KubeProxy KCSA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A cluster administrator is choosing a kube-proxy mode for a large cluster that runs many Services and expects high throughput. They need to minimize latency and support a large number of Service rules efficiently. Which mode should they choose?

   • AIPVS mode, because it uses a kernel-level load balancer with a hash table that scales well and offers scheduling algorithms like round-robin.
   • Bnftables mode, because it is the newest mode and replaces iptables with a more efficient packet filtering framework.
   • Ciptables mode, because it is the default and has the lowest overhead for a small number of Services.
   • Duserspace mode, because it provides the most flexibility for custom load-balancing algorithms.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which component is responsible for updating kube-proxy's rules when a new Service is created?

   • AThe cloud-controller-manager
   • BThe kube-proxy process itself
   • CThe kubelet on the node
   • DThe kube-controller-manager
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A cluster administrator is configuring kube-proxy to run in IPVS mode. They want to ensure that the IPVS kernel modules are loaded on all nodes. Which approach should they use?

   • ASet the kube-proxy flag --ipvs-scheduler=rr to enable IPVS mode and automatically load the modules.
   • BUse a DaemonSet to run a privileged init container that loads the modules before kube-proxy starts.
   • CSet the kube-proxy flag --proxy-mode=ipvs and rely on kube-proxy to automatically load the kernel modules.
   • DAdd the IPVS modules to the node's kernel module load list (e.g., /etc/modules-load.d/kube-proxy-ipvs.conf) and ensure they are loaded before kube-proxy starts.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which security feature should be used to restrict traffic between pods, thereby reducing the attack surface that kube-proxy must handle?

   • AResource Quotas
   • BPod Security Standards
   • CNetwork Policies
   • DService Accounts
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A cluster administrator is configuring kube-proxy to run as a non-root user for security. Which flag or configuration change is necessary to allow this?

   • ASet the flag --conntrack-max-per-core=0 to disable conntrack, which removes the need for root.
   • BGrant the kube-proxy container the NET_ADMIN capability and run it with a non-root user.
   • CSet the flag --proxy-mode=userspace to avoid needing root privileges.
   • DSet the flag --iptables-sync-period=0 to disable iptables synchronization, allowing non-root operation.
   Reveal Solution Discussion Select an answer first