Denial of Service KCSA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which Kubernetes resource is used to set a hard limit on the total amount of CPU and memory that all pods in a namespace can consume?

   • AResourceQuota
   • BLimitRange
   • CPodDisruptionBudget
   • DNetworkPolicy
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A multi-tenant Kubernetes cluster runs workloads from different teams on the same set of nodes. One team's application is prone to resource spikes that could affect other tenants. The cluster administrator wants to minimize the blast radius of a potential DoS attack from that application. Which approach is most effective?

   • AAssign the high-risk application to dedicated nodes using node selectors and taints, and set resource quotas in its namespace.
   • BApply a NetworkPolicy that blocks all ingress to the high-risk application.
   • CCreate a LimitRange that sets a minimum CPU request for all pods in the cluster.
   • DEnable the HorizontalPodAutoscaler on the high-risk application to scale it down during spikes.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security engineer is analyzing a DoS attack on a Kubernetes cluster. The attack involves a high volume of requests to the API server, causing it to become unresponsive. The engineer notices that the attack is coming from a single compromised service account. They want to limit the impact of this account without affecting other legitimate users. Which combination of controls should they implement?

   • AUse API Priority and Fairness (APF) to create a flow schema that limits the request rate for the compromised service account, and set a ResourceQuota on its namespace.
   • BApply a NetworkPolicy that blocks all traffic from the compromised service account's pods.
   • CRevoke the service account's permissions and delete its associated secrets.
   • DEnable the HorizontalPodAutoscaler on all deployments to scale down during the attack.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the default behavior of Kubernetes NetworkPolicies if no policies are defined?

   • AAll traffic is denied
   • BOnly traffic from the same node is allowed
   • COnly traffic from the same namespace is allowed
   • DAll traffic is allowed
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of setting up alerts on API server request latency and error rates?

   • ATo automatically scale the API server
   • BTo enforce NetworkPolicies
   • CTo detect a potential denial-of-service attack on the control plane
   • DTo block malicious IP addresses
   Reveal Solution Discussion Select an answer first