Cluster Components Security KCSA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which method is used to encrypt communication between etcd clients and the etcd server?

   • ASecret encryption
   • BRBAC authorization
   • CTLS certificates
   • DNetworkPolicy
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security engineer is configuring a Kubernetes cluster and needs to ensure that all traffic between pods is encrypted. The cluster uses a CNI plugin that supports encryption. What is the most appropriate way to achieve this?

   • AEnable encryption at the CNI plugin level (e.g., using WireGuard or IPsec) for all pod-to-pod traffic.
   • BUse a Service Mesh like Istio with mutual TLS (mTLS) enabled.
   • CSet the 'hostNetwork: true' on all pods and rely on the host's network encryption.
   • DCreate a NetworkPolicy that allows all traffic and set 'encrypt: true' on the policy.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which security context setting in a Pod specification prevents the container from running with root privileges?

   • ArunAsNonRoot: true
   • Bprivileged: false
   • CreadOnlyRootFilesystem: true
   • DallowPrivilegeEscalation: false
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A platform team runs a multi-tenant Kubernetes cluster where each development team has its own namespace. The security team requires that workloads in the 'payments' namespace must not be able to access the cluster's internal metadata service or any pod in other namespaces, but must be able to communicate with a database pod in the same namespace. The team also wants to enforce that containers in this namespace run with a non-root user and a read-only root filesystem. Which combination of resources should the team configure?

   • AA NetworkPolicy denying all ingress, combined with a SecurityContext in each pod spec that sets 'runAsUser: 1000' and 'readOnlyRootFilesystem: true'.
   • BA NetworkPolicy allowing traffic only to the database pod's IP, combined with a Pod Security Admission label set to 'baseline' on the namespace.
   • CA NetworkPolicy allowing ingress/egress only within the 'payments' namespace, combined with a Pod Security Admission (PSA) label set to 'restricted' on the namespace.
   • DA NetworkPolicy allowing all egress, combined with a PodSecurityPolicy (PSP) that sets 'runAsNonRoot: true' and 'readOnlyRootFilesystem: true'.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A cluster administrator is setting up a new Kubernetes cluster and wants to ensure that the control plane components (API server, scheduler, controller manager) communicate securely with each other and with the kubelet on worker nodes. What is the primary mechanism to achieve this?

   • AUse a NetworkPolicy that allows traffic only between control plane components and the kubelet.
   • BSet the '--insecure-port' flag on the API server to 0 and rely on the internal network.
   • CConfigure TLS certificates for all control plane components and the kubelet, and enable '--client-cert-auth' on the kubelet.
   • DEnable 'hostNetwork: true' on all control plane pods and kubelet.
   Reveal Solution Discussion Select an answer first