Risks, Authentication, and Access-Control of Container Orchestration GCSA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team is evaluating the risk of a container escape in a Kubernetes cluster. They are considering using a sandboxing runtime like gVisor or Kata Containers. Which statement accurately describes the benefit of using a sandboxing runtime?

   • AIt provides an additional layer of isolation between containers and the host kernel, reducing the impact of a container escape.
   • BIt guarantees that a container escape cannot happen.
   • CIt eliminates the need for network policies and RBAC.
   • DIt is only useful for untrusted workloads and provides no benefit for trusted workloads.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security architect is designing a Kubernetes control plane for a regulated environment. They must protect the API server from unauthorized access, ensure that only authenticated users can perform actions, and provide a tamper-evident record of all changes. Which combination of controls is most appropriate?

   • AExpose the API server directly to the internet and rely on RBAC for protection.
   • BPlace the API server behind an authentication gateway, enable OIDC, and ship audit logs to a SIEM with write-once storage.
   • CDisable authentication and use network policies to restrict access to the API server.
   • DUse static tokens for all users and store audit logs locally on the API server.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team is reviewing the audit logs of a Kubernetes cluster and notices that a service account is making repeated requests to list secrets across all namespaces. The service account is used by a monitoring tool that should only have read access to metrics. Which action should the team take to address this potential issue?

   • ADisable audit logging for that service account to reduce noise.
   • BRotate the service account token immediately.
   • CGrant the service account cluster-admin to ensure it has all necessary permissions.
   • DReview the RBAC bindings for the service account and remove any permissions that grant list secrets across all namespaces.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company runs a Kubernetes cluster that is shared between development and production workloads. The security team is concerned about the risk of a development workload being compromised and affecting production. They are considering several options. Which option provides the strongest isolation while still allowing some resource sharing?

   • AUse the same namespace but apply pod security policies to restrict privileged containers.
   • BUse node labels and taints to schedule development workloads on dedicated nodes, but share the same control plane.
   • CUse separate clusters for development and production, with no shared resources.
   • DUse separate namespaces for development and production, and apply network policies to restrict traffic between them.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A Kubernetes administrator needs to grant a monitoring service account read-only access to pods and nodes across the entire cluster. Which RBAC objects should be used?

   • AAdd the service account to the 'system:masters' group.
   • BCreate a ClusterRole with get/list/watch on pods and nodes, and bind it with a ClusterRoleBinding to the service account.
   • CCreate a Role in each namespace with get/list/watch on pods and nodes, and bind it with a RoleBinding.
   • DGrant the service account the 'view' ClusterRole via a ClusterRoleBinding.
   Reveal Solution Discussion Select an answer first