easyMultiple ChoiceObjective-mapped
CAS-004 Uses Kubernetes to orchestrate containers Practice Question
An organization uses Kubernetes to orchestrate containers. Which practice enhances the security of pod-to-pod communication?
⚠ Common exam trap
A common misconception is that ClusterIP services inherently secure pod-to-pod communication, but ClusterIP only provides service discovery and load balancing, not traffic filtering or segmentation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement network policies that restrict ingress and egress traffic based on labels.
Network policies in Kubernetes act as a firewall for pods, allowing you to define ingress and egress rules based on labels, namespaces, or IP blocks. By default, all pod-to-pod traffic is allowed; implementing network policies restricts this traffic to only what is explicitly permitted, thereby enhancing security by enforcing the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement network policies that restrict ingress and egress traffic based on labels.
Why this is correct
Network policies enforce least-privilege communication.
- ✗
Expose all pods via NodePort services.
Why it's wrong here
NodePort exposes pods externally, increasing attack surface.
- ✗
Use ClusterIP services for all internal traffic.
Why it's wrong here
ClusterIP does not provide traffic filtering.
- ✗
Rely on the default Kubernetes network configuration.
Why it's wrong here
Default is permissive, allowing all pod-to-pod traffic.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.