Workload and Application Code Security KCSA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A containerized application runs as root and has access to the host's kernel. The security team wants to reduce the impact of a container escape. Which configuration is most effective?

   • ADisable all logging to reduce information leakage.
   • BUse a larger base image with more tools for debugging.
   • CEnable automatic image updates to keep the base image patched.
   • DRun the container as a non-root user and drop all capabilities.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A multi-tenant platform runs workloads from different customers on the same Kubernetes cluster. A security auditor requires that a compromise in one workload must not affect other tenants. Which isolation measure is most appropriate?

   • AUse resource quotas to limit CPU and memory usage per tenant.
   • BDisable all network policies to allow free communication.
   • CPlace each tenant's workloads in a separate namespace with NetworkPolicies.
   • DApply the same security context to all workloads.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In a secure development lifecycle, when is threat modeling typically performed?

   • AOnly after a security incident occurs
   • BOnly during the deployment phase
   • COnly when required by compliance audits
   • DDuring the design phase of the application
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A team is starting a new microservice that will handle credit card data. They want to integrate security early in the development process. Which practice best aligns with a Secure Development Lifecycle (SDL) approach?

   • APerform a threat model during the design phase and define security requirements.
   • BDeploy to production first and then conduct a penetration test.
   • CRely solely on runtime monitoring to detect and block attacks.
   • DRun a SAST scan only after the code is merged to the main branch.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security policy requires that only images that have been scanned and approved can be deployed to the production cluster. Which mechanism enforces this policy?

   • AA cron job that scans images every night and sends a report.
   • BA Kubernetes secret that stores the list of approved images.
   • CAn admission controller that validates image signatures and scan results.
   • DA NetworkPolicy that blocks traffic from unapproved images.
   Reveal Solution Discussion Select an answer first