Workload and Data Security CKS Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a sandboxed container runtime?

   • ADocker
   • BgVisor
   • CCRI-O
   • Dcontainerd
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which Kubernetes resource is used to store sensitive data such as passwords, tokens, or keys?

   • AServiceAccount
   • BSecret
   • CConfigMap
   • DPersistentVolume
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which combination of Kubernetes features is commonly used to implement multi-tenancy?

   • ADeployments, ReplicaSets, and StatefulSets
   • BNamespaces, ResourceQuotas, and NetworkPolicies
   • CServices, Ingress, and ConfigMaps
   • DNodes, PersistentVolumes, and StorageClasses
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   Your application needs to read a database password from a Kubernetes Secret. The security team requires that the password is not visible in the pod's environment variables or in the pod's spec. They also require that the password is rotated every 24 hours without restarting the pod. Which approach should you use?

   • AUse the Kubernetes API from within the pod to fetch the Secret periodically.
   • BMount the Secret as a volume and use a controller or sidecar to watch for changes and reload the application configuration.
   • CStore the password in a ConfigMap and mount it as a volume.
   • DInject the Secret as an environment variable and use a controller to restart the pod when the Secret changes.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the default behavior for pod-to-pod communication in a Kubernetes cluster?

   • AOnly traffic from the same node is allowed
   • BOnly traffic within the same namespace is allowed
   • CAll traffic is blocked by default
   • DAll traffic is allowed by default
   Reveal Solution Discussion Select an answer first