Architecture and Fundamentals of Container Orchestration GCSA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a core component of a container orchestration platform?

   • AHypervisor
   • BContainer runtime
   • CLoad balancer
   • DScheduler
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a fundamental security best practice for container orchestration environments?

   • AStoring secrets in environment variables for easy access
   • BRunning containers as the root user to ensure compatibility
   • CUsing role-based access control (RBAC) to limit permissions
   • DDisabling all network policies to simplify connectivity
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company runs a microservices application on Kubernetes. They need to expose a set of internal APIs to other services within the cluster without exposing them to the internet. They also need to ensure that only services in the same namespace can communicate with these APIs. Which approach should they use?

   • ACreate a NodePort Service and rely on the node's firewall to block external access.
   • BCreate a LoadBalancer Service and use a security group to restrict access to internal IPs.
   • CCreate a ClusterIP Service and a NetworkPolicy that allows ingress only from the same namespace.
   • DCreate an ExternalName Service and use DNS to restrict access.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company runs a batch processing workload on Kubernetes. The workload is CPU-intensive and runs for a few minutes. They want to ensure that the workload does not consume more CPU than allocated and that it is terminated if it runs longer than expected. Which set of Kubernetes features should they use?

   • AA CronJob with a CPU limit and a restart policy.
   • BA Job with a CPU limit and an activeDeadlineSeconds setting.
   • CA DaemonSet with a CPU limit and a pod disruption budget.
   • DA Deployment with a CPU request and a liveness probe.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is designing a multi-tenant Kubernetes cluster. Each tenant team has its own namespace and needs to be isolated from other tenants. The security team requires that tenant workloads cannot access the Kubernetes API server. Which combination of Kubernetes features should be used to enforce this isolation?

   • AUse ResourceQuotas to limit resource usage per namespace and LimitRanges to set default pod limits.
   • BUse PodSecurityPolicies (or Pod Security Admission) to restrict privileged containers and host access.
   • CUse a single namespace for all tenants and rely on labels to identify tenant resources.
   • DUse Role-Based Access Control (RBAC) to restrict API access per namespace and NetworkPolicies to isolate pod-to-pod traffic between namespaces.
   Reveal Solution Discussion Select an answer first