Isolation Techniques KCSA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A large enterprise runs a Kubernetes cluster shared by two business units. Business Unit A handles highly sensitive data and requires that its workloads be isolated from Business Unit B at the network and identity level. Business Unit B is less sensitive but runs batch jobs that consume significant resources. The enterprise wants to avoid the cost of separate clusters. Which combination of controls provides the most appropriate isolation?

   • ASeparate namespaces, NetworkPolicies to block cross-namespace traffic, and separate service accounts with RBAC scoped to each namespace.
   • BA single namespace with NetworkPolicies based on pod labels.
   • CSeparate clusters, one for each business unit, with no shared infrastructure.
   • DUse the same namespace but different service accounts and rely on NetworkPolicies.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When choosing an isolation level, what is a common trade-off to consider?

   • AWeaker isolation always provides better security.
   • BOperational complexity is not affected by the isolation level.
   • CStronger isolation always improves performance.
   • DStronger isolation often requires more resources and operational complexity.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the purpose of sandboxing techniques in cloud native security?

   • ATo simplify the deployment of containers by removing the need for network configuration.
   • BTo run workloads in a restricted environment to contain potential security breaches.
   • CTo encrypt all data in transit between containers.
   • DTo increase the performance of workloads by removing security checks.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is network segmentation in the context of workload isolation?

   • ACombining multiple networks into one to simplify management.
   • BAssigning each workload a unique IP address.
   • CEncrypting all network traffic to protect data in transit.
   • DDividing a network into smaller subnetworks to limit communication between them.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   You operate a shared Kubernetes cluster for multiple internal teams. One team's batch job is consuming all available CPU on a node, causing latency spikes for other teams' web services on the same node. You need to prevent this without moving workloads to dedicated nodes. What should you configure?

   • AEnable the HPA (Horizontal Pod Autoscaler) on the batch job.
   • BSet resource requests and limits on the batch job's pod spec, and define a ResourceQuota for the team's namespace.
   • CApply a NetworkPolicy that blocks the batch job from reaching other pods.
   • DMove the batch job to a separate namespace without any quotas.
   Reveal Solution Discussion Select an answer first