A company runs a customer-facing web application on Kubernetes. During a recent incident, a flood of HTTP requests caused the application pods to consume excessive CPU and memory, leading to node pressure and evictions. The security team wants to prevent a single compromised or misbehaving pod from exhausting the resources of the shared node. Which combination of controls should they implement?

Define ResourceQuota and LimitRange in the namespace, and set CPU and memory limits on each pod's container.

Apply a NetworkPolicy that restricts ingress traffic to the application pods from known clients.

Configure taints on the nodes and tolerations on the application pods to isolate them.

Enable HorizontalPodAutoscaler on the deployment to scale out during high load.

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 6Objective 1

Denial of Service KCSA Practice Questions (Page 1)

Part of the Kubernetes Threat Model domain, which accounts for 16% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

7concepts

16%of the exam

Questions 1–5

1foundation · easy
Which Kubernetes feature is designed to prevent a single client or workload from overwhelming the API server by limiting the rate of requests?
Select an answer first
2application · medium
A company runs a customer-facing web application on Kubernetes. During a recent incident, a flood of HTTP requests caused the application pods to consume excessive CPU and memory, leading to node pressure and evictions. The security team wants to prevent a single compromised or misbehaving pod from exhausting the resources of the shared node. Which combination of controls should they implement?
Select an answer first
3foundation · easy
Which Kubernetes feature allows you to prevent pods from being scheduled on a node unless the node has a matching label?
Select an answer first
4foundation · easy
Which Kubernetes feature automatically adjusts the number of pod replicas based on observed CPU utilization or custom metrics?
Select an answer first
5foundation · easy
Which admission controller can be used to validate or mutate requests before they are persisted to etcd, and can be used to enforce policies that prevent resource exhaustion?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.

Denial of Service KCSA Practice Questions (Page 1)

Questions 1–5

Which Kubernetes feature is designed to prevent a single client or workload from overwhelming the API server by limiting the rate of requests?

Which Kubernetes feature allows you to prevent pods from being scheduled on a node unless the node has a matching label?

Which Kubernetes feature automatically adjusts the number of pod replicas based on observed CPU utilization or custom metrics?

Which admission controller can be used to validate or mutate requests before they are persisted to etcd, and can be used to enforce policies that prevent resource exhaustion?

Keep studying — Kubernetes Threat Model