API Server KCSA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How does the Kubernetes API server secure communication with clients?

   • ABy using a VPN for all client connections.
   • BBy using SSH tunnels for all client connections.
   • CBy using IPsec to encrypt all network traffic.
   • DBy using TLS to encrypt all traffic between clients and the API server.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a recommended best practice for hardening the Kubernetes API server?

   • ADisable audit logging to reduce performance overhead.
   • BEnable the insecure port to allow easy access for debugging.
   • CAllow anonymous access to all API endpoints to simplify authentication.
   • DDisable the insecure port (port 8080) and ensure all communication uses the secure port (port 6443).
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Why is enabling audit logging considered a best practice for API server hardening?

   • AIt encrypts all data stored in etcd.
   • BIt provides a record of all API requests, which can be used to detect and investigate suspicious activities.
   • CIt automatically blocks malicious requests.
   • DIt reduces the attack surface by disabling unused API endpoints.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary role of the Kubernetes API server in relation to cluster security?

   • AIt is responsible for running container workloads and enforcing security policies at the node level.
   • BIt acts as the central gateway for all cluster operations, enforcing authentication, authorization, and admission controls on every request.
   • CIt primarily manages network policies and firewall rules for the cluster.
   • DIt only handles requests from external users and does not process requests from internal components like kubelets or controllers.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the purpose of OpenID Connect (OIDC) as an authentication mechanism for the Kubernetes API server?

   • AIt allows users to authenticate using their existing identity provider (e.g., corporate SSO) by exchanging OIDC tokens.
   • BIt provides a way to authenticate pods to the API server using short-lived tokens.
   • CIt replaces the need for RBAC by providing fine-grained access control.
   • DIt encrypts all communication between the API server and clients.
   Reveal Solution Discussion Select an answer first