Isolation Techniques KCSA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the role of kernel namespaces in container isolation?

   • AThey create a separate kernel for each container to prevent kernel-level attacks.
   • BThey limit the amount of CPU and memory a container can use.
   • CThey encrypt the container's filesystem to prevent unauthorized access.
   • DThey provide each container with its own view of system resources like processes, network interfaces, and filesystem mounts.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the role of a hypervisor in virtual machine isolation?

   • AIt encrypts the VM's disk to protect data at rest.
   • BIt limits the CPU and memory usage of each container.
   • CIt shares the host kernel among multiple VMs to reduce overhead.
   • DIt provides each VM with its own isolated kernel and hardware resources.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which kernel namespace is responsible for isolating the list of running processes that a container can see?

   • AMount namespace
   • BNetwork namespace
   • CUser namespace
   • DPID namespace
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is a key consideration when selecting an isolation level for a workload?

   • AThe security requirements and threat model of the workload.
   • BThe color scheme of the application's user interface.
   • CThe programming language used to write the application.
   • DThe number of developers on the team.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A fintech company runs a Kubernetes cluster for internal microservices. They want to isolate a new, untrusted third-party workload from the rest of the cluster, but they are concerned about the performance overhead of full VMs. They also need to keep using the same Kubernetes API and tooling. Which isolation technique best meets these requirements?

   • AUse a sidecar container to monitor the workload's system calls and block suspicious activity.
   • BDeploy the workload on a dedicated node with taints and tolerations.
   • CRun the workload in a separate namespace with a NetworkPolicy that denies all ingress and egress.
   • DUse a microVM runtime like Kata Containers for the untrusted workload.
   Reveal Solution Discussion Select an answer first