Linux-Foundation CKS Exam Questions

Master Your Preparation for the Linux-Foundation CKS

We give our customers with the finest CKS preparation material available in the form of pdf .Linux-Foundation CKS exam questions answers are carefully analyzed and crafted with the latest exam patterns by our experts. This steadfast commitment to excellence has built unbreakable trust among countless people who aspire to advance their careers. Our learning resources are designed to help our students attain an impressive score of over 97% in the Linux-Foundation CKS exam, thanks to our effective study materials. We appreciate your time and investments, ensuring you receive the best resources. Rest assured, we leave no room for error, committed to excellence.

Friendly Support Available 24/7:

If you face issues with our Linux-Foundation CKS Exam dumps, our customer support specialists are ready to assist you promptly. Your success is our priority, we believe in quality and our customers are our 1st priority. Our team is available 24/7 to offer guidance and support for your Linux-Foundation CKS exam preparation. Feel free to reach out with any questions if you find any difficulty or confusion. We are committed to ensuring you have the necessary study materials to excel.

Verified and approved Dumps for Linux-Foundation CKS:

Our team of IT experts delivers the most accurate and reliable CKS dumps for your Linux-Foundation CKS exam. All the study material is approved and verified by our team regarding Linux-Foundation CKS dumps. Our meticulously verified material, endorsed by our IT experts, ensures that you excel with distinction in the CKS exam. This top-tier resource, consisting of CKS exam questions answers, mirrors the actual exam format, facilitating effective preparation. Our committed team works tirelessly to make sure that our customers can confidently pass their exams on their first attempt, backed by the assurance that our CKS dumps are the best and have been thoroughly approved by our experts.

Linux-Foundation CKS Questions:

Embark on your certification journey with confidence as we are providing most reliable CKS dumps from Microsoft. Our commitment to your success comes with a 100% passing guarantee, ensuring that you successfully navigate your Linux-Foundation CKS exam on your initial attempt. Our dedicated team of seasoned experts has intricately designed our Linux-Foundation CKS dumps PDF to align seamlessly with the actual exam question answers. Trust our comprehensive CKS exam questions answers to be your reliable companion for acing the CKS certification.

Linux-Foundation CKS Sample Questions

use the Trivy to scan the following images, 1. amazonlinux:1 2. k8s.gcr.io/kube-controller-manager:v1.18.6 Look for images with HIGH or CRITICAL severity vulnerabilities and store the output of the same in /opt/trivy-vulnerable.txt 

Enable audit logs in the cluster, To Do so, enable the log backend, and ensure that 1. logs are stored at /var/log/kubernetes-logs.txt. 2. Log files are retained for 12 days. 3. at maximum, a number of 8 old audit logs files are retained. 4. set the maximum size before getting rotated to 200MB Edit and extend the basic policy to log: 1. namespaces changes at RequestResponse 2. Log the request body of secrets changes in the namespace kube-system. Question No : 46 CORRECT TEXT Linux Foundation CKS : Practice Test 130 3. Log all other resources in core and extensions at the Request level. 4. Log "pods/portforward", "services/proxy" at Metadata level. 5. Omit the Stage RequestReceived All other requests at the Metadata level 

Create a RuntimeClass named gvisor-rc using the prepared runtime handler named runsc. Create a Pods of image Nginx in the Namespace server to run on the gVisor runtime class

You must complete this task on the following cluster/nodes: Cluster: trace Question No : 40 CORRECT TEXT Linux Foundation CKS : Practice Test 111 Master node: master Worker node: worker1 You can switch the cluster/configuration context using the following command: [desk@cli] $ kubectl config use-context trace Given: You may use Sysdig or Falco documentation. Task: Use detection tools to detect anomalies like processes spawning and executing something weird frequently in the single container belonging to Pod tomcat. Two tools are available to use: 1. falco 2. sysdig Tools are pre-installed on the worker1 node only. Analyse the container’s behaviour for at least 40 seconds, using filters that detect newly spawning and executing processes. Store an incident file at /home/cert_masters/report, in the following format: [timestamp],[uid],[processName] Note: Make sure to store incident file on the cluster's worker node, don't move it to master node. 

Create a User named john, create the CSR Request, fetch the certificate of the user after approving it. Create a Role name john-role to list secrets, pods in namespace john Finally, Create a RoleBinding named john-role-binding to attach the newly created role john-role to the user john in the namespace john. To Verify: Use the kubectl auth CLI command to verify the permissions. 

