A DevOps team manages a Kubernetes cluster in a cloud environment. Developers need to view logs and describe pods in the 'dev' namespace, but should not be able to create or delete resources. The team wants to enforce this using cloud IAM, not Kubernetes RBAC. What should they configure?

Grant the developers the cloud IAM role of 'Kubernetes Cluster Admin' but restrict it to the 'dev' namespace.

Attach a cloud IAM role with read-only permissions for the Kubernetes API to the developers' cloud identities.

Create a Kubernetes Role and RoleBinding in the 'dev' namespace with get and list permissions for pods and logs.

Provide the developers with the cluster's kubeconfig file and instruct them to use 'kubectl get' commands only.

In Kubernetes, what is the primary purpose of role-based access control (RBAC)?

To scan container images for vulnerabilities

To control what actions users and service accounts can perform on cluster resources

To encrypt communication between pods

To automatically scale pods based on CPU usage

A company deploys containerized applications to a Kubernetes cluster. They want to ensure that only images from a trusted registry are used and that vulnerabilities are caught before deployment. What should they implement?

Use a Kubernetes network policy to restrict pod-to-pod communication.

Set up a Kubernetes Role-Based Access Control (RBAC) policy to limit who can deploy images.

Use an admission controller that validates image signatures and rejects images from untrusted registries, and scan images for vulnerabilities in the CI pipeline.

Enable Kubernetes audit logging to record all image pulls.

A company must comply with a regulation that requires encryption keys to be rotated every 90 days. They use a cloud KMS to manage keys for encrypting data at rest. They want to automate the rotation process to avoid manual errors. What should they do?

Enable automatic key rotation in the cloud KMS and set the rotation period to 90 days.

Use a script that runs daily to check the key age and rotate it if older than 90 days.

Disable key rotation and use a longer key length to meet the compliance requirement.

Manually rotate the keys every 90 days using the cloud console.

LPI DevOps Tools Engineer

Domain 4Objective 1

704.1 Cloud Native Security (weight: 4) DEVOPS-TOOLS-ENGINEER Practice Questions (Page 5)

Part of the 704 Security and Observability domain, which makes up ~26% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~9–16 in this domain), expect 2–4 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

10concepts

Questions 21–25

21foundation · easy
In the shared responsibility model for cloud services, which party is typically responsible for securing the physical data center infrastructure in an IaaS deployment?
Select an answer first
22application · medium
A DevOps team manages a Kubernetes cluster in a cloud environment. Developers need to view logs and describe pods in the 'dev' namespace, but should not be able to create or delete resources. The team wants to enforce this using cloud IAM, not Kubernetes RBAC. What should they configure?
Select an answer first
23foundation · easy
In Kubernetes, what is the primary purpose of role-based access control (RBAC)?
Select an answer first
24application · medium
A company deploys containerized applications to a Kubernetes cluster. They want to ensure that only images from a trusted registry are used and that vulnerabilities are caught before deployment. What should they implement?
Select an answer first
25expert · hard
A company must comply with a regulation that requires encryption keys to be rotated every 90 days. They use a cloud KMS to manage keys for encrypting data at rest. They want to automate the rotation process to avoid manual errors. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DEVOPS-TOOLS-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “DEVOPS-TOOLS-ENGINEER” is a trademark of its owner, used for identification only.