Question: 1
Cluster:admission-cluster
Master node:master
Worker node:worker1
You can switch the cluster/configuration context using the following command:
[desk@cli] $kubectl config use-context admission-cluster
Context:
A container image scanner is set up on the cluster, but it's not yet fully integrated into the cluster's configuration. When complete, the container image scanner shall scan for and reject the use of vulnerable images.
Task:
You have to complete the entire task on the cluster's master node, where all services and files have been prepared and placed.
Given an incomplete configuration in directory /etc/Kubernetes/config and a functional container image scanner with HTTPS endpoint https://imagescanner.local:8181/image_policy:
1. Enable the necessary plugins to create an image policy
2. Validate the control configuration and change it to an implicit deny
3. Edit the configuration to point to the provided HTTPS endpoint correctly
Finally, test if the configuration is working by trying to deploy the vulnerable resource /home/cert_masters/test-pod.yml
Note: You can find the container image scanner's log file at /var/log/policy/scanner.log
A Explanation:
Note:We can see a missing value here, so how from where i can get this value
[master@cli] $vim /etc/kubernetes/config/kubeconfig.yaml
[master@cli] $vim /etc/kubernetes/manifests/kube-apiserver.yaml
Answer : A
Show Answer
Hide Answer
Question: 2
Use the kubesec docker images to scan the given YAML manifest, edit and apply the advised changes, and passed with a score of 4 points.
kubesec-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: kubesec-demo
spec:
containers:
- name: kubesec-demo
image: gcr.io/google-samples/node-hello:1.0
securityContext:
readOnlyRootFilesystem: true
A Hint:docker run -i kubesec/kubesec:512c5e0 scan /dev/stdin < kubesec-test.yaml
Answer : A
Show Answer
Hide Answer
Question: 3
Using the runtime detection tool Falco, Analyse the container behavior for at least 20 seconds, using filters that detect newly spawning and executing processes in a single container of Nginx.
A store the incident file art /opt/falco-incident.txt, containing the detected incidents. one per line, in the format
Answer : A
Show Answer
Hide Answer
Question: 4
Secrets stored in the etcd is not secure at rest, you can use the etcdctl command utility to find the secret value
for e.g:-
Answer : A
Show Answer
Hide Answer
Question: 5
A container image scanner is set up on the cluster.
Given an incomplete configuration in the directory
A 1. Enable the admission plugin.
Answer : A
Show Answer
Hide Answer
