A security team wants to prevent DNS-based attacks such as DNS spoofing and cache poisoning within their Kubernetes cluster. They also want to restrict which domains pods can resolve. Which approach should they implement?

Configure NetworkPolicies to restrict egress DNS traffic to a trusted DNS server.

Use CoreDNS with the 'rewrite' plugin to block malicious domains.

Implement a DNS firewall that filters queries based on domain allowlists and uses DNSSEC.

Disable DNS resolution for all pods except those that need it.

A company runs a Kubernetes cluster with a payment processing service that must be isolated from other services to limit lateral movement. They also need to allow the payment service to communicate with a specific database. What is the best way to achieve this?

Use network segmentation at the CNI level by assigning a different subnet to the payment service.

Place the payment service and database in a dedicated namespace and apply NetworkPolicies that allow only the required traffic.

Use a single namespace and rely on NetworkPolicies to isolate the payment service.

Use a separate cluster for the payment service and database.

What is the purpose of CoreDNS in a Kubernetes cluster?

To provide DNS-based service discovery for pods and services

To manage TLS certificates for the cluster

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 4Objective 6

Connectivity KCSA Practice Questions (Page 4)

Part of the Platform Security domain, which accounts for 16% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–1 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

16%of the exam

Questions 16–20

16application · medium
A security team wants to prevent DNS-based attacks such as DNS spoofing and cache poisoning within their Kubernetes cluster. They also want to restrict which domains pods can resolve. Which approach should they implement?
Select an answer first
17foundation · easy
Which NetworkPolicy field would you use to restrict a pod from making outbound connections to the internet?
Select an answer first
18foundation · easy
Which method is commonly used to encrypt traffic between Kubernetes components, such as kubelet and API server?
Select an answer first
19application · medium
A company runs a Kubernetes cluster with a payment processing service that must be isolated from other services to limit lateral movement. They also need to allow the payment service to communicate with a specific database. What is the best way to achieve this?
Select an answer first
20foundation · easy
What is the purpose of CoreDNS in a Kubernetes cluster?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.

Connectivity KCSA Practice Questions (Page 4)

Questions 16–20

A security team wants to prevent DNS-based attacks such as DNS spoofing and cache poisoning within their Kubernetes cluster. They also want to restrict which domains pods can resolve. Which approach should they implement?

Which NetworkPolicy field would you use to restrict a pod from making outbound connections to the internet?

Which method is commonly used to encrypt traffic between Kubernetes components, such as kubelet and API server?

A company runs a Kubernetes cluster with a payment processing service that must be isolated from other services to limit lateral movement. They also need to allow the payment service to communicate with a specific database. What is the best way to achieve this?

What is the purpose of CoreDNS in a Kubernetes cluster?

Keep studying — Platform Security