200-901 Question 99
Select 3You are working on deploying a containerized application using Kubernetes. The application handles sensitive customer data, and you need to ensure that the data is encrypted both in transit and at rest. Which steps should you take to meet this requirement?
- A
Use Kubernetes Secrets to store sensitive data such as passwords and API keys.
- B
Enable TLS for all communication between the application services.
- C
Store sensitive data in plain text within the application pod's environment variables.
- D
Use a Persistent Volume with encryption enabled for data storage.
- E
Disable Role-Based Access Control (RBAC) to simplify access management in the cluster.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure sensitive customer data, it is critical to follow best practices for encryption and access management. Kubernetes Secrets provide a secure mechanism to store sensitive information, TLS ensures data is encrypted during communication between services, and Persistent Volumes with encryption protect data at rest. Avoid practices like storing plain text sensitive data in environment variables or disabling security features like RBAC, as these compromise security.
- A. Correct.
Correct. Kubernetes Secrets are designed to securely store sensitive information like passwords and API keys, ensuring data is encrypted and protected.
- B. Correct.
Correct. Enabling TLS ensures that all communication between application services is encrypted in transit, protecting sensitive data from interception.
- C. Incorrect.
Incorrect. Storing sensitive data in plain text in environment variables poses a security risk because it can be easily accessed by anyone with access to the pod.
- D. Correct.
Correct. Using a Persistent Volume with encryption enabled ensures that any data stored at rest is encrypted and protected from unauthorized access.
- E. Incorrect.
Incorrect. Disabling RBAC would increase the risk of unauthorized access to the cluster and is not a recommended practice for securing sensitive data.