Risks, Authentication, and Access-Control of Container Orchestration GCSA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is assessing the risks of a Kubernetes cluster that hosts multiple customer applications. The cluster uses a shared control plane, and each customer's workloads run in separate namespaces. The analyst is particularly concerned about the risk of a compromised pod being used to attack the Kubernetes API server. Which control is most directly effective at mitigating this specific risk?

   • AUse RBAC to restrict each customer's service account to its own namespace.
   • BDisable the Kubernetes dashboard to reduce the attack surface.
   • CEnable audit logging on the API server to record all requests.
   • DApply a network policy that denies egress from all pods to the API server's IP address, except for the kube-system namespace.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An organization wants to allow employees to authenticate to the Kubernetes API server using their existing corporate single sign-on (SSO) credentials. Which authentication mechanism should be configured?

   • AConfigure the API server to use OIDC with the corporate identity provider as the issuer.
   • BUse client certificate authentication with a certificate signed by the cluster CA for each employee.
   • CCreate individual static token files for each employee and distribute them securely.
   • DEnable anonymous access and rely on the corporate firewall to restrict API access.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which practice is most effective for protecting the Kubernetes API server from unauthorized network access?

   • ARunning the API server on the same node as etcd without TLS
   • BDisabling audit logging to reduce overhead
   • CExposing the API server directly to the internet for easy access
   • DRestricting access to the API server using network policies and authentication
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which authentication method is commonly used by a human administrator to interact with a Kubernetes cluster via kubectl?

   • AA bearer token from a service account
   • BThe node's SSH private key
   • CA client certificate signed by the cluster certificate authority
   • DA static API key stored in the kubeconfig file
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A large enterprise runs a multi-tenant Kubernetes cluster with a shared control plane. Each tenant has a namespace, and the security team is concerned about the risk of a tenant's workload using a vulnerability in the kubelet to access other tenants' pods. They are evaluating controls to mitigate this risk. Which control is most effective at preventing a compromised workload from exploiting the kubelet to reach other tenants' pods?

   • AUse network policies to isolate tenant namespaces and restrict pod-to-pod traffic.
   • BRun each tenant's workloads on dedicated node pools with strong isolation between nodes.
   • CEnable audit logging on the kubelet to detect any unauthorized access.
   • DEnable the kubelet's read-only port and disable anonymous authentication on the kubelet.
   Reveal Solution Discussion Select an answer first