Kubernetes Cluster Component Security

You are hardening a production Kubernetes control plane. You need to ensure that etcd client-to-server and peer communications are strictly encrypted in transit and require mutual TLS (mTLS). Which etcd configuration flag combination enforces this requirement?

A security scan reveals that the kubelet read-only port (typically port 1055) is active and exposes unauthenticated pod and cluster metadata. How should this vulnerability be remediated?

When configuring the Kubernetes API server authorization modes, which mode evaluates requests against Kubernetes RBAC policies?

You are auditing the Kubernetes control plane and notice that the API server is configured with an insecure port (--insecure-port=8080). What is the primary security implication of leaving this port enabled?

A security auditor discovers that anonymous authentication is accidentally enabled on the Kubernetes API server, allowing unauthenticated read access to cluster health endpoints. Which API server flag must be modified to disable anonymous requests?

An administrator needs to restrict kubelets so they can only modify resources associated with their own node (such as their own Node object and Pods bound to them). Which authorization mode must be enabled alongside RBAC?

An engineer needs to verify that the kubelet on worker nodes is not allowing unauthenticated requests. Which configuration parameter in the kubelet configuration file disables anonymous access?

An administrator needs to secure access to the Kubernetes API server from an external CI/CD pipeline. Which mechanism should be used to authenticate the pipeline using an existing external identity provider without embedding long-lived static tokens?

Which component in the Kubernetes control plane is directly responsible for interacting with etcd to persist and retrieve cluster state?

An administrator wants to prevent the kubelet from automatically approving certificate signing requests (CSRs) generated by nodes joining the cluster. Which mechanism manages kubelet TLS bootstrapping approval behavior?

You are hardening etcd and want to ensure that sensitive data stored in Kubernetes secrets is encrypted at rest within etcd. Which API server configuration file parameter specifies how secrets should be encrypted?

An incident response team suspects that an attacker has gained unauthorized access to the cluster via an unencrypted etcd backup file containing sensitive cluster state. Which etcd utility should be used to securely snapshot and backup etcd data?

Where are static pods for a control plane node typically defined so that the kubelet can automatically create and manage them?

A cluster administrator wants to implement admission control auditing to record all mutating and validating requests made to the API server. Which component configuration handles this requirement?

You are reviewing security logs on a control plane node and discover that an unauthenticated user accessed the kubelet's HTTPS port (10250) to execute commands inside containers. How should you restrict kubelet authentication and authorization to prevent this?

Which file on a Kubernetes control plane node contains the startup arguments and flags for the statically hosted API server?

You need to audit the cryptographic algorithms and TLS versions permitted by the Kubernetes API server for incoming client connections. Which API server flag enforces a minimum TLS version of 1.3?

Which Kubernetes control plane component is responsible for noticing and responding when nodes go down or fail health checks?

An administrator suspects that someone is attempting brute-force attacks against the Kubernetes API server. Where should the administrator look to inspect authentication failures