Isolation Techniques KCSA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is an example of hard multi-tenancy?

   • AUsing network policies to restrict traffic between pods.
   • BUsing Kubernetes namespaces to separate tenants.
   • CUsing RBAC to control access to resources.
   • DRunning each tenant in a separate virtual machine.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A SaaS provider hosts multiple customers on a shared Kubernetes cluster. The provider wants to minimize cost and operational overhead while ensuring that a compromised customer workload cannot access the host kernel or other customers' workloads. Which multi-tenancy model best fits this requirement?

   • AHard multi-tenancy by giving each customer a dedicated cluster on separate VMs.
   • BHard multi-tenancy using a single cluster but with PodSecurity admission enforcing restricted policies.
   • CSoft multi-tenancy using namespaces, RBAC, and NetworkPolicies.
   • DSoft multi-tenancy with sandboxed runtimes (e.g., gVisor or Kata Containers) for all customer workloads.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is a strength of container isolation compared to virtual machines?

   • AStronger security boundary
   • BHardware-level isolation
   • CComplete isolation from the host operating system
   • DLower resource overhead and faster startup times
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   Your organization runs a multi-tenant SaaS platform. A customer requires strong isolation from other customers due to regulatory requirements, and they are willing to pay for dedicated infrastructure. However, your platform is Kubernetes-based and you want to keep using the same orchestration tooling. Which isolation approach best satisfies the customer's requirement while preserving Kubernetes management?

   • AApply PodSecurity admission to the customer's namespace to enforce restricted security context.
   • BRun the customer's workloads in a separate Kubernetes cluster on dedicated VMs, managed by the same GitOps pipeline.
   • CUse a sandboxed runtime like gVisor for the customer's pods in the shared cluster.
   • DPlace the customer's workloads in a dedicated namespace with NetworkPolicies restricting traffic.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   Your team runs a multi-tenant Kubernetes cluster where each tenant deploys untrusted code from external partners. A security audit flags that a container escape in one tenant could expose kernel data to other tenants. You need to reduce the blast radius of a kernel exploit while keeping the operational overhead of managing per-tenant infrastructure low. Which approach best meets these requirements?

   • ADeploy workloads in gVisor or Kata Containers runtime classes within the shared cluster.
   • BMove each tenant to a separate virtual machine with its own Kubernetes node, managed by a cluster autoscaler.
   • CEnable SELinux on all nodes and set per-tenant SELinux labels on pods.
   • DApply Kubernetes NetworkPolicies to block cross-tenant traffic and rely on namespace isolation.
   Reveal Solution Discussion Select an answer first