Create the Pod using this manifest

Reveal Solution Hide Solution

CORRECT TEXT

Using the runtime detection tool Falco, Analyse the container behavior for at least 30 seconds, using filters that detect newly spawning and executing processes store the incident file art /opt/falco-incident.txt, containing the detected incidents. one per line, in the format

[timestamp],[uid],[user-name],[processName]

Reveal Solution Hide Solution

CORRECT TEXT

Using the runtime detection tool Falco, Analyse the container behavior for at least 30 seconds, using filters that detect newly spawning and executing processes store the incident file art /opt/falco-incident.txt, containing the detected incidents. one per line, in the format

[timestamp],[uid],[user-name],[processName]

Reveal Solution Hide Solution

Pods being configured to be privileged in any way must be treated as potentially not stateless or not immutable.

Reveal Solution Hide Solution

CORRECT TEXT

Cluster: scanner

Master node: controlplane

Worker node: worker1

You can switch the cluster/configuration context using the following command:

[desk@cli] $ kubectl config use-context scanner

Given:

You may use Trivy’s documentation.

Task:

Use the Trivy open-source container scanner to detect images with severe vulnerabilities used by Pods in the namespace nato.

Look for images with High or Critical severity vulnerabilities and delete the Pods that use those images.

Trivy is pre-installed on the cluster’s master node. Use cluster’s master node to use Trivy.

Reveal Solution Hide Solution

CORRECT TEXT

Cluster: scanner

Master node: controlplane

Worker node: worker1

You can switch the cluster/configuration context using the following command:

[desk@cli] $ kubectl config use-context scanner

Given:

You may use Trivy’s documentation.

Task:

Use the Trivy open-source container scanner to detect images with severe vulnerabilities used by Pods in the namespace nato.

Look for images with High or Critical severity vulnerabilities and delete the Pods that use those images.

Trivy is pre-installed on the cluster’s master node. Use cluster’s master node to use Trivy.

Reveal Solution Hide Solution

CORRECT TEXT

Fix all issues via configuration and restart the affected components to ensure the new setting takes effect.

Fix all of the following violations that were found against the API server:-

✑ a. Ensure that the RotateKubeletServerCertificate argumentissettotrue.

✑ b. Ensure that the admission control plugin PodSecurityPolicyisset.

✑ c. Ensure that the –kubelet-certificate-authority argumentissetasappropriate.

Fix all of the following violations that were found against the Kubelet:-

✑ a. Ensure the –anonymous-auth argumentissettofalse.

✑ b. Ensure that the –authorization-mode argumentissetto Webhook.

Fix all of the following violations that were found against the ETCD:-

✑ a. Ensure that the –auto-tls argumentisnotsettotrue

✑ b. Ensure that the –peer-auto-tls argumentisnotsettotrue

Hint: Take the use of Tool Kube-Bench

Reveal Solution Hide Solution