Which other controllers are part of the kube-controller-manager inside the Kubernetes cluster?

• A.Job controller, CronJob controller, and DaemonSet controller
• B.Pod, Service, and Ingress controller
• C.Namespace controller, ConfigMap controller, and Secret controller
• D.Replication controller, Endpoints controller, Namespace controller, and ServiceAccounts controller

Comment: *

Name: *

Email: *

Verification: *

Which way of defining security policy brings consistency, minimizes toil, and reduces the probability of misconfiguration?

• A.Using a declarative approach to define security policies as code.
• B.Relying on manual audits and inspections for security policy enforcement.
• C.Manually configuring security controls for each individual resource, regularly.
• D.Implementing security policies through manual scripting on an ad-hoc basis.

Comment: *

Name: *

Email: *

Verification: *

Is it possible to restrict permissions so that a controller can only change the image of a deployment (without changing anything else about it, e.g., environment variables, commands, replicas, secrets)?

• A.Yes, by granting permission to the /image subresource.
• B.Not with RBAC, but it is possible with an admission webhook.
• C.No, because granting access to the spec.containers.image field always grants access to the rest of the spec object.
• D.Yes, with a 'managed fields' annotation.

Comment: *

Name: *

Email: *

Verification: *

Which of the following statements correctly describes a container breakout?

• A.A container breakout is the process of escaping the container and gaining access to the Pod's network traffic.
• B.A container breakout is the process of escaping a container when it reaches its resource limits.
• C.A container breakout is the process of escaping the container and gaining access to the cloud provider's infrastructure.
• D.A container breakout is the process of escaping the container and gaining access to the host operating system.

Comment: *

Name: *

Email: *

Verification: *

In order to reduce the attack surface of the Scheduler, which default parameter should be set to false?

• A.--scheduler-name
• B.--profiling
• C.--secure-kubeconfig
• D.--bind-address

Comment: *

Name: *

Email: *

Verification: *