What is the primary purpose of a Kubernetes NetworkPolicy resource?

To encrypt all traffic between pods using mutual TLS

To control communication between pods by specifying allowed sources, destinations, and ports

To assign IP addresses to pods from a specific subnet

To define firewall rules for traffic entering and leaving the cluster's nodes

How does a service mesh like Istio enforce fine-grained connectivity security between services?

By using sidecar proxies that intercept and enforce policies on all traffic

By encrypting all traffic with a shared cluster-wide certificate

By modifying the CNI plugin to filter traffic at the network layer

By configuring Kubernetes NetworkPolicies for each service

A company runs a multi-tenant Kubernetes cluster. They want to isolate workloads from different tenants to prevent lateral movement. They also need to allow some cross-tenant communication for a specific integration. What is the best approach?

Use a single namespace for all tenants and rely on NetworkPolicies to isolate traffic.

Use separate namespaces per tenant and apply NetworkPolicies that deny all ingress/egress by default, then allow specific cross-tenant traffic with targeted policies.

Use network segmentation at the CNI level by assigning different subnets to each tenant.

Use separate clusters for each tenant to ensure complete isolation.

A company runs a Kubernetes cluster with a mix of Linux and Windows nodes. They want to encrypt traffic between pods running on different nodes. They are considering using a service mesh. What is a key consideration?

Service meshes work the same on all node types, so there is no issue.

Service meshes require a separate CNI plugin to encrypt traffic.

Service mesh support for Windows nodes may be limited, so they may need to use a CNI plugin that supports encryption.

Service meshes only encrypt traffic between pods on the same node.

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 4Objective 6

Connectivity KCSA Practice Questions (Page 3)

Part of the Platform Security domain, which accounts for 16% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–1 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

16%of the exam

Questions 11–15

11foundation · easy
What is the primary purpose of a Kubernetes NetworkPolicy resource?
Select an answer first
12foundation · easy
How does a service mesh like Istio enforce fine-grained connectivity security between services?
Select an answer first
13application · medium
A company runs a multi-tenant Kubernetes cluster. They want to isolate workloads from different tenants to prevent lateral movement. They also need to allow some cross-tenant communication for a specific integration. What is the best approach?
Select an answer first
14expert · hard
A company runs a Kubernetes cluster with a mix of Linux and Windows nodes. They want to encrypt traffic between pods running on different nodes. They are considering using a service mesh. What is a key consideration?
Select an answer first
15foundation · easy
Which CNI plugin is known for NOT supporting Kubernetes NetworkPolicies by default?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.