NEW
Font size
WorksheetsKCSA - API Server and Networking Security
Total questions: 10
Worksheet time: 5mins
What is the primary function of the Kubernetes API Server in the control plane?
Scheduling pods
Handling REST requests and cluster interaction
Monitoring node health
Configuring storage
Which mechanism does the API Server use to verify user identities?
Network Policies
Pod Security Admission
OpenID Connect, X.509 Certificates, Service Accounts, Webhooks
Container Runtime Sandboxing
What is the principle of least privilege (PoLP) in Kubernetes, and how is it enforced for controllers?
Granting all permissions by default
Controllers run with minimal service account permissions, restricted by RBAC
Allowing privilege escalation
Using only privileged containers
Which Kubernetes component is responsible for scheduling pods onto nodes based on resource availability?
Kubelet
Controller Manager
API Server
Scheduler
What security benefit does enabling TLS communication between cluster components provide?
Disables anonymous access
Encrypts data in transit, protecting against eavesdropping and MITM attacks
Manages RBAC policies
Blocks network traffic between pods
Which method should you use to restrict network communication between pods in a Kubernetes cluster?
Pod Security Admission
RBAC RoleBindings
NetworkPolicies
Controller service accounts
Why is it important to encrypt etcd data at rest in Kubernetes?
Improves scheduler performance
Prevents unauthorized access to cluster secrets and configuration
Enables rolling updates
Allows pod IP spoofing
Which best practice limits privilege escalation in containers?
Running containers as root
Setting allowPrivilegeEscalation: false and using restricted Pod Security Admission policies
Using default service accounts
Allowing any workload on all nodes
How does audit logging in Kubernetes enhance cluster security?
Automatically rotates certificates
Tracks API activity to detect unauthorized access or suspicious changes
Schedules pods automatically
Encrypts container images
When creating roles for RBAC, why should you avoid using the 'cluster-admin' ClusterRole except when necessary?
It only allows read access
It applies only to Pods
It disables admission controllers
It grants full, unrestricted access to all resources, violating PoLP and increasing security risks
