Scheduler KCSA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which security practice is recommended to limit the Kubernetes scheduler's permissions?

   • ADisable authentication for the scheduler to simplify its communication with the API server
   • BGrant the scheduler cluster-admin rights so it can perform all operations
   • CUse RBAC to grant the scheduler only the permissions it needs, such as updating pod bindings
   • DRun the scheduler as a static pod on every node to increase redundancy
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In the Kubernetes scheduling process, what is the purpose of the filtering (or feasibility) stage?

   • ATo eliminate nodes that cannot satisfy the pod's requirements, such as resource requests or node selectors
   • BTo update the pod's status to 'Scheduled' after a node is chosen
   • CTo ensure the pod's containers are pulled from the correct image registry
   • DTo rank the nodes that can run the pod and choose the highest-scoring one
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   After the Kubernetes scheduler filters nodes to find feasible candidates, what does it do next to choose the final node for a pod?

   • AIt asks the user to manually choose a node from the feasible list
   • BIt randomly selects one of the feasible nodes to spread load evenly
   • CIt selects the node with the least CPU usage at that moment
   • DIt scores the feasible nodes and selects the one with the highest score
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team is reviewing the Kubernetes scheduler's permissions. They want to ensure that the scheduler can only perform its required functions and cannot modify pods or nodes outside its scope. What is the recommended approach?

   • ACreate a dedicated ServiceAccount for the scheduler and bind it to a Role that only allows updating pod bindings and node status.
   • BUse the default ServiceAccount for the scheduler to avoid extra configuration.
   • CGrant the scheduler cluster-admin permissions to ensure it can bind pods to nodes.
   • DDisable RBAC for the scheduler to simplify its operation.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A cluster administrator wants to ensure that the scheduler component itself is not compromised. They plan to run the scheduler as a static pod. What additional security measure should they implement?

   • ADisable the scheduler's secure port to reduce attack surface.
   • BUse a ServiceAccount with cluster-admin permissions for the scheduler.
   • CEnable TLS for the scheduler's secure port.
   • DSet the scheduler's CPU and memory limits to zero.
   Reveal Solution Discussion Select an answer first