KubeProxy KCSA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Why is it important to restrict access to the kube-proxy configuration and its network rules?

   • ABecause kube-proxy runs with elevated privileges and can be used to bypass network policies
   • BBecause kube-proxy must be restarted after every configuration change
   • CBecause kube-proxy is the only component that can authenticate to the API server
   • DBecause kube-proxy stores sensitive application data in its configuration
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A cluster runs kube-proxy in IPVS mode. An administrator notices that Service traffic is not being load balanced as expected; all traffic goes to the first backend pod. What is the most likely cause?

   • AThe kube-proxy configuration has 'ipvs.strictARP' set to true, which disables load balancing.
   • BThe kube-proxy mode is actually iptables, not IPVS, despite the configuration.
   • CThe Service's session affinity is set to ClientIP, causing all traffic from the same client to go to the same backend.
   • DThe IPVS scheduler is set to 'rr' but the backend pods have different weights, causing uneven distribution.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team is reviewing the cluster's network configuration. They notice that kube-proxy is running with the default settings and that the node's kube-proxy port (10249) is accessible from all network interfaces. What is the primary security concern with this configuration?

   • AThe kube-proxy configuration file is world-readable, allowing any user on the node to modify proxy rules.
   • Bkube-proxy will forward traffic to pods on other nodes, creating a lateral movement path for attackers.
   • Ckube-proxy will automatically allow inbound traffic to all Services, bypassing NetworkPolicies.
   • DThe metrics endpoint is exposed on all interfaces, allowing any network entity that can reach the node to access potentially sensitive operational data.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which kube-proxy flag restricts the proxy to listen only on the node's primary IP address instead of all interfaces?

   • A--cluster-cidr
   • B--bind-address
   • C--healthz-bind-address
   • D--metrics-bind-address
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security audit reveals that kube-proxy is running with the --proxy-mode=userspace flag. The cluster has a mix of Linux and Windows nodes. What is the primary security concern with this configuration?

   • AUserspace mode does not support NetworkPolicies, leaving the cluster unprotected.
   • BUserspace mode requires the kube-proxy process to listen on all Service ports, increasing the attack surface.
   • CUserspace mode is not supported on Windows nodes, causing kube-proxy to fail.
   • DUserspace mode is deprecated and has known vulnerabilities that are not patched.
   Reveal Solution Discussion Select an answer first