2V0-71.23 Question 340
Select 3You are tasked with improving the security posture of your organization's Tanzu Kubernetes Grid (TKG) environment. As part of this effort, you need to ensure that workloads follow security best practices, including limiting permissions and isolating workloads. Which of the following practices should you implement to enhance the security of your TKG environment?
- A
Implement Role-Based Access Control (RBAC) to restrict user and service account permissions.
- B
Run all workloads with root privileges for easier debugging and administration.
- C
Enable network policies to control pod-to-pod and pod-to-external communication.
- D
Disable Kubernetes audit logging to reduce resource overhead.
- E
Enforce image signing and scanning to ensure only trusted container images are deployed.
Show answer and explanation
Correct answers: A, C, E
Explanation
To enhance the security of a Tanzu Kubernetes Grid (TKG) environment, it is essential to implement best practices such as RBAC for fine-grained permission control, network policies for communication restrictions, and image signing/scanning to maintain trusted workloads. Avoid practices like running workloads with root privileges or disabling audit logging, as these compromise the security and visibility of the environment.
- A. Correct.
Implementing Role-Based Access Control (RBAC) is a critical security measure to restrict permissions and follow the principle of least privilege, reducing the risk of unauthorized actions.
- B. Incorrect.
Running workloads with root privileges is a poor practice as it increases the attack surface and can lead to privilege escalation in the event of a security breach.
- C. Correct.
Enabling network policies is essential to control communication between pods and external entities, which helps minimize the potential for lateral movement during an attack.
- D. Incorrect.
Disabling Kubernetes audit logging is not recommended as it removes visibility into cluster activities, which is crucial for detecting and responding to security incidents.
- E. Correct.
Enforcing image signing and scanning ensures that only trusted and verified container images are used, reducing the risk of deploying malicious or vulnerable images.