Scheduler KCSA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security auditor is reviewing the scheduler's configuration and notices it is running with the --kubeconfig flag pointing to a file with broad permissions. What is the primary security concern?

   • AThe scheduler might use the wrong API server endpoint.
   • BThe kubeconfig file could be read by unauthorized users, exposing credentials.
   • CThe scheduler will not be able to authenticate to the API server.
   • DThe scheduler might schedule pods on unauthorized nodes.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A pod is stuck in Pending state. The administrator checks the events and sees '0/3 nodes are available: 3 Insufficient cpu'. The pod requests 2 CPUs, but each node has only 1 CPU available. What is the most likely cause?

   • AThe pod's resource request exceeds the available CPU on all nodes.
   • BThe scheduler is not running.
   • CThe nodes are tainted and the pod lacks tolerations.
   • DThe pod has a nodeSelector that matches no nodes.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An administrator notices that pods are frequently scheduled on nodes with high CPU utilization, causing performance issues. They want the scheduler to avoid nodes that are already heavily loaded. What is the most effective way to achieve this?

   • AConfigure the scheduler's scoring policy to use the 'LeastRequestedPriority' plugin.
   • BSet nodeSelector on the pods to only match nodes with low CPU usage.
   • CUse taints on nodes that are heavily loaded and add tolerations to all pods.
   • DManually move pods to other nodes using kubectl drain.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team is investigating a potential compromise of the scheduler. They suspect that an attacker with access to the scheduler's pod could manipulate pod scheduling to run malicious workloads on specific nodes. What additional security measure can they implement to detect such manipulation?

   • AEnable audit logging for the scheduler's API requests.
   • BSet resource limits on the scheduler pod to prevent resource exhaustion.
   • CUse network policies to restrict the scheduler's egress traffic.
   • DUse a read-only filesystem for the scheduler container.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary responsibility of the Kubernetes scheduler?

   • ATo expose the Kubernetes API to external clients
   • BTo assign pods to nodes based on resource requirements and constraints
   • CTo run and manage container runtimes on each node
   • DTo store cluster state and configuration data
   Reveal Solution Discussion Select an answer first