KCSA Kubernetes Network Security Quiz

1. Which of these is NOT a best practice for Kubernetes network security?

Implementing network policies to restrict pod traffic

Using mutual TLS for pod-to-pod communication

Allowing all pods to communicate by default

Encrypting data in transit between services

2. What does the 'allowPrivilegeEscalation' field control in a security context?

Whether containers can gain elevated privileges during execution

Whether pods can access node resources

Whether services can be exposed externally

Whether volumes can be mounted read-only

3. How can you restrict a container from running as root in Kubernetes?

Using a NetworkPolicy

Setting 'runAsNonRoot: true' in the security context

Using RBAC rules

Modifying the container image

4. What is the purpose of a security context in Kubernetes?

To manage network policies

To define privilege and access control settings for containers

To encrypt cluster data

To authenticate users

5. Which tool is commonly used to scan container images for vulnerabilities?

Kubelet

Trivy or Clair

Etcd

CoreDNS

6. In Kubernetes, what does the 'default' service account provide?

Administrative access to all resources

Basic pod identity and API access within its namespace

No permissions unless explicitly granted

Access to all secrets in the cluster

7. What is the primary advantage of using a service mesh for security?

It replaces the need for RBAC

It provides transparent encryption without application code changes

It eliminates the need for network policies

It encrypts storage volumes

8. Which Kubernetes secret type is used for storing TLS certificates?

Opaque

Kubernetes.io/tls

Kubernetes.io/certificate

Kubernetes.io/ssh

9. How do you specify egress rules in a Kubernetes NetworkPolicy?

Using the 'outbound' field

Using the 'egress' field with destination rules

Egress cannot be controlled in NetworkPolicy

Using the 'routes' field

10. What does mTLS stand for in the context of service mesh security?

Multi-Transport Layer Security

Mutual Transport Layer Security

Multi-Tenant TLS

Modified TLS

11. What is the primary purpose of a Kubernetes NetworkPolicy?

To manage IP address allocation across nodes

To control traffic flow between pods based on labels and rules

To encrypt all data transmitted over the network

To route external traffic to services

12. What is the function of a Pod Security Policy (deprecated in favor of Pod Security Standards)?

To manage network traffic between pods

To enforce security constraints on pod creation

To encrypt pod storage volumes

To monitor pod resource usage

13. In Kubernetes, which component authenticates and authorizes API requests?

Kubelet

API Server

Controller Manager

Scheduler

14. What does RBAC stand for in Kubernetes security?

Role-Based Access Control

Remote Backup and Caching

Resilient Burst Allocation Control

Resource-Based Authentication Control

15. Which CNI plugin provides native network policy support in Kubernetes?

Flannel

Calico

Weave

Kubenet

16. What is the scope of a NetworkPolicy when no namespace selector is specified?

Cluster-wide

Node-level

The namespace where it is defined

All namespaces

17. Which protocol is commonly used for secure communication between Kubernetes components?

HTTP

TLS/SSL

SSH

SNMP

18. What does a service mesh like Istio primarily provide for security?

Pod-to-pod encryption and mutual TLS

Node firewall management

Persistent volume encryption

API server authentication

19. In a default Kubernetes cluster without NetworkPolicies, what is the default traffic behavior?

All traffic is blocked

All pods can communicate with each other

Only pods in the same namespace can communicate

Traffic requires explicit TLS encryption

20. Which Kubernetes object defines how external traffic reaches services?

NetworkPolicy

ServiceMesh

Ingress

LoadBalancer