Denial of Service KCSA Practice Questions (Page 6)

Questions 26–28

1. 26application · medium

   A security engineer is concerned about an attacker flooding the Kubernetes API server with authentication requests, which could overwhelm the control plane and affect all cluster operations. Which built-in Kubernetes feature should they configure to protect the API server from such overload?

   • ASet up a NetworkPolicy to restrict access to the API server pods.
   • BEnable API Priority and Fairness (APF) to classify and limit the rate of requests.
   • CConfigure a ResourceQuota on the kube-system namespace.
   • DUse taints and tolerations to isolate the API server on dedicated nodes.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of the Cluster Autoscaler in the context of DoS resilience?

   • ATo enforce resource quotas on namespaces
   • BTo automatically add or remove nodes based on pending pods and resource utilization
   • CTo automatically scale the number of pod replicas based on CPU usage
   • DTo block traffic from malicious IP addresses
   Reveal Solution Discussion Select an answer first
3. 28application · medium

   A company runs a stateless web service on Kubernetes. During a DDoS attack, the service experiences a sudden spike in traffic, and the current number of replicas is insufficient to handle the load, causing availability issues. The team wants to maintain availability during such events without manual intervention. Which configuration should they implement?

   • AManually increase the number of replicas when an attack is detected.
   • BUse a NetworkPolicy to block traffic from unknown IP addresses.
   • CSet a very high resource limit on the pods to allow them to handle more traffic.
   • DConfigure a HorizontalPodAutoscaler (HPA) on the deployment based on CPU utilization, and enable cluster autoscaling to add nodes when needed.
   Reveal Solution Discussion Select an answer first