Describe the Security Implications of Running Vault in Kubernetes VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A Vault pod is configured with a Kubernetes security context that includes `runAsNonRoot: true` and `readOnlyRootFilesystem: true`. What is the primary security benefit of this configuration?

   • AIt automatically rotates Vault's TLS certificates.
   • BIt encrypts all data stored by Vault in the persistent volume.
   • CIt restricts network traffic to and from the Vault pod.
   • DIt prevents the Vault container from writing to its root filesystem and forces it to run with a non-root user, reducing the impact of a container escape.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a security implication of using a self-signed certificate for Vault's TLS communication in a Kubernetes cluster?

   • AIt is more secure than using a certificate from a public CA.
   • BIt prevents unauthorized access to Vault.
   • CIt automatically encrypts all data at rest.
   • DClients must be configured to trust the certificate, which can be a security risk if not managed properly.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Why is it important to manage TLS certificates for Vault within Kubernetes, including regular rotation?

   • ATo encrypt the persistent volume where Vault stores data.
   • BTo ensure that certificates do not expire and to reduce the risk of a compromised certificate being used for a prolonged period.
   • CTo prevent Vault from being compromised by malicious pods.
   • DTo allow Vault to authenticate to the Kubernetes API.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   You run Vault in a Kubernetes cluster with a NetworkPolicy that allows ingress only from pods labeled 'vault-client'. A new application needs to access Vault, but it is deployed in a different namespace. The application's pods cannot be relabeled. Which approach should you take to allow access while maintaining security?

   • ARemove the NetworkPolicy entirely and rely on Kubernetes RBAC to control access to Vault.
   • BCreate a NetworkPolicy in the application's namespace that allows egress to the Vault service.
   • CModify the existing NetworkPolicy to allow ingress from all namespaces, but only from pods with the 'vault-client' label.
   • DCreate a new NetworkPolicy in the Vault namespace that allows ingress from the application's namespace and pods with a specific label.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a security constraint that Pod Security Admission can enforce on Vault pods?

   • ARequiring that Vault pods are scheduled on specific nodes.
   • BRequiring that Vault uses a specific storage backend.
   • CRequiring that all secrets are encrypted in etcd.
   • DRequiring that containers run as a non-root user.
   Reveal Solution Discussion Select an answer first