A company wants to implement a canary release for a new version of a service. They want to monitor the error rate and latency of the new version before increasing traffic. What should they use?

A manual review of the new version's code.

The Kubernetes dashboard to view pod status.

Kubernetes liveness probes to check if the new version is running.

The service mesh's metrics and tracing to monitor the new version's performance.

A company is considering a service mesh but is worried about the performance overhead of sidecar proxies. They have a high-throughput application with strict latency requirements. What is the best way to evaluate the impact?

Use the service mesh's default configuration without tuning, as it is optimized for performance.

Run a proof-of-concept with representative traffic and measure latency and throughput with and without the mesh.

Avoid using a service mesh altogether to eliminate any performance risk.

Assume the overhead is negligible because sidecar proxies are lightweight.

How does a service mesh enforce authorization policies between services?

By using a firewall to block external traffic

By encrypting all traffic with a shared key

By configuring rules that specify which services are allowed to communicate

By requiring users to log in with multi-factor authentication

A company is adopting a service mesh and wants to ensure that legacy services that do not support mTLS can still communicate with new services that do. What is the best approach?

Force STRICT mode immediately and update all legacy services to support mTLS.

Use a separate mesh for legacy services.

Use mTLS in PERMISSIVE mode initially, then gradually migrate services to STRICT mode.

Disable mTLS entirely and rely on network security.

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 4Objective 4

Service Mesh KCSA Practice Questions (Page 5)

Part of the Platform Security domain, which accounts for 16% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–1 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

5concepts

16%of the exam

Questions 21–25

21foundation · easy
Which deployment strategy does a service mesh commonly support by gradually shifting a percentage of traffic from an old version to a new version of a service?
Select an answer first
22application · medium
A company wants to implement a canary release for a new version of a service. They want to monitor the error rate and latency of the new version before increasing traffic. What should they use?
Select an answer first
23expert · hard
A company is considering a service mesh but is worried about the performance overhead of sidecar proxies. They have a high-throughput application with strict latency requirements. What is the best way to evaluate the impact?
Select an answer first
24foundation · easy
How does a service mesh enforce authorization policies between services?
Select an answer first
25expert · hard
A company is adopting a service mesh and wants to ensure that legacy services that do not support mTLS can still communicate with new services that do. What is the best approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.