Describe the Security Implications of Running Vault in Kubernetes VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which Kubernetes security context setting is used to restrict the Linux capabilities available to a Vault container?

   • Acapabilities
   • Bprivileged
   • CreadOnlyRootFilesystem
   • DrunAsUser
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   Your organization enforces Pod Security Admission with the restricted profile. You need to deploy Vault, but Vault's default configuration requires mlock. Which approach should you take to comply with the restricted profile while maintaining Vault's security features?

   • ADisable mlock in Vault's configuration and run the pod with the restricted security context.
   • BRun the pod with the restricted security context and add the IPC_LOCK capability to the container.
   • CRun the pod with the restricted security context and set the container to privileged mode.
   • DUse an init container to set the mlock limit and run Vault with mlock enabled, all within the restricted security context.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the security implication of using a Kubernetes PersistentVolume with `accessModes: ReadWriteMany` for Vault's storage?

   • AIt automatically encrypts the volume.
   • BIt prevents any pod from writing to the volume.
   • CIt allows multiple pods to write to the same volume, which could lead to data corruption and unauthorized access if not properly secured.
   • DIt restricts access to a single pod, improving security.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   Your security team is concerned about the Kubernetes service account token mounted into the Vault pod. Vault uses the Kubernetes auth method to authenticate clients. Which configuration change reduces the risk of a compromised Vault pod being used to access the Kubernetes API?

   • AStore the service account token in a Kubernetes secret and mount it as a volume to avoid automatic rotation.
   • BUse a projected service account token with a short expiration and bind the Kubernetes auth method's role to a minimal set of permissions for token review.
   • CDisable the service account token entirely and rely on the Kubernetes auth method's JWT from the kubelet.
   • DMount the service account token with a long expiration and grant it cluster-admin permissions for Vault's token review calls.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of Pod Security Admission (PSA) in the context of running Vault in Kubernetes?

   • ATo enforce security constraints on pods, such as preventing privileged containers or requiring non-root users, before they are admitted to the cluster.
   • BTo automatically encrypt all secrets stored in etcd.
   • CTo monitor network traffic to and from Vault pods.
   • DTo rotate Vault's TLS certificates automatically.
   Reveal Solution Discussion Select an answer first