Attacker on the Network KCSA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which Kubernetes Service type exposes a service on a high port on every node in the cluster, making it reachable from outside the cluster?

   • AExternalName
   • BNodePort
   • CLoadBalancer
   • DClusterIP
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security engineer is reviewing the network configuration of a Kubernetes cluster. The cluster uses a flannel CNI plugin, which does not support NetworkPolicies. The engineer wants to implement network segmentation to limit lateral movement. Which approach should the engineer take?

   • AUse a service mesh to enforce network policies.
   • BReplace the CNI plugin with a NetworkPolicy-enabled plugin such as Calico.
   • CUse Kubernetes RBAC to restrict pod-to-pod communication.
   • DImplement network segmentation using Linux iptables rules on each node.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is investigating a potential data breach. The analyst suspects that an attacker has been using DNS tunneling to exfiltrate data from a compromised pod. Which monitoring technique would be most effective in confirming this suspicion?

   • AMonitor network flow logs for connections to known malicious IP addresses.
   • BAnalyze DNS logs for a high volume of queries to a single domain with unusual record types.
   • CEnable audit logging for all pod creation events.
   • DUse a NetworkPolicy to block all DNS traffic from the compromised pod.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the default behavior for pod-to-pod traffic when a NetworkPolicy is applied to a pod?

   • AAll traffic is allowed unless explicitly denied by a policy rule
   • BAll traffic is denied unless explicitly allowed by a policy rule
   • CTraffic is allowed only if it is encrypted
   • DTraffic is allowed only if it originates from the same namespace
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is a risk of relying solely on Kubernetes Service DNS names for service discovery without additional security controls?

   • AAn attacker who can spoof DNS responses can redirect a pod to a malicious service
   • BThe DNS names will not resolve if the cluster is using a custom domain
   • CThe DNS names are automatically encrypted, preventing interception
   • DThe DNS names are only accessible from within the cluster, limiting external access
   Reveal Solution Discussion Select an answer first