task:

1. Create a new PodSecurityPolcy named deny-policy, which prevents the creation of privileged Pods.

2. Create a new ClusterRole name deny-access-role, which uses the newly created PodSecurityPolicy deny-policy.

3. Create a new ServiceAccount named psd-denial-sa in the existing namespace development.

Finally, create a new ClusterRoleBindind named restrict-access-bind, which binds the newly created ClusterRole deny-access-role to the newly created ServiceAccount psp-denial-sa

Q3.

You must complete this task on the following cluster/nodes: Cluster:immutable-cluster

Master node:master1

Worker node:worker1

You can switch the cluster/configuration context using the following command:

[desk@cli] $kubectl config use-context immutable-cluster

Context: It is best practice to design containers to be stateless and immutable.

Task:

Inspect Pods running in namespaceprodand delete any Pod that is either not stateless or not immutable.

Use the following strict interpretation of stateless and immutable:

1. Pods being able to store data inside containers must be treated as not stateless.

Note:You don't have to worry whether data is actually stored inside containers or not already.

2. Pods being configured to beprivilegedin any way must be treated as potentially not stateless or not immutable.

Q4.

Cluster:admission-cluster

Master node:master

Worker node:worker1

You can switch the cluster/configuration context using the following command:

[desk@cli] $kubectl config use-context admission-cluster

Context:

A container image scanner is set up on the cluster, but it's not yet fully integrated into the cluster's configuration. When complete, the container image scanner shall scan for and reject the use of vulnerable images.

Task:

You have to complete the entire task on the cluster's master node, where all services and files have been prepared and placed.

Given an incomplete configuration in directory /etc/Kubernetes/config and a functional container image scanner with HTTPS endpoint https://imagescanner.local:8181/image_policy:

1. Enable the necessary plugins to create an image policy

2. Validate the control configuration and change it to an implicit deny

3. Edit the configuration to point to the provided HTTPS endpoint correctly

Finally, test if the configuration is working by trying to deploy the vulnerable resource /home/cert_masters/test-pod.yml

Note: You can find the container image scanner's log file at /var/log/policy/scanner.log

Q5.

Cluster:qa-cluster

Master node:masterWorker node:worker1

You can switch the cluster/configuration context using the following command:

[desk@cli] $kubectl config use-context qa-cluster

Task:

Create a NetworkPolicy namedrestricted-policyto restrict access to Podproductrunning in namespacedev.

Only allow the following Pods to connect to Pod products-service:

1. Pods in the namespaceqa

2. Pods with labelenvironment: stage, in any namespace

Solutions:
Question: 1 Answer: A
Question: 2 Answer: A
Question: 3 Answer: A
Question: 4 Answer: A
Question: 5 Answer: A

Limited Time Offer

50%

Off

Get Premium CKS Questions as Interactive Practice Test or PDF

Get Full Access for Linux Foundation CKS questions with 50% exclusive Discount

Get All Questions DemoImgs1
Disscuss Linux Foundation CKS Topics, Questions or Ask Anything Related

Currently there are no comments in this discussion, be the first to comment!