Certified Kubernetes Security Specialist (CKS) Exam
7 Warning Signs Of Your Certified Kubernetes Security Specialist (cks) Exam Demise
level access Understand Network Policies Use Network security policies to restrict cluster level access Exam tip: Know how to create Network Policies using proper selectors Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi) Center of Internet Security – CIS defines security best practices for Kubernetes and can help evaluate and recommendation for the fixes. Aqua Security kube-bench is a free tool that can help evaluate the k8s cluster for CIS rules. Exam tip: Know how to read the CIS report, identify failures, map it to the recommendation, and fix the same. Properly set up Ingress objects with security control Ingress endpoint can be configured with TLS endpoint Exam tip: Know how to create a TLS secret and associate the same with the
Ingress Protect node metadata and endpoints Authentication using Certificates and Service Accounts Authorization using Node and RBAC Exam tip: Know how to create Service Accounts, Roles, and Cluster Roles and associate them together using Role Binding and Cluster Role Binding. Exam tip: Know to create Service Accounts with automount disabled using the automountServiceAccountToken flag. Minimize use of, and access to, GUI elements Kubernetes Dashboard is a Certified Kubernetes Security Specialist (CKS) Exam
GUI component that needs to be secured. Verify platform binaries before deploying Exam tip: Know how to verify platform binaries digest using sha Cluster Hardening – 15% Practice CKS Exercises – Cluster Harding Restrict access to Kubernetes API Control anonymous requests to Kube-apiserver Use Role-Based Access Controls to minimize exposure Exam tip: Know how to create Service Accounts, Roles, and Cluster Roles and associate them together using Role Binding and Cluster Role Binding.
7 Ways Facebook Destroyed My Certified Kubernetes Security Specialist (cks) Exam Without Me Noticing
Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones. Exam tip: Know how to create Service Accounts, Roles, and Cluster Roles and associate them together using Role Binding and Cluster Role Binding. Exam tip: Know automountServiceAccountToken can be used to prevent the service account from being auto-mounted. Update Kubernetes frequently Kubernetes supports N to N-2 versions and it is recommended to upgrade the components Exam tip: Know how to upgrade a Kubernetes cluster (although it did not appear on my exam) System Hardening – 15% Practice CKS Exercises – System Harding Minimize host OS footprint (reduce attack surface) Control access using SSH, disable root and password-based logins Remove unwanted packages and ports Minimize IAM roles IAM roles are usually with Cloud providers and relate to the least privilege access principle. Minimize external access to the network External access can be controlled using Network Policies through egress policies. Appropriately use kernel hardening tools such as AppArmor, seccomp Runtime
classes provided by gvisor and kata containers can help provide further isolation of the containers Secure Computing – Seccomp tool helps control syscalls made by containers AppArmor can be configured for any application to reduce its potential host attack surface and provide a greater in-depth defense. PodSecurityPolicies – PSP enables fine-grained authorization of pod creation and updates. Apply host updates Install minimal required OS fingerprint Identify and address open ports Remove unnecessary packages Protect access to data with permissions Restrict allowed hostpaths Exam tip: Know how to load AppArmor profiles, and enable them for the pods. AppArmor is in beta and needs to be enabled using container.apparmor.security.beta.kubernetes.io/<container_name>: <profile_ref> Minimize Microservice Vulnerabilities – 20% Practice CKS Exercises – Minimize Microservice Vulnerabilities Setup appropriate OS-level security domains e.g. using PSP, OPA, security contexts.
Final Words Certified Kubernetes Security Specialist (CKS) Exam
Pod Security Contexts help define security for pods and containers at the pod or at the container level. Capabilities can be added at the container level only. Pod Security Policies enable fine-grained authorization of pod creation and updates and is implemented as an optional admission controller. Open Policy Agent helps enforce custom policies on Kubernetes objects without recompiling or reconfiguring the Kubernetes API server. Admission controllers can be used for validating configurations as well as mutating the configurations. Mutating controllers are triggered before validating controllers. Allows extension by adding custom controllers using MutatingAdmissionWebhook and ValidatingAdmissionWebhook. Exam tip: Know how to configure Pod Security Context, Pod Security Policies
Manage Kubernetes secrets Exam Tip: Know how to read secret values, create secrets and mount the same on the pods. Use container runtime sandboxes in multi-tenant environments (e.g. gvisor, kata containers) Exam tip: Know how to create a Runtime and associate it with a pod using runtimeClassName Implement pod to pod encryption by use of mTLS Practice manage TLS certificates in a Cluster Service Mesh Istio can be used to establish MTLS for Intra pod communication. Istio automatically configures workload sidecars to use mutual TLS when calling other workloads. By default, Istio Linux Foundation CKS Exam Dumps
configures the destination workloads using PERMISSIVE mode. When PERMISSIVE mode is enabled, a service can accept both plain text and mutual TLS traffic. In order to only allow mutual TLS traffic, the configuration needs to be changed to STRICT mode. Exam tip: No questions related to mTLS appeared in the exam Supply Chain Security – 20% Practice CKS Exercises – Supply Chain Security Minimize base image footprint Remove unnecessary tools.
Click Here More Info ……. >>>>>>>>> https://dumpsboss.com/linux-foundation-exam/cks/
