Workload Security in Container Orchestration GCSA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which feature of external secrets management tools (e.g., HashiCorp Vault) improves security compared to storing secrets directly in Kubernetes Secrets?

   • APod scheduling optimization
   • BAutomatic container image building
   • CNetwork policy enforcement
   • DCentralized secret rotation and access policies
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   Your security team wants to detect zero-day exploits in container workloads. They are considering two approaches: (A) runtime security monitoring with Falco, and (B) image scanning with Trivy. Which approach is more effective for detecting zero-day exploits, and why?

   • ANeither approach can detect zero-day exploits
   • BRuntime security monitoring with Falco, because it detects anomalous behavior at runtime
   • CBoth are equally effective for zero-day detection
   • DImage scanning with Trivy, because it identifies known vulnerabilities before deployment
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In Kubernetes, what is the primary mechanism for a pod to authenticate to the Kubernetes API server?

   • AA client certificate
   • BA username and password
   • CAn SSH key
   • DA service account token
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which Kubernetes admission control mechanism is used to enforce Pod Security Policies on workloads?

   • AResourceQuota admission controller
   • BPodSecurityPolicy admission controller
   • CServiceAccount admission controller
   • DNamespaceLifecycle admission controller
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A cluster administrator wants to ensure that no single pod can consume all available CPU on a node, which could starve other pods. They also want to ensure that a compromised pod cannot escalate privileges. Which two configurations should be applied?

   • ASet a ResourceQuota for CPU and apply a NetworkPolicy that blocks all traffic.
   • BSet CPU limits on each pod and apply a Pod Security Admission restricted profile.
   • CSet a LimitRange for CPU and use a custom admission webhook to reject privileged containers.
   • DSet CPU requests on each pod and apply a Pod Security Admission baseline profile.
   Reveal Solution Discussion Select an answer first