Linux Foundation CKS Exam - Topic 1 Question 54 Discussion

Actual exam question for Linux Foundation's CKS exam

Question #: 54
Topic #: 1

[All CKS Questions]

Secrets stored in the etcd is not secure at rest, you can use the etcdctl command utility to find the secret value

for e.g:-

ETCDCTL_API=3 etcdctl get /registry/secrets/default/cks-secret --cacert="ca.crt" --cert="server.crt" --key="server.key"

Output

Using the Encryption Configuration, Create the manifest, which secures the resource secrets using the provider AES-CBC and identity, to encrypt the secret-data at rest and ensure all secrets are encrypted with the new configuration.

AExplanation:
ETCD secret encryption can be verified with the help ofetcdctlcommand line utility.
ETCD secrets are stored at the path/registry/secrets/$namespace/$secreton the master node.
The below command can be used to verify if the particular ETCD secret is encrypted or not.
# ETCDCTL_API=3 etcdctl get /registry/secrets/default/secret1 [...] | hexdump -C

Show Suggested Answer

Suggested Answer: A

by Frederic at May 11, 2024, 07:06 PM

Limited Time Offer

25%

Off

Get Premium CKS Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Shoshana

4 months ago

Definitely need to set up that encryption config ASAP!

upvoted 0 times

...

Kiley

4 months ago

Surprised to hear that! I thought encryption was a given.

upvoted 0 times

...

Quentin

4 months ago

Yeah, I've used etcdctl before, it's pretty straightforward.

upvoted 0 times

...

Jani

4 months ago

I thought they were supposed to be secure at rest?

upvoted 0 times

...

Pearly

5 months ago

That's true, etcd secrets can be accessed like that.

upvoted 0 times

...

Glory

5 months ago

I feel confident about using etcdctl, but I need to double-check the steps for setting up the encryption configuration in the manifest.

upvoted 0 times

...

Audra

5 months ago

The command to check if secrets are encrypted seems familiar, but I might mix up the paths for different namespaces.

upvoted 0 times

...

Aleisha

5 months ago

I think we did a similar question in class about securing secrets, but I can't recall the exact syntax for the AES-CBC provider.

upvoted 0 times

...

Broderick

5 months ago

I remember practicing with etcdctl commands, but I'm not entirely sure how to create the manifest for the encryption configuration.

upvoted 0 times

...

Bernardine

5 months ago

This seems like a good opportunity to demonstrate my understanding of etcd security and encryption. I'll start by running the etcdctl command to confirm the secret is stored in plaintext. Then I'll carefully craft the encryption configuration manifest to ensure all secrets are properly encrypted at rest.

upvoted 0 times

...

Tiara

5 months ago

Okay, I think I've got this. First, I'll use etcdctl to verify the secret value is not encrypted. Then I'll create a manifest with the encryption configuration to secure the secrets using AES-CBC. Shouldn't be too difficult as long as I get the details right in the manifest.

upvoted 0 times

...

Angella

5 months ago

This question seems straightforward. I'll start by using the etcdctl command to check the secret value, as shown in the example. Then I'll need to create a manifest to configure encryption for the secrets using the AES-CBC provider and identity.

upvoted 0 times

...

Josephine

6 months ago

Hmm, I'm a bit confused about the encryption configuration part. I'll need to review the details on how to set that up properly in the manifest. The etcdctl command looks simple enough, but I want to make sure I understand the encryption requirements fully.

upvoted 0 times

...

Lai

6 months ago

This is a tricky one. The details about the insurer acting as an agent and making the actual claim payments from Flair's account don't seem to match up perfectly with any of the answer choices. I'm going to have to think this through step-by-step to figure out the right approach.

upvoted 0 times

...

Ryan

6 months ago

I'm a bit confused on the rate of return. If the rate is low, the value goes up, right? I just can't seem to remember the exact calculation.

upvoted 0 times

...

Theron

6 months ago

I'm a little confused by the terminology here. What's the difference between an Access Username and an Access Key ID? I'll have to review my notes to make sure I understand the concepts.

upvoted 0 times

...

Louisa

6 months ago

Okay, let's see. The question mentions customer service, so I'm guessing the Case entity would be a good choice. And maybe something like Goal or Social activity could also be used. I'll select those and see how it goes.

upvoted 0 times

...

Phil

6 months ago

This is a good test of our understanding of information security principles. I'll methodically go through each option and consider how they align with managing information that is no longer needed.

upvoted 0 times

...

Reed

10 months ago

Well, at least they're not asking us to do a barrel roll in the middle of the exam. Although, that would probably be more fun than trying to secure those etcd secrets.

upvoted 0 times

Rikki

9 months ago

Haha, that would definitely make the exam more interesting.

upvoted 0 times

...

Tony

9 months ago

Yeah, let's hope for the best during the exam.

upvoted 0 times

...

Paulina

9 months ago

I hope the encryption configuration helps in securing the secrets properly.

upvoted 0 times

...

Derick

9 months ago

I wish they would ask us to do a barrel roll instead!

upvoted 0 times

...

Florinda

10 months ago

I agree, securing etcd secrets can be quite challenging.

upvoted 0 times

...

Rupert

10 months ago

I agree, securing etcd secrets can be quite challenging.

upvoted 0 times

...

Beata

11 months ago

Ah, the joys of working with sensitive data. Gotta love how they give you the exact command to reveal the secrets. It's like they want us to become master hackers or something!

upvoted 0 times

Emmett

10 months ago

User 2

upvoted 0 times

...

Stevie

10 months ago

User 1

upvoted 0 times

...

Antonette

11 months ago

Hmm, I'm not sure I'd want to be running that etcdctl command on my production cluster. Sounds like a good way to get caught by the security police!

upvoted 0 times

...

Truman

11 months ago

Encrypting the secrets at rest is crucial for security. I'm glad they're providing a step-by-step on how to set that up. Can't wait to try it out!

upvoted 0 times

...

Niesha

11 months ago

Whoa, that's a handy trick to check the secrets in etcd! But I wonder if there's a more secure way to manage those secrets, ya know, without exposing them in the clear.

upvoted 0 times