Attacker on the Network KCSA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company exposes a web application via an Ingress resource. The application is also accessible via a NodePort service for debugging. The security team wants to minimize the attack surface while keeping the application accessible. Which action should be taken?

   • AKeep the NodePort service but restrict access to it using a NetworkPolicy.
   • BRemove the NodePort service and rely solely on the Ingress for external access.
   • CUse a LoadBalancer service instead of the Ingress.
   • DEnable TLS for the NodePort service.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a technique for detecting suspicious network behavior in a Kubernetes cluster?

   • AReviewing container image vulnerabilities
   • BChecking the Kubernetes API server audit logs for failed authentication
   • CVerifying that all pods have resource limits set
   • DAnalyzing flow logs for unexpected connections to external IPs
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of Kubernetes Network Policies?

   • ATo encrypt all traffic between pods automatically
   • BTo provide DNS resolution for services
   • CTo load balance traffic across pods
   • DTo restrict traffic between pods based on labels and ports
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company runs a web application in a Kubernetes cluster. The application is exposed to the internet via a LoadBalancer service. A security audit reveals that traffic between the external client and the LoadBalancer is encrypted, but traffic between the LoadBalancer and the backend pods is not. An attacker with access to the cluster network could potentially intercept this internal traffic. Which action would most directly address this vulnerability?

   • AConfigure the application to use HTTP/2 for all internal communications.
   • BApply a NetworkPolicy that denies all ingress traffic to the backend pods.
   • CEnable TLS termination at the ingress controller and use a service mesh with mutual TLS for pod-to-pod communication.
   • DSwitch the LoadBalancer service to a NodePort service to reduce the attack surface.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How do Network Policies help limit an attacker's lateral movement within a cluster?

   • ABy automatically detecting and blocking malicious traffic
   • BBy blocking all traffic to and from pods by default
   • CBy isolating pods in separate virtual networks
   • DBy encrypting all pod-to-pod traffic
   Reveal Solution Discussion Select an answer first