KCSA Platform Security Practice Question
You are troubleshooting a service mesh traffic split policy where telemetry shows that unauthorized external clients are bypassing the service mesh ingress gateway and directly accessing backend services via NodePort services. Which Kubernetes feature should you configure to prevent direct NodePort access to these sensitive pods?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NetworkPolicies restricting pod ingress traffic exclusively to the service mesh gateway pod selector
Kubernetes NetworkPolicies can be configured to restrict incoming traffic to backend pods so that they only accept connections originating from the ingress gateway pod selectors, blocking direct NodePort access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enabling anonymous authentication in kube-apiserver
Why it's wrong here
Enabling anonymous authentication weakens cluster security rather than securing network paths.
- ✗
Changing the service type from NodePort to ClusterIP
Why it's wrong here
While changing to ClusterIP removes external cluster access, NodePort is specifically cited in the scenario and NetworkPolicies can protect pods regardless of service type.
- ✗
Increasing the API server request rate limit
Why it's wrong here
Rate limits control API server request frequency, not network packet routing to NodePorts.
- ✓
NetworkPolicies restricting pod ingress traffic exclusively to the service mesh gateway pod selector
Why this is correct
NetworkPolicies ensure that pods only accept traffic from authorized sources such as the ingress gateway.
About these practice questions
One of 320 original KCSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.