Cluster Components Security KCSA Practice Questions (Page 4)

Questions 16–19

1. 16foundation · easy

   Which Kubernetes feature is used to control which users or service accounts can perform operations on etcd through the Kubernetes API?

   • APodSecurityPolicy
   • BNetworkPolicy
   • CResourceQuota
   • DRBAC
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the default behavior of Kubernetes regarding Pod-to-Pod network traffic?

   • APods are isolated by default and require explicit rules to communicate
   • BAll Pods can communicate with each other by default
   • COnly Pods in the same namespace can communicate
   • DTraffic is encrypted by default
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a recommended practice to protect persistent data in Kubernetes against data loss?

   • AUsing emptyDir volumes
   • BDisabling encryption at rest
   • CRegular backups of PersistentVolumes
   • DSetting fsGroup to root
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security auditor is reviewing a Kubernetes cluster and finds that the etcd database, which stores all cluster secrets, is accessible on port 2379 from any pod in the cluster. The auditor requires that only the API server should be able to communicate with etcd, and that all communication should be encrypted. The cluster is managed with kubeadm. What is the minimum set of changes the administrator should implement?

   • ASet the '--client-cert-auth' flag on etcd and provide it with a CA bundle, then configure the API server to present a client certificate signed by that CA.
   • BApply a NetworkPolicy that denies all traffic to port 2379 from all pods, and enable etcd's built-in authentication with a static token.
   • CMove etcd to a separate, isolated network segment and use a firewall rule to allow only the API server's IP address to reach port 2379.
   • DConfigure etcd to listen only on localhost and use TLS certificates for peer and client communication, then restart the etcd and API server components.
   Reveal Solution Discussion Select an answer first