Describe the Security Implications of Running Vault in Kubernetes VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of a Kubernetes NetworkPolicy when applied to Vault pods?

   • ATo restrict network traffic to and from the Vault pods, limiting the attack surface and preventing unauthorized access.
   • BTo encrypt all traffic between Vault and its clients.
   • CTo block all inbound traffic to the Vault pods.
   • DTo provide a firewall for the underlying host nodes.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How do Kubernetes resource limits (CPU/memory) help mitigate denial-of-service risks for Vault?

   • ABy encrypting all network traffic to Vault.
   • BBy blocking malicious requests to Vault.
   • CBy preventing a single Vault pod from consuming all node resources, which could starve other pods and cause a denial of service.
   • DBy automatically scaling Vault pods to handle increased load.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a security benefit of using a NetworkPolicy to restrict egress traffic from Vault pods?

   • AIt blocks all inbound traffic to Vault.
   • BIt prevents Vault from communicating with unauthorized external endpoints, reducing the risk of data exfiltration.
   • CIt automatically rotates Vault's encryption keys.
   • DIt encrypts all outbound traffic from Vault.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   Your platform team runs Vault on a Kubernetes cluster that enforces Pod Security Admission with the restricted profile. The Vault pod fails to start with a security context validation error. Which change to the Vault pod's security context is most likely required to satisfy the restricted profile while maintaining Vault's operational requirements?

   • ASet allowPrivilegeEscalation: false and add the SYS_ADMIN capability for Vault's mlock operation.
   • BSet runAsUser to 100 and add the NET_BIND_SERVICE capability to the container's capabilities add list.
   • CSet runAsNonRoot: true, set readOnlyRootFilesystem: true, and drop all capabilities.
   • DSet runAsNonRoot: true and remove the NET_BIND_SERVICE capability from the container's capabilities drop list.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How can Kubernetes audit logs help detect security issues related to Vault?

   • ABy automatically blocking malicious requests.
   • BBy encrypting all traffic to Vault.
   • CBy providing real-time alerts for all Vault operations.
   • DBy recording API requests, such as attempts to access Vault pods or secrets, which can be reviewed for suspicious activity.
   Reveal Solution Discussion Select an answer first