Isolation Techniques KCSA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the difference between soft and hard multi-tenancy?

   • ASoft multi-tenancy requires a hypervisor, while hard multi-tenancy does not.
   • BSoft multi-tenancy is more secure than hard multi-tenancy.
   • CSoft multi-tenancy uses logical isolation, while hard multi-tenancy uses stronger isolation mechanisms like separate VMs.
   • DHard multi-tenancy is cheaper to implement than soft multi-tenancy.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a common method to isolate storage between workloads?

   • AUsing a single namespace for all workloads.
   • BUsing the same volume for all workloads to reduce cost.
   • CEncrypting the host's disk.
   • DUsing separate storage volumes for each workload.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a key difference between container isolation and virtual machine isolation?

   • AContainers provide stronger isolation than VMs.
   • BVMs are lighter weight and start faster than containers.
   • CContainers require a hypervisor to run, while VMs do not.
   • DContainers share the host kernel, while VMs have their own kernel.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   Two teams share a Kubernetes cluster. Team A runs a database that stores sensitive customer data. Team B runs a data-processing job that needs to read a specific subset of that data. You need to ensure Team B's job can read the data without being able to access the database directly or read other data in the same storage system. Which approach best achieves this?

   • AGrant Team B's service account permissions to read the database pod's IP and port, and let the job query the database directly.
   • BShare the database's existing PVC with Team B's job by adding it to the job's pod spec.
   • CCreate a NetworkPolicy that allows Team B's job to reach the database pod on port 5432.
   • DExport the required subset of data to a separate PersistentVolumeClaim (PVC) in Team B's namespace, and mount it into the job.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   Your security team is reviewing the isolation properties of your container platform. They note that a vulnerability in the Linux kernel could allow a container to read host memory. You need to recommend a deployment model that provides a stronger isolation boundary than standard containers, while still allowing you to run containerized applications. Which option should you recommend?

   • ARun each container directly on the host with `--network=host` to reduce overhead.
   • BApply SELinux labels to each container to confine its access.
   • CRun containers inside a virtual machine, with the VM providing the isolation boundary.
   • DUse Docker's default bridge network and rely on the container's own kernel.
   Reveal Solution Discussion Select an answer first