Attacker on the Network KCSA Practice Questions (Page 6)

Questions 26–27

1. 26application · medium

   A Kubernetes cluster is shared by multiple teams. The security team wants to limit the impact of a compromised pod by preventing it from communicating with pods in other namespaces. Which approach should be used?

   • AUse a service mesh to encrypt all inter-pod traffic.
   • BApply a NetworkPolicy in each namespace that denies ingress from other namespaces.
   • CEnable Kubernetes Role-Based Access Control (RBAC) to restrict pod creation.
   • DConfigure the cluster to use a private container registry.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company runs a legacy application in Kubernetes that communicates with an external payment gateway. The application sends credit card numbers over HTTP. The security team must ensure that this data is encrypted in transit. Which solution should be implemented?

   • AUse a NetworkPolicy to restrict egress traffic to the payment gateway's IP address.
   • BConfigure the application to use HTTPS for all external communications.
   • CEnable TLS termination at the ingress controller.
   • DUse a service mesh to encrypt traffic between pods.
   Reveal Solution Discussion Select an answer first