Network Security CKS Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In Istio, where is mTLS typically implemented?

   • AIn the CNI plugin
   • BIn the Kubernetes API server
   • CIn the kubelet on each node
   • DIn the sidecar proxies deployed alongside each pod
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of Istio's mutual TLS (mTLS) for pod-to-pod communication?

   • ATo compress traffic between services
   • BTo load balance traffic between pods
   • CTo route traffic based on HTTP headers
   • DTo encrypt and authenticate traffic between services
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In Istio, which resource is used to enforce mTLS for all services in a namespace?

   • APeerAuthentication
   • BGateway
   • CDestinationRule
   • DVirtualService
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which NetworkPolicy rule allows ingress traffic only from pods with the label 'app=web'?

   • Aspec.ingress.to.podSelector.matchLabels: {app: web}
   • Bspec.ingress.from.podSelector.matchLabels: {app: web}
   • Cspec.ingress.podSelector.matchLabels: {app: web}
   • Dspec.egress.from.podSelector.matchLabels: {app: web}
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Why is it important to protect cloud provider metadata endpoints from pods?

   • AThe metadata endpoint may contain credentials and instance information that could be used for lateral movement
   • BThe metadata endpoint provides load balancing for services
   • CThe metadata endpoint is required for DNS resolution
   • DThe metadata endpoint is used for pod-to-pod communication
   Reveal Solution Discussion Select an answer first