Isolation Techniques KCSA Practice Questions (Page 7)

Questions 31–33

1. 31foundation · easy

   What is the primary purpose of isolation techniques in cloud native environments?

   • ATo prevent workloads from interfering with each other and to limit the impact of a security breach.
   • BTo ensure that all workloads run on the same operating system kernel for easier patching.
   • CTo simplify the deployment process by removing the need for network configuration.
   • DTo increase the performance of individual workloads by dedicating hardware resources to each one.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   Your organization runs a multi-tenant Kubernetes cluster. Each tenant has its own namespace. You need to ensure that a tenant's application cannot read secrets belonging to another tenant, even if the application is compromised. Which configuration is the most effective?

   • AStore each tenant's secrets in their own namespace and use RBAC to grant each tenant's service account access only to its own namespace's secrets.
   • BStore secrets in a ConfigMap instead of a Secret to avoid the base64 encoding issue.
   • CUse a single service account for all tenants and rely on Kubernetes Secrets being encrypted at rest.
   • DStore all secrets in a single namespace and use RBAC to restrict access to specific service accounts.
   Reveal Solution Discussion Select an answer first
3. 33expert · hard

   A managed Kubernetes provider hosts multiple customers on shared nodes. A new customer requires that their workloads be isolated from other customers at the kernel level, but they also demand low latency and high performance for their compute-intensive workloads. The provider must balance security, performance, and cost. Which isolation strategy is the most appropriate?

   • AUse standard containers with cgroup limits and CPU pinning to guarantee performance.
   • BUse namespaces and NetworkPolicies to isolate the customer's workloads.
   • CUse a microVM runtime like Firecracker for the customer's workloads.
   • DUse full VMs with a hypervisor for the customer's workloads.
   Reveal Solution Discussion Select an answer first