Denial of Service KCSA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company runs a stateful application on Kubernetes that is critical to operations. During a DoS attack, the application's pods are evicted due to resource pressure, and the statefulset does not recover quickly. The team wants to ensure that the application remains available and recovers quickly from such events. Which configuration should they implement?

   • AIncrease the number of replicas to a very high number.
   • BDisable the HorizontalPodAutoscaler to prevent scaling during an attack.
   • CSet appropriate resource requests and limits, and configure a PodDisruptionBudget to ensure a minimum number of pods are available during disruptions.
   • DUse a NetworkPolicy to block all traffic to the application during an attack.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a valid use of a Kubernetes NetworkPolicy to mitigate network-based denial-of-service?

   • AAutomatically blocking IP addresses that exceed a certain request rate
   • BLimiting the number of connections a pod can accept
   • CRestricting ingress traffic to a pod to only come from specific pods or namespaces
   • DPrioritizing traffic from certain pods over others
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the purpose of pod anti-affinity in the context of DoS mitigation?

   • ATo prevent pods from being scheduled on nodes that have a specific taint
   • BTo ensure that pods of the same workload are scheduled on the same node to reduce network latency
   • CTo spread pods across different nodes to avoid a single point of failure
   • DTo restrict pods to nodes that have a specific label
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A cluster runs a critical application alongside less critical workloads. The critical application is sensitive to latency, and the administrator wants to ensure that a DoS attack on the less critical workloads does not affect the critical one. Which scheduling strategy should they use?

   • AUse node selectors and taints to dedicate specific nodes to the critical application, and add tolerations to its pods.
   • BUse pod anti-affinity to spread the critical application's pods across all nodes.
   • CUse a NetworkPolicy to block all traffic to the less critical workloads.
   • DSet a very high priority class on the critical application's pods.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A platform team wants to detect a potential DoS attack on a Kubernetes cluster early. They plan to monitor metrics that indicate resource exhaustion or API server overload. Which set of metrics should they focus on to detect such conditions?

   • AImage pull counts and container restart counts.
   • BNumber of pods in the cluster and node count.
   • CCluster version and kubelet version.
   • DContainer CPU and memory usage, API server request latency and error rates, and network packet drops.
   Reveal Solution Discussion Select an answer first