We're so confident of our products that we provide no hassle product exchange.
Linux Foundation Kubernetes and Cloud Native Security Associate Sample Questions:
1. A container image istrojanizedby an attacker by compromising the build server. Based on the STRIDE threat modeling framework, which threat category best defines this threat?
A) Spoofing
B) Repudiation
C) Denial of Service
D) Tampering
2. Which step would give an attacker a foothold in a cluster butno long-term persistence?
A) Create restarting container on host using Docker.
B) Starting a process in a running container.
C) Modify Kubernetes objects stored within etcd.
D) Modify file on host filesystem.
3. In which order are thevalidating and mutating admission controllersrun while the Kubernetes API server processes a request?
A) The order of execution varies and is determined by the cluster configuration.
B) Validating admission controllers run before mutating admission controllers.
C) Validating and mutating admission controllers run simultaneously.
D) Mutating admission controllers run before validating admission controllers.
4. A Kubernetes cluster tenant can launch privileged Pods in contravention of therestricted Pod Security Standardmandated for cluster tenants and enforced by the built-inPodSecurity admission controller.
The tenant has full CRUD permissions on the namespace object and the namespaced resources. How did the tenant achieve this?
A) The scope of the tenant role means privilege escalation is impossible.
B) By tampering with the namespace labels.
C) By using higher-level access credentials obtained reading secrets from another namespace.
D) By deleting the PodSecurity admission controller deployment running in their namespace.
5. Why mightNetworkPolicyresources have no effect in a Kubernetes cluster?
A) NetworkPolicy resources are only enforced for unprivileged Pods.
B) NetworkPolicy resources are only enforced if the user has the right RBAC permissions.
C) NetworkPolicy resources are only enforced if the networking plugin supports them.
D) NetworkPolicy resources are only enforced if the Kubernetes scheduler supports them.
Solutions:
| Question # 1 Answer: D | Question # 2 Answer: B | Question # 3 Answer: D | Question # 4 Answer: B | Question # 5 Answer: C |
By Dempsey
