CKS Exam Questions

Create a new ServiceAccount named backend-sa in the existing namespace default, which has the capability to list the pods inside the namespace default. Create a new Pod named backe...

Create a new ServiceAccount backend-sa in the existing namespace default, which has the capability to list the pods inside the namespace default. Create a new Pod named backend-pod...

Fix all issues via configuration and restart the affected components to ensure the new setting takes effect. Fix all of the following violations that were found against the API ser...

Fix all issues via configuration and restart the affected components to ensure the new setting takes effect. Fix all of the following violations that were found against the API ser...

Ensure that the --authorization-mode argument is set to Webhook.

Ensure that the --profiling argument is set to false

Fix all of the following violations that were found against the Kubelet:- Ensure the --anonymous-auth argument is set to false.

Fix the following violation found against ETCD: Ensure that the --auto-tls argument is not set to true. (This fix is to be applied during buildtime.)

Create a PSP that will prevent the creation of privileged pods in the namespace. Create a new PodSecurityPolicy named prevent-privileged-policy which prevents the creation of privi...

Fix all of the following violations that were found against the ETCD:- a. Ensure that the --auto-tls argument is not set to true

A Role bound to a Pod's ServiceAccount grants overly permissive permissions. Complete the following tasks to reduce the set of permissions.

Given an existing Pod named web-pod running in the namespace security. Edit the existing Role bound to the Pod's ServiceAccount sa-dev-1 to only allow performing watch operations,...

Question: 5 SIMULATION Enable audit logs in the cluster, To Do so, enable the log backend, and ensure that 1. logs are stored at /var/log/kubernetes-logs.txt. 2. Log files are reta...

Question: 6 SIMULATION Analyze and edit the given Dockerfile FROM ubuntu:latest RUN apt-get update -y RUN apt-get install nginx -y COPY entrypoint.sh / ENTRYPOINT ["/entrypoint.sh"...

Task: Given an existing Pod named web-pod running in the namespace security. Edit the existing Role bound to the Pod's ServiceAccount sa-dev-1 to only allow performing watch operat...

Create a RuntimeClass named gvisor-rc using the prepared runtime handler named runsc. Create a Pods of image Nginx in the Namespace server to run on the gVisor runtime class

Question: 5 SIMULATION. Enable audit logs in the cluster, To Do so, enable the log backend, and ensure that: 1. logs are stored at /var/log/kubernetes-logs.txt. 2. Log files are re...

Question: 6 SIMULATION. Analyze and edit the given Dockerfile FROM ubuntu:latest RUN apt-get update -y RUN apt-get install nginx -y COPY entrypoint.sh / ENTRYPOINT ["/entrypoint.sh...

Create a NetworkPolicy named pod-access to restrict access to Pod users-service running in namespace dev-team.

Given the following container configuration: ```yaml runAsUser: 1000 containers: - name: sec-ctx-demo-2 image: gcr.io/google-samples/node-hello:1.0 securityContext: runAsUser: 0 pr...

Only allow the following Pods to connect to Pod users-service: - Pods in the namespace qa - Pods with label environment: testing, in any namespace Make sure to apply the NetworkPol...

A container image scanner is set up on the cluster. Given an incomplete configuration in the directory /etc/kubernetes/confcontrol and a functional container image scanner with HTT...

Given the following AppArmor profile and Pod manifest: AppArmor Profile: ``` profile nginx-deny flags=(attach_disconnected) { #include <abstractions/base> file, # Deny all file wri...

On the Cluster worker node, enforce the prepared AppArmor profile

Create a new NetworkPolicy named deny-all in the namespace testing which denies all traffic of type ingress and egress traffic

a. Retrieve the content of the existing secret named default-token-xxxxx in the testing namespace. Store the value of the token in the token.txt b. Create a new secret named test-d...

a. Retrieve the content of the existing secret named default-token-xxxxx in the testing namespace. Store the value of the token in the token.txt. b. Create a new secret named test-...

use the Trivy to scan the following images, 1. amazonlinux:1 2. k8s.gcr.io/kube-controller-manager:v1.18.6 Look for images with HIGH or CRITICAL severity vulnerabilities and store...

Create a RuntimeClass named untrusted using the prepared runtime handler named runsc. Create a Pods of image alpine:3.13.2 in the Namespace default to run on the gVisor runtime cla...

use the Trivy to scan the following images, 1. amazonlinux:1 2. k8s.gcr.io/kube-controller-manager:v1.18.6 Look for images with HIGH or CRITICAL severity vulnerabilities and store...

You must complete this task on the following cluster/nodes: Cluster | Master node | Worker node KSRS001 | ksrs00101-master | ksrs00101-worker1 You can switch the cluster/configurat...

Create a network policy named allow-np, that allows pod in the namespace staging to connect to port 80 of other pods in the same namespace. Ensure that Network Policy: 1. Does not...

Ensure that the admission control plugin PodSecurityPolicy is set.

Create a Pod name Nginx-pod inside the namespace testing, Create a service for the Nginx-pod named nginx-svc, using the ingress of your choice, run the ingress on tls, secure port.

Secrets stored in the etcd is not secure at rest, you can use the etcdctl command utility to find the secret value for e.g.: ETCDCTL_API=3 etcdctl get /registry/secrets/default/cks...

Ensure that the --kubelet-certificate-authority argument is set as appropriate.

Create a PSP that will only allow the persistentvolumeclaim as the volume type in the namespace restricted. Create a new PodSecurityPolicy named prevent-volume-policy which prevent...

Service is running on port 389 inside the system, find the process-id of the process, and stores the names of all the open-files inside the /candidate/KH77539/files.txt, and also d...

Given an existing Pod named nginx-pod running in the namespace test-system, fetch the service-account-name used and put the content in /candidate/KSC00124.txt Create a new Role nam...

Use the kubesec docker images to scan the given YAML manifest, edit and apply the advised changes, and passed with a score of 4 points. kubesec-test.yaml apiVersion: v1 kind: Pod m...

Using the runtime detection tool Falco, Analyse the container behavior for at least 20 seconds, using filters that detect newly spawning and executing processes in a single contain...

Enable audit logs in the cluster, To Do so, enable the log backend, and ensure that 1. logs are stored at /var/log/kubernetes/kubernetes-logs.txt. 2. Log files are retained for 5 d...

Given an incomplete configuration in directory /etc/kubernetes/epconfig and a functional container image scanner with HTTPS endpoint https://wakanda.local:8081/image_policy : 1. En...

Edit the configuration to point to the provided HTTPS endpoint correctly. You can find the container image scanner's log file at /var/log/imagepolicy/acme.log. Finally, test if the...

QUESTION 29 You must complete this task on the following cluster/nodes: Cluster: immutable-cluster Worker node: worker1 You can switch the cluster/configuration context using the f...

Context: A PodSecurityPolicy shall prevent the creation of privileged Pods in a specific namespace. Task: 1. Create a new PodSecurityPolicy named deny-policy, which prevents the cr...

Secrets stored in the etcd is not secure at rest, you can use the etcdctl command utility to find the secret value. For example: A `kubectl create secret` command is shown, followe...

Context: Cluster: prod Master node: master1 Worker node: worker1 You can switch the cluster/configuration context using the following command: [desk@cli] $ kubectl config use-conte...

Perform the following fixes: 1. For `Dockerfile`: Fix the image version & user name in `Dockerfile`. 2. For `mydeployment.yaml`: Fix security contexts.

Enable audit logs in the cluster. To do so, enable the log backend, and ensure that: 1. logs are stored at `/var/log/Kubernetes/logs.txt` 2. log files are retained for 5 days 3. at...