Risks, Authentication, and Access-Control of Container Orchestration GCSA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company wants to ensure that all requests to the Kubernetes API server are authenticated and that sensitive actions are recorded for audit. Which combination of controls should be implemented?

   • AEnable anonymous access and use a webhook to validate requests.
   • BExpose the API server on a public IP and rely on network policies to restrict access.
   • CUse static token files for all users and disable audit logging to reduce overhead.
   • DEnable TLS for API server communication, configure OIDC authentication, and enable audit logging with a policy that captures write operations.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security team wants to enforce that no workload in a cluster can run as root or mount the host filesystem. They also want to ensure that only approved images are used. Which combination of admission controls should they implement?

   • AUse NetworkPolicies to block traffic from privileged pods.
   • BUse a custom admission webhook that only checks the pod name.
   • CUse only RBAC to prevent users from creating privileged pods.
   • DUse Pod Security Admission (PSA) with a restricted policy and an image policy webhook to validate image provenance.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An organization is deploying a production Kubernetes cluster and wants to ensure that only authenticated and authorized users can access the API server. They also need to maintain an audit trail of all API requests for compliance. Which combination of controls should they implement?

   • AEnable TLS for all API server traffic, use OIDC for user authentication, and enable audit logging with a policy that captures all requests.
   • BUse static token files for authentication and enable audit logging for failed requests only.
   • CExpose the API server on a public IP and rely on RBAC to restrict access.
   • DDisable anonymous authentication and use client certificates for all users, but do not enable audit logging.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which Kubernetes resource is used to control network traffic between pods and services, enabling micro-segmentation?

   • AIngress
   • BNetworkPolicy
   • CResourceQuota
   • DLimitRange
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A Kubernetes cluster is configured with RBAC and uses OIDC for user authentication. A security audit reveals that a former employee's OIDC account is still active and has cluster-admin privileges. The company wants to ensure that this account cannot be used to access the cluster. What is the most effective immediate action?

   • ADisable anonymous authentication on the API server.
   • BRemove the cluster-admin ClusterRoleBinding for the user.
   • CDelete the user's OIDC account from the identity provider.
   • DRotate the OIDC client secret.
   Reveal Solution Discussion Select an answer first