Denial of Service KCSA Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security operations team is setting up monitoring for a Kubernetes cluster to detect DoS attacks. They want to detect both network-level floods and application-level resource exhaustion. They also want to be able to respond quickly to mitigate the attack. Which combination of monitoring and response capabilities should they implement?

   • AUse a NetworkPolicy to block all traffic from unknown IP addresses.
   • BUse kubectl top to monitor resource usage and manually apply NetworkPolicies when an attack is detected.
   • CEnable the HorizontalPodAutoscaler on all deployments to automatically scale during high load.
   • DUse Prometheus to collect network and resource metrics, set up alerts for anomalies, and integrate with a policy engine to automatically apply NetworkPolicies or scale resources.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A Kubernetes cluster hosts a microservices application. The frontend service is exposed to the internet, and the backend service should only be reachable from the frontend. An attacker is flooding the backend service directly with traffic, causing it to become overloaded. Which action would most directly mitigate this network-based DoS vector?

   • AAdd a taint to the backend nodes to prevent other workloads from scheduling there.
   • BCreate a NetworkPolicy that allows ingress to the backend pods only from the frontend pods.
   • CEnable the HorizontalPodAutoscaler on the backend deployment.
   • DIncrease the resource limits on the backend pods to handle more traffic.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which Kubernetes metric is most directly useful for detecting a CPU-based resource exhaustion attack on a workload?

   • AThe number of replicas in a Deployment
   • BThe version of the Kubernetes API server
   • CThe number of NetworkPolicies applied to the namespace
   • DThe CPU usage of the pod's containers
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of a LimitRange in a Kubernetes namespace?

   • ATo restrict the total amount of CPU and memory that all pods in the namespace can use
   • BTo block network traffic from specific IP ranges to pods in the namespace
   • CTo set default and maximum resource requests and limits for individual pods or containers
   • DTo automatically scale pods based on CPU utilization
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A Kubernetes cluster hosts multiple teams in shared namespaces. One team's application is known to have memory leaks, and the administrator wants to ensure that a single pod cannot consume all the memory of a node, affecting other workloads. Which Kubernetes resource should be configured to enforce a maximum memory limit per pod?

   • APodDisruptionBudget in the namespace
   • BResourceQuota in the namespace
   • CLimitRange in the namespace
   • DNetworkPolicy in the namespace
   Reveal Solution Discussion Select an answer first