2V0-71.23 Question 24
Select 2You are tasked with securing a Kubernetes cluster used by a financial services application. One of the requirements is to restrict access to sensitive APIs and ensure that only authorized users and service accounts can perform specific actions. Which of the following measures should you implement to achieve this?
- A
Use Role-Based Access Control (RBAC) to define granular permissions for users and service accounts.
- B
Deploy a network policy to isolate namespaces and restrict pod-to-pod communication.
- C
Enable Pod Security Admission to enforce security context and privilege settings at the pod level.
- D
Use Kubernetes Secrets to store sensitive information, such as API keys and credentials, securely.
- E
Configure audit logging to track access and modifications to the Kubernetes API.
Show answer and explanation
Correct answers: A, E
Explanation
To restrict access to sensitive APIs and ensure only authorized entities can perform specific actions, RBAC should be implemented as it provides granular access control to Kubernetes resources, including APIs. Additionally, enabling audit logging ensures that any unauthorized or suspicious access to the API can be monitored and addressed, enhancing security.
- A. Correct.
RBAC is used to assign and enforce granular permissions for users and service accounts, ensuring only authorized entities can access specific APIs or resources. This directly addresses the requirement to restrict access to sensitive APIs.
- B. Incorrect.
Network policies are used to control communication between pods and namespaces but do not directly address API access or authorization concerns.
- C. Incorrect.
Pod Security Admission helps enforce security best practices for pods, such as restricting privilege escalation, but does not restrict API access or authorization.
- D. Incorrect.
Kubernetes Secrets are used for securely storing sensitive data, but this does not involve controlling API access or user permissions.
- E. Correct.
Enabling audit logging allows you to monitor and track access to the Kubernetes API, ensuring unauthorized access attempts can be identified and responded to. This supports the requirement to ensure only authorized actions are performed.