2V0-71.23 Question 21
Select 3Your organization uses VMware Tanzu Kubernetes Grid (TKG) to manage Kubernetes clusters. A recent security audit identified potential vulnerabilities in the cluster configuration. As part of the remediation plan, you are tasked with enhancing the security of the cluster and its applications. Which two actions should you take to mitigate risks associated with unauthorized access and insecure application behavior?
- A
Implement Role-Based Access Control (RBAC) to restrict user and service account permissions.
- B
Disable Kubernetes Network Policies to allow unrestricted pod-to-pod communication.
- C
Use Kubernetes Secrets to securely store sensitive application data, such as database credentials.
- D
Grant cluster-admin role to all developers for faster troubleshooting and deployment.
- E
Enable Pod Security Standards (PSS) to enforce security policies for deployed workloads.
Show answer and explanation
Correct answers: A, C, E
Explanation
To secure a Kubernetes cluster and its applications, it is essential to implement RBAC to minimize access, use Kubernetes Secrets for sensitive data, and enable Pod Security Standards to enforce workload security policies. These measures reduce the risk of unauthorized access and application vulnerabilities. Disabling Network Policies or granting excessive permissions would weaken the cluster's security posture.
- A. Correct.
Implementing RBAC is a critical step in securing a Kubernetes cluster by ensuring that users and service accounts only have the minimum permissions they need to perform their tasks.
- B. Incorrect.
Disabling Network Policies would increase risk by allowing unrestricted communication between pods, which could result in lateral movement of attackers within the cluster.
- C. Correct.
Using Kubernetes Secrets is a best practice for securely managing sensitive data, ensuring that secrets are not hardcoded in application configurations or exposed in plaintext.
- D. Incorrect.
Granting cluster-admin role to all developers is a security risk as it provides excessive permissions, violating the principle of least privilege.
- E. Correct.
Enabling Pod Security Standards (PSS) helps enforce security best practices for container workloads, such as restricting privilege escalation or running as root.