Denial of Service KCSA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is an example of an application-level resource exhaustion attack in a Kubernetes cluster?

   • AAn attacker exploiting a vulnerability in the kubelet to crash the node
   • BSending a large number of TCP SYN packets to a service's external IP
   • CA misconfigured NetworkPolicy that blocks all traffic to a service
   • DA pod that repeatedly calls a CPU-intensive function, causing high CPU usage and starving other pods on the same node
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a primary denial-of-service vector in Kubernetes that specifically targets the control plane?

   • AA DNS spoofing attack that redirects traffic to a malicious service
   • BAn API server overload caused by excessive requests from compromised or misconfigured clients
   • CAn application-level resource exhaustion that consumes all available memory in a pod
   • DA network flood that saturates the node's network interface
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A cluster administrator notices that a misconfigured controller is making an excessive number of API requests, causing the API server to become slow for all users. They want to limit the impact of such misbehaving clients. Which feature should they enable?

   • APodDisruptionBudget on the controller's deployment.
   • BResourceQuota on the namespace where the controller runs.
   • CNetworkPolicy that blocks traffic to the API server.
   • DAPI Priority and Fairness (APF) with flow schemas that limit the request rate for specific clients.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A cluster administrator is troubleshooting an issue where the API server is becoming slow during peak hours. They suspect that a specific namespace's workloads are making an excessive number of API requests. They want to identify the source of the problem and implement a solution that limits the impact without affecting other namespaces. Which approach should they take?

   • AApply a NetworkPolicy that blocks traffic from the problematic namespace to the API server.
   • BUse API Priority and Fairness (APF) to create a flow schema that limits the request rate for the problematic namespace, and monitor API server metrics to confirm the source.
   • CIncrease the API server's resource limits to handle more requests.
   • DSet a ResourceQuota on the problematic namespace to limit its resource usage.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A platform team wants to set up alerts for potential DoS conditions in their Kubernetes cluster. They want to be notified when a namespace's aggregate memory usage exceeds a threshold, indicating possible resource exhaustion. Which approach should they use?

   • AUse Prometheus to scrape namespace-level metrics and create an alerting rule on the sum of container memory usage by namespace.
   • BUse kubectl top to manually check memory usage periodically.
   • CEnable the HorizontalPodAutoscaler to scale down pods when memory usage is high.
   • DUse a NetworkPolicy to block traffic to namespaces with high memory usage.
   Reveal Solution Discussion Select an answer first