CKS Exam Dumps : Certified Kubernetes Security Specialist (CKS)

Analyze and edit the given Dockerfile

FROM ubuntu:latest

 

RUN apt-get update -y

 

RUN apt-install nginx -y

 

COPY entrypoint.sh /

 

ENTRYPOINT ["/entrypoint.sh"]

 

USER ROOT

Fixing two instructions present in the file being prominent security best practice issues

Analyze and edit the deployment manifest file

apiVersion: v1

kind: Pod

metadata:

  name: security-context-demo-2

spec:

  securityContext:

    runAsUser: 1000

  containers:

  - name: sec-ctx-demo-2

    image: gcr.io/google-samples/node-hello:1.0

    securityContext:

      runAsUser: 0

      privileged: True

      allowPrivilegeEscalation: false

Fixing two fields present in the file being prominent security best practice issues

Don't add or remove configuration settings; only modify the existing configuration settings

Whenever you need an unprivileged user for any of the tasks, use user  test-user with the user id 5487

Create a RuntimeClass named untrusted using the prepared runtime handler named runsc.

Create a Pods of image alpine:3.13.2 in the Namespace default to run on the gVisor runtime class.

Context

A default-deny NetworkPolicy avoids to accidentally expose a Pod in a namespace that doesn't have any other NetworkPolicy defined.

Task

Create a new default-deny NetworkPolicy named defaultdeny in the namespace testing for all traffic of type Egress.

The new NetworkPolicy must deny all Egress traffic in the namespace testing.

Apply the newly created default-deny NetworkPolicy to all Pods running in namespace testing.