Cluster Components Security KCSA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which Kubernetes feature can be used to encrypt Secrets at rest in etcd?

   • AEncryptionConfiguration
   • BPodSecurityPolicy
   • CStorageClass
   • DNetworkPolicy
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which Kubernetes feature allows you to control the filesystem permissions of a mounted volume?

   • AServiceAccount
   • BNetworkPolicy
   • CResourceQuota
   • DsecurityContext with fsGroup
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company runs a multi-tenant cluster where a 'finance' team and a 'marketing' team share the same worker nodes. The finance team requires that their pods must not be able to read the memory or process list of marketing pods. The marketing team has a legacy application that must run as root. The security team wants to enforce the strongest possible isolation without breaking the marketing application. What should the administrator configure?

   • AUse a RuntimeClass that leverages gVisor or Kata Containers for the finance pods, and apply the 'baseline' PSA label to the marketing namespace.
   • BApply the 'restricted' Pod Security Admission label to the 'finance' namespace and the 'baseline' label to the 'marketing' namespace.
   • CUse a NetworkPolicy to block all traffic between the finance and marketing namespaces.
   • DApply the 'restricted' PSA label to both namespaces and configure the marketing application to run with 'allowPrivilegeEscalation: false'.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A financial services company is deploying a stateful application on a managed Kubernetes cluster (EKS). The application writes sensitive customer data to a PersistentVolume. The security team mandates that data at rest must be encrypted and that only the specific application pod should have access to the volume. What should the team configure?

   • AUse a Secret to store the volume's encryption key and mount it into the application pod.
   • BEnable encryption on the underlying cloud storage (e.g., EBS encryption) and use a PersistentVolumeClaim with 'accessModes: ReadWriteOnce' and a pod-level SecurityContext that sets 'fsGroup' to a specific group ID.
   • CCreate a NetworkPolicy that allows only the application pod to access the PersistentVolume's IP address.
   • DUse a StorageClass with 'encrypted: true' and set the PersistentVolume's accessModes to 'ReadWriteOnce'.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A cluster administrator is securing a Kubernetes cluster and wants to ensure that secrets stored in etcd are encrypted. The cluster is running on a cloud provider. What is the correct way to enable encryption at rest for etcd data?

   • AEnable encryption at rest for the etcd volume at the cloud provider level (e.g., EBS encryption).
   • BUse a NetworkPolicy to restrict access to etcd to only the API server.
   • CSet the 'encryption: true' field in the etcd configuration file.
   • DConfigure the API server with the '--encryption-provider-config' flag and provide a configuration file with a secret key.
   Reveal Solution Discussion Select an answer first