My feedback about Kubernetes Security Specialist exam (CKS)

Jihad Benabra

Dec 15, 2020·3 min read

I’ve achieved my CKS certificate this weekend, and for that many people come to ask me about feedback and exam big topics.

Therefore, you should to understand that the exam scenario is not the same for all people, but in my case the challenge was to resolve 19 questions concerning this topics:

ImagePolicyWebhook

The goals is to enable this plugin and connect it with webhook server.

Audit Policy

Enable plugin, define logs for some resources ( for namespaces and secrets…) at different levels (Metadata, Request…)…

Anomaly fix with Falco or Sysdig

Check containers and pod anomaly using scanners like Falco or Sysdig, and format the output in a specific format.

Sandbox containers, RuntimeClass and gVisor

Deploy a RuntimeClass, and create deployment using this class on the correct worker node.

PodSecurityPolicies

Create PSP and it’s ClusterRole, ClusterRoleBinding and deploy a pod impacted by the PSP.

CSI Bench

Try to resolve security issues detected by kube-bench on master, node and ETCD.

Static Dockerfile best security and hardening practice

Analyse a static Dockerfile and try to fix many security issues and hardening best security and optimization practices.

Cluster security hardening with Strace

Strace is a diagnostic and debugging userspace utility for Linux. It is used to monitor and tamper with interactions between processes and the Linux kernel, which include system calls…

Others

Of course, you need to practice and practice cases like:

1. RBAC
2. NetworkPolicies
3. Sidecar containers
4. Image vulnerability (Trivy)
5. Verify kube-apiserver sha512…

Finally, every scenario is different, but the big topics are the same :)