A company needs to encrypt traffic between pods in a Kubernetes cluster. They are considering using a service mesh. What is a key consideration when using a service mesh for encryption?

The service mesh only encrypts traffic between services in the same namespace.

The service mesh encrypts traffic at the application layer, so no additional configuration is needed.

The service mesh must be configured to enforce mTLS in strict mode to ensure all traffic is encrypted.

The service mesh automatically encrypts traffic without any configuration.

A financial services company runs a multi-service application in Kubernetes. They need to ensure that all service-to-service communication is encrypted and that each service can verify the identity of the other. They also want to enforce fine-grained access policies between services. Which solution should they adopt?

Configure NetworkPolicies to allow only specific pod-to-pod traffic and rely on the CNI plugin for encryption.

Enable TLS on the Kubernetes API server and assume all pod-to-pod traffic is encrypted.

Use Kubernetes Secrets to distribute TLS certificates to each pod and configure mutual TLS manually.

Implement a service mesh like Istio with automatic mTLS and AuthorizationPolicies.

Why is the choice of CNI plugin a security consideration in a Kubernetes cluster?

Different CNI plugins have different capabilities for NetworkPolicy enforcement and network isolation

CNI plugins are responsible for encrypting all pod-to-pod traffic

CNI plugins determine the Kubernetes version that can be used

CNI plugins control access to the Kubernetes API server

What is a common way to encrypt traffic between pods in a Kubernetes cluster?

Setting the `encryption` flag in the pod spec

A security auditor asks about the security implications of the CNI plugin used in a Kubernetes cluster. Which statement is accurate regarding CNI plugins?

CNI plugins can enforce NetworkPolicies, but the level of enforcement varies by plugin.

All CNI plugins provide the same level of security features.

CNI plugins automatically encrypt all pod-to-pod traffic.

CNI plugins are responsible for DNS resolution.

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 4Objective 6

Connectivity KCSA Practice Questions (Page 5)

Part of the Platform Security domain, which accounts for 16% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–1 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

16%of the exam

Questions 21–25

21application · medium
A company needs to encrypt traffic between pods in a Kubernetes cluster. They are considering using a service mesh. What is a key consideration when using a service mesh for encryption?
Select an answer first
22application · medium
A financial services company runs a multi-service application in Kubernetes. They need to ensure that all service-to-service communication is encrypted and that each service can verify the identity of the other. They also want to enforce fine-grained access policies between services. Which solution should they adopt?
Select an answer first
23foundation · easy
Why is the choice of CNI plugin a security consideration in a Kubernetes cluster?
Select an answer first
24foundation · easy
What is a common way to encrypt traffic between pods in a Kubernetes cluster?
Select an answer first
25application · medium
A security auditor asks about the security implications of the CNI plugin used in a Kubernetes cluster. Which statement is accurate regarding CNI plugins?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.