Attacker on the Network KCSA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   An attacker on the cluster network sends traffic that appears to come from a legitimate service's IP address. Which network attack technique does this describe?

   • AIP spoofing
   • BDNS cache poisoning
   • CPort scanning
   • DARP poisoning
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which scenario is most vulnerable to unencrypted traffic?

   • AA pod using mTLS to communicate with a service mesh
   • BA pod sending HTTP requests to another pod on the same node
   • CA pod using HTTPS to communicate with an external API
   • DA pod using a Kubernetes Service to communicate with another pod
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A developer exposes a database service using a NodePort service to allow external access for debugging. The security team is concerned about the risk. Which action should be taken to reduce the risk while still allowing debugging?

   • AKeep the NodePort service but restrict the source IP ranges in the NetworkPolicy.
   • BChange the service to a ClusterIP service and use a bastion host with a VPN to access the database.
   • CEnable TLS for the database service.
   • DUse a LoadBalancer service instead of NodePort to expose the database.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security analyst is investigating a potential network attack. The analyst notices that a pod is making connections to an IP address that is not in the cluster's known service list. The analyst suspects that the pod is communicating with a command-and-control server. Which monitoring technique would be most effective in confirming this?

   • AEnable audit logging for all pod exec commands.
   • BUse a network flow log to identify the destination IP and compare it with threat intelligence feeds.
   • CDeploy a service mesh to encrypt all pod-to-pod traffic.
   • DUse a NetworkPolicy to block all egress traffic from the pod.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company runs a microservices application in a Kubernetes cluster. The application uses a service mesh to encrypt traffic between services. However, the security team discovers that traffic between the service mesh sidecar and the application container is unencrypted. An attacker with access to the pod could intercept this traffic. Which action should be taken to mitigate this risk?

   • AEnable TLS within the pod between the sidecar and the application container.
   • BMove the application container to a separate pod.
   • CDisable the service mesh and rely on NetworkPolicies for security.
   • DUse a NetworkPolicy to block all traffic from the application container.
   Reveal Solution Discussion Select an answer first