Use the kubesec docker images to scan the given YAML manifest, edit and apply the advised changes, and passed with a score of 4 points. kubesec-test.yaml apiVersion: v1 kind: Pod metadata: name: kubesec-demo Question No : 38 CORRECT TEXT Linux Foundation CKS : Practice Test 108 spec: containers: - name: kubesec-demo image: gcr.io/google-samples/node-hello:1.0 securityContext: readOnlyRootFilesystem: true Hint: docker run -i kubesec/kubesec:512c5e0 scan /dev/stdin < kubesec-test.yaml 

Analyze and edit the given Dockerfile FROM ubuntu:latest RUN apt-get update -y RUN apt-install nginx -y COPY entrypoint.sh / ENTRYPOINT ["/entrypoint.sh"] USER ROOT Fixing two instructions present in the file being prominent security best practice issues Analyze and edit the deployment manifest file apiVersion: v1 Question No : 36 CORRECT TEXT Linux Foundation CKS : Practice Test 101 kind: Pod metadata: name: security-context-demo-2 spec: securityContext: runAsUser: 1000 containers: - name: sec-ctx-demo-2 image: gcr.io/google-samples/node-hello:1.0 securityContext: runAsUser: 0 privileged: True allowPrivilegeEscalation: false Fixing two fields present in the file being prominent security best practice issues Don't add or remove configuration settings; only modify the existing configuration settings Whenever you need an unprivileged user for any of the tasks, use user test-user with the user id 548

You can switch the cluster/configuration context using the following command: [desk@cli] $ kubectl config use-context stage Context: A PodSecurityPolicy shall prevent the creation of privileged Pods in a specific namespace. Task: 1. Create a new PodSecurityPolcy named deny-policy, which prevents the creation of privileged Pods. 2. Create a new ClusterRole name deny-access-role, which uses the newly created PodSecurityPolicy deny-policy. 3. Create a new ServiceAccount named psd-denial-sa in the existing namespace development. Finally, create a new ClusterRoleBindind named restrict-access-bind, which binds the Question No : 32 CORRECT TEXT Linux Foundation CKS : Practice Test 90 newly created ClusterRole deny-access-role to the newly created ServiceAccount pspdenial-sa

You can switch the cluster/configuration context using the following command: [desk@cli] $ kubectl config use-context qa Context: A pod fails to run because of an incorrectly specified ServiceAccount Task: Question No : 30 CORRECT TEXT Linux Foundation CKS : Practice Test 85 Create a new service account named backend-qa in an existing namespace qa, which must not have access to any secret. Edit the frontend pod yaml to use backend-qa service account Note: You can find the frontend pod yaml at /home/cert_masters/frontend-pod.yaml

Service is running on port 389 inside the system, find the process-id of the process, and stores the names of all the open-files inside the /candidate/KH77539/files.txt, and also delete the binary.

You can switch the cluster/configuration context using the following command: [desk@cli] $ kubectl config use-context test-account Task: Enable audit logs in the cluster. To do so, enable the log backend, and ensure that: 1. logs are stored at /var/log/Kubernetes/logs.txt 2. log files are retained for 5 days 3. at maximum, a number of 10 old audit log files are retained A basic policy is provided at /etc/Kubernetes/logpolicy/audit-policy.yaml. It only specifies what not to log. Note: The base policy is located on the cluster's master node. Edit and extend the basic policy to log: 1. Nodes changes at RequestResponse level 2. The request body of persistentvolumes changes in the namespace frontend 3. ConfigMap and Secret changes in all namespaces at the Metadata level Also, add a catch-all rule to log all other requests at the Metadata leve Note: Don't forget to apply the modified policy.

Create a PSP that will prevent the creation of privileged pods in the namespace. Create a new PodSecurityPolicy named prevent-privileged-policy which prevents the creation of privileged pods. Create a new ServiceAccount named psp-sa in the namespace default. Create a new ClusterRole named prevent-role, which uses the newly created Pod Security Policy prevent-privileged-policy. Create a new ClusterRoleBinding named prevent-role-binding, which binds the created ClusterRole prevent-role to the created SA psp-sa. Also, Check the Configuration is working or not by trying to Create a Privileged pod, it should get failed. 

a. Retrieve the content of the existing secret named default-token-xxxxx in the testing namespace. Store the value of the token in the token.txt b. Create a new secret named test-db-secret in the DB namespace with the following content: username: mysql password: password@123 Create the Pod name test-db-pod of image nginx in the namespace db that can access test-db-secret via a volume at path /etc/mysql-credentials