Risks, Authentication, and Access-Control of Container Orchestration GCSA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company runs a multi-tenant Kubernetes cluster and wants to ensure that a compromised workload in one tenant cannot reach the API server or other tenants' services. They also want to maintain auditability of all API requests. Which set of controls best achieves this?

   • ADisable the API server and use only kubectl proxy for all access.
   • BUse RBAC to revoke the service account's permissions, but allow all network traffic.
   • CUse a service mesh with mTLS but do not implement NetworkPolicies.
   • DApply NetworkPolicies that block egress to the API server and other namespaces, and enable API server audit logging.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which characteristic of container orchestration platforms introduces a unique security risk that is not typically present in traditional single-host container deployments?

   • AThe use of Linux kernel namespaces for process isolation
   • BThe requirement to use a Linux operating system for all worker nodes
   • CThe dynamic scheduling of workloads across a shared cluster of nodes
   • DThe use of container images pulled from public registries
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security team is reviewing a Kubernetes cluster that runs workloads for multiple business units. Each business unit has its own namespace, and developers have been granted cluster-admin permissions to deploy their applications. The team is concerned about the risk of a compromised workload in one namespace affecting workloads in other namespaces. Which two actions should the team take to reduce the blast radius of a compromised workload while still allowing developers to deploy their applications?

   • AApply pod security policies that restrict privileged containers, and disable the Kubernetes dashboard.
   • BReplace cluster-admin with RBAC roles scoped to each namespace, and apply network policies that restrict ingress/egress between namespaces.
   • CKeep cluster-admin for developers but enable audit logging to detect any cross-namespace activity.
   • DMove all workloads to a single namespace and use network policies to isolate pods.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security architect is designing authentication for a Kubernetes cluster that will be accessed by both human users and automated CI/CD pipelines. The architect wants to use short-lived credentials for both, but the CI/CD pipelines need to run for up to an hour. Which approach best balances security and operational needs?

   • AUse client certificates for both human users and pipelines, with a one-year expiration.
   • BUse OIDC for human users with short token lifetimes, and use projected service account tokens for pipelines with a configurable expiration that matches the pipeline duration.
   • CUse static service account tokens for pipelines and OIDC for human users.
   • DUse OIDC for both human users and pipelines, but set the token lifetime to 24 hours to avoid pipeline interruptions.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is migrating to Kubernetes and wants to authenticate both human users and automated workloads. They require that human users use corporate SSO, while workloads use short-lived credentials. Which authentication strategy should they implement?

   • AConfigure OIDC for human users and use service account tokens with short TTLs for workloads.
   • BUse client certificates for humans and static tokens for workloads.
   • CEnable anonymous access for humans and use service account tokens for workloads.
   • DUse static tokens for both humans and workloads.
   Reveal Solution Discussion Select an answer first