Free Linux Foundation KCSA Exam Dumps Questions & Answers

An attacker compromises a Pod and attempts to use its service account token to escalate privileges within the cluster. Which Kubernetes security feature is designed tolimit what this service account can do?

• A.  RuntimeClass
• B.  NetworkPolicy
• C.  PodSecurity admission
• D.  Role-Based Access Control (RBAC)

Given a standard Kubernetes cluster architecture comprising a single control plane node (hosting bothetcdand the control plane as Pods) and three worker nodes, which of the following data flows crosses atrust boundary
?

• A.  From kubelet to Controller Manager
• B.  From kubelet to API Server
• C.  From API Server to Container Runtime
• D.  From kubelet to Container Runtime

Which of the following statements is true concerning the use ofmicroVMsover user-space kernel implementations for advanced container sandboxing?

• A.  MicroVMs offer higher isolation than user-space kernel implementations at the cost of a higher per- instance memory footprint.
• B.  MicroVMs allow for easier container management and orchestration than user-space kernel implementation.
• C.  MicroVMs provide reduced application compatibility and higher per-system call overhead than user- space kernel implementations.
• D.  MicroVMs offer lower isolation and security compared to user-space kernel implementations.

By default, in a Kubeadm cluster, which authentication methods are enabled?

• A.  X509 Client Certs, Webhook Authentication, and Service Account Tokens
• B.  OIDC, Bootstrap tokens, and Service Account Tokens
• C.  X509 Client Certs, Bootstrap Tokens, and Service Account Tokens
• D.  X509 Client Certs, OIDC, and Service Account Tokens

Is it possible to restrict permissions so that a controller can only change the image of a deployment (without changing anything else about it, e.g., environment variables, commands, replicas, secrets)?

• A.  Yes, with a 'managed fields' annotation.
• B.  Not with RBAC, but it is possible with an admission webhook.
• C.  No, because granting access to the spec.containers.image field always grants access to the rest of the spec object.
• D.  Yes, by granting permission to the /image subresource.