CKS Exam Topics & Practice Tasks

Fix all issues via configuration and restart the affected components to ensure the new settings take effect. Fix all of the following violations that were found against the kubelet: The cluster uses the Docker Engine as its…

The worker node is running an older kubelet patch version (v1.35.0) and must be upgraded to v1.35.1. Access The upgrade is performed on the worker node itself.

First, secure the cluster's API server configuring it as follows: Forbid anonymous authentication Use authorization mode Node,RBAC Use admission controller NodeRestriction The cluster uses the Docker Engine as its container…

Create a TLS Secret named clever-cactus in the clever-cactus namespace for an existing Deployment named clever-cactus. Use the following SSL files: Certificate: /home/candidate/clever-cactus/web.k8s.local.crt Key:…

First, create a NetworkPolicy named deny-policy in the prod namespace to block all ingress traffic. The prod namespace is labeled env:prod.

Create an Ingress resource named web in the prod namespace and configure it as follows: Route traffic for host web.k8s.local and all paths to the existing Service web. Enable TLS termination using the existing Secret web-cert.

Istio is installed in the cluster. Deployment target-app runs in namespace app-ns, but the namespace was never enabled for sidecar injection, so its pods are not in the mesh.

Perform the following tasks to secure the cluster node: Remove user developer from the docker group. Do not remove the user from any other group.

Modify the existing Deployment named lamp-deployment, running in namespace lamp, so that its containers: run with user ID 20000 use a read-only root filesystem forbid privilege escalation The Deployment's manifest file can be…

First, modify the existing ServiceAccount stats-monitor-sa in the namespace monitoring to turn off automounting of API credentials.

Namespace restricted-ns enforces the restricted Pod Security Standard. A Deployment pss-app in this namespace is currently non-compliant and its Pods cannot start.

Analyze and edit the Dockerfile located at /home/candidate/subtle-bee/build/Dockerfile, fixing one instruction present in the file that is a prominent security/best-practice issue.

The alpine Deployment in the alpine namespace has three containers that run different versions of the alpine image. First, find out which version of the alpine image contains the libcrypto3 package at version 3.1.4-r5.

Given an incomplete configuration located at /etc/kubernetes/bouncer and a functional container image scanner with an HTTPS endpoint at https://smooth-yak.local/review, perform the following tasks to implement a validating…

One of the Pods belonging to the application ollama is misbehaving. It is directly accessing the system's memory reading from the sensitive file /dev/mem. First, identify the misbehaving Pod accessing /dev/mem.

First, reconfigure the cluster's API server, so that: the basic audit policy located at /etc/kubernetes/logpolicy/audit-policy.yaml is used, logs are stored at /var/log/kubernetes/audit-logs.txt, and a maximum of 2 logs are…