Workload and Data Security CKS Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary benefit of using namespaces for multi-tenancy?

   • AThey improve application performance
   • BThey reduce the number of nodes required
   • CThey automatically encrypt all data
   • DThey provide a way to isolate resources and policies per tenant
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which component is responsible for encrypting data at rest in etcd?

   • Aetcd itself
   • Bkubelet
   • Ckube-controller-manager
   • Dkube-apiserver
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   Your cluster stores Secrets in etcd. A security audit has flagged that Secrets are stored in plaintext in etcd, and you need to enable encryption at rest. You have generated a 32-byte random key and base64-encoded it. What is the next step to configure encryption at rest?

   • ACreate an EncryptionConfiguration YAML file with the key, place it on the API server host, and pass its path to the API server via the '--encryption-provider-config' flag.
   • BEnable encryption by setting the 'encryption-at-rest: true' field in the kube-apiserver configuration file.
   • CSet the '--encryption-provider-config' flag to the base64-encoded key directly in the API server's systemd unit file.
   • DStore the key in a Kubernetes Secret and reference it in the API server's configuration file.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which security context field controls whether a container's root filesystem is mounted as read-only?

   • Aprivileged
   • BreadOnlyRootFilesystem
   • CrunAsUser
   • Dcapabilities
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   You have a cluster with two container runtimes installed: runc (the default) and Kata Containers. You need to ensure that a specific workload runs with the Kata Containers runtime for stronger isolation, while other workloads continue to use runc. What should you do?

   • AAdd an annotation to the pod spec to select the Kata Containers runtime.
   • BCreate a RuntimeClass named 'kata' that references the Kata Containers runtime handler, and set 'runtimeClassName: kata' in the workload's pod spec.
   • CSet the 'runtimeClassName: kata' field in the pod spec without creating a RuntimeClass object.
   • DModify the kubelet configuration to use Kata Containers as the default runtime for all pods.
   Reveal Solution Discussion Select an answer first