3.7 Explain the Deployment of Kubernetes Connectors CLOUD-SECURITY-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An administrator has deployed a Kubernetes connector and wants to confirm that it is successfully syncing data. The connector's pod is running, and the logs show no errors. Which additional check would provide the most reliable confirmation that the connector is operational?

   • AVerify that the connector's pod has a stable IP address.
   • BCheck the connector's metrics endpoint for successful API server requests.
   • CConfirm that the connector's service account has the `cluster-admin` role.
   • DVerify that the connector's deployment has the correct number of replicas.
   Reveal Solution Discussion Select an answer first
2. 17expert · medium

   A Kubernetes connector is failing to connect to the API server. The team has confirmed that the API server is healthy and reachable from the connector's pod using `curl`. The connector's configuration includes the correct endpoint and a valid service account token. However, the connector still reports a connection timeout. What is the most likely cause?

   • AThe API server is using a self-signed certificate that is not in the connector's trust store.
   • BThe connector is configured with an HTTP proxy that cannot reach the API server.
   • CThe service account token is not base64-encoded in the configuration.
   • DThe connector's pod is running in a different namespace than the service account.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A team is deploying a Kubernetes connector to a managed Kubernetes service (e.g., EKS, GKE, AKS). The connector is installed, but it cannot reach the API server. The team has verified that the API server endpoint is publicly accessible. What is the most likely prerequisite that was overlooked?

   • AThe connector's pod is not allowed to use the cluster's egress IP due to an allowlist.
   • BThe connector's service account lacks the `system:discovery` ClusterRole.
   • CThe connector was installed using a Helm chart instead of a manifest.
   • DThe connector's namespace does not have a default resource quota.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team is deploying a Kubernetes connector to monitor a self-managed cluster. The cluster API server is reachable only from a management subnet, and the team wants to use a service account with the least privilege necessary. During deployment, the connector fails to authenticate. Which prerequisite is most likely missing?

   • AThe service account token secret was not created because Kubernetes 1.24+ does not auto-generate one for the service account.
   • BThe cluster's kubeconfig file was not base64-encoded before being passed to the connector.
   • CThe API server endpoint was specified using the cluster's internal DNS name instead of its external IP.
   • DThe connector was deployed in a different namespace than the service account.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An administrator is configuring a Kubernetes connector and needs to specify the API server endpoint. The cluster uses a private DNS name for the API server that is only resolvable inside the cluster. The connector will run as a pod inside the cluster. What is the most appropriate configuration?

   • AUse the loopback address (127.0.0.1).
   • BUse the external IP address of the API server.
   • CUse the cluster's public DNS name.
   • DUse the private DNS name as the API server endpoint.
   Reveal Solution Discussion Select an answer first