Isolate a Compromised Pod Using NetworkPolicy

• A.Modify the pod's labels to prevent it from receiving traffic
• B.Delete the pod to stop its activity
• ✓ C.Apply a NetworkPolicy that denies all traffic to and from the pod's labels
• D.Scale down the deployment to zero replicas

Why C: Applying a NetworkPolicy that denies all ingress and egress traffic to the pod isolates it from network communication while preserving the pod for forensic analysis. Option A (modifying labels) may not be sufficient to stop traffic. Option B (deleting the pod) removes evidence. Option D (scaling down) is not immediate and may delete the pod.

• A.Modify the container image to disable networking
• ✓ B.Apply a NetworkPolicy that denies all ingress and egress traffic to the pod
• ✓ C.Cordon the node where the pod is running
• ✓ D.Add a label 'isolated=true' to the pod and apply a NetworkPolicy that selects that label and denies all traffic
• E.Delete the pod immediately to stop the threat

Why B: Option B is correct because applying a NetworkPolicy that denies all ingress and egress traffic to the pod effectively isolates it at the network layer, preventing any lateral movement or data exfiltration. This is a standard incident response technique that uses Kubernetes-native network policy rules to create a network-level quarantine without modifying the pod or its image.

• A.kubectl run networkpolicy --image=nginx --restart=Never
• B.kubectl delete pod malicious-pod
• ✓ C.kubectl apply -f networkpolicy.yaml
• D.kubectl create networkpolicy isolate --pod-selector=app=malicious --policy-types=Ingress,Egress

Why C: Pod isolation is achieved by applying a NetworkPolicy that denies ingress/egress traffic. 'kubectl apply -f networkpolicy.yaml' applies the policy. The policy must be written to deny all traffic.

• A.Immediately delete the pod to stop the attack
• ✓ B.Scale the deployment replicas to zero to stop the pod
• C.Run kubectl exec to investigate the container's state
• ✓ D.Isolate the pod using a NetworkPolicy that denies all egress
• ✓ E.Capture a snapshot of the container's filesystem using kubectl cp

Why B: Isolating the pod via NetworkPolicy, capturing a forensic snapshot (e.g., using kubectl cp), and scaling replicas to zero are all valid steps. Deleting the pod immediately may destroy evidence. Running commands inside the pod could alter state.

• A.ResourceQuota
• B.PodSecurityPolicy
• ✓ C.NetworkPolicy with spec.podSelector: {} and spec.policyTypes: [Ingress, Egress]
• D.LimitRange

Why C: A NetworkPolicy with `spec.podSelector: {}` selects all pods in the namespace, and `spec.policyTypes: [Ingress, Egress]` with no rules under `ingress` or `egress` defaults to denying all traffic. This effectively isolates the compromised pod by blocking all incoming and outgoing network traffic at the CNI level.