Correct Answer:

See the Explanation below for complete solution
Explanation:
1) Connect to the correct host
ssh cks000032
sudo -i
2) Use admin kubeconfig
export KUBECONFIG=/etc/kubernetes/admin.conf
3) Verify prerequisites (quick check)
These should already exist per task.
kubectl -n prod get svc web
kubectl -n prod get secret web-cert
kubectl get pods -n ingress-nginx
(If the ingress controller pods exist, you're good.)
4) Create the Ingress resource
Create Ingress named web in namespace prod with:
host: web.k8s.local
all paths → Service web
TLS using Secret web-cert
HTTP → HTTPS redirect (NGINX)
cat <<EOF | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: web
namespace: prod
annotations:
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
ingressClassName: nginx
tls:
- hosts:
- web.k8s.local
secretName: web-cert
rules:
- host: web.k8s.local
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: web
port:
number: 80
EOF
5) Verify Ingress creation
kubectl -n prod get ingress web
kubectl -n prod describe ingress web
Confirm:
Host = web.k8s.local
TLS Secret = web-cert
Backend Service = web
6) Test HTTP → HTTPS redirect
curl -L http://web.k8s.local
Expected:
Redirects to https://web.k8s.local
Returns application response over HTTPS

Correct Answer:

See the Explanation below for complete solution
Explanation:
1) Connect to the correct host
ssh cks000026
sudo -i
2) Identify the misbehaving Pod accessing /dev/mem
This task hints Falco is available → use it first (fast + intended).
2.1 Check Falco logs for /dev/mem access
journalctl -u falco | grep dev/mem
If Falco runs as a pod instead of systemd:
kubectl -n falco logs -l app=falco | grep dev/mem
2.2 Identify the Pod name
From the Falco output, you will see something like:
Pod=ollama-xxxxx Namespace=default File=/dev/mem
Note the exact Pod name (example: ollama-7c9d6f7b6d-abcde)
3) (If Falco logs are unclear) Confirm using Docker runtime
Because the cluster uses Docker, verify which container is accessing /dev/mem.
3.1 List running containers
docker ps
3.2 Inspect suspicious container
(Find container related to ollama)
docker inspect <container_id> | grep ollama
You should confirm it maps to the same Pod you saw in Falco.
4) Identify the Deployment managing the misbehaving Pod
4.1 Get Pod details
kubectl get pod <MISBEHAVING_POD_NAME> -o wide
4.2 Find owning Deployment
kubectl get pod <MISBEHAVING_POD_NAME> -o jsonpath='{.metadata.ownerReference[0].name}' This will output something like:
ollama
That is the Deployment name
5) Scale ONLY that Deployment to zero replicas
Do not edit, delete, or touch anything else
kubectl scale deployment ollama --replicas=0
6) Verify the Pod is terminated
kubectl get pods | grep ollama
Expected: no running Pods
Also confirm replicas:
kubectl get deployment ollama
Replicas should show:
0/0

Correct Answer:

See the Explanation belowExplanation:
root# netstat -ltnup
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:17600 0.0.0.0:* LISTEN 1293/dropbox tcp 0 0 127.0.0.1:17603 0.0.0.0:* LISTEN 1293/dropbox tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 575/sshd tcp 0 0 127.0.0.1:9393 0.0.0.0:* LISTEN 900/perl tcp 0 0 :::80 :::* LISTEN 9583/docker-proxy tcp 0 0 :::443 :::* LISTEN 9571/docker-proxy udp 0 0 0.0.0.0:68 0.0.0.0:* 8822/dhcpcd
...
root# netstat -ltnup | grep ':22'
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 575/sshd
The ss command is the replacement of the netstat command.
Now let's see how to use the ss command to see which process is listening on port 22:
root# ss -ltnup 'sport = :22'
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:("sshd",pid=575,fd=3))

Correct Answer:

See the Explanation belowExplanation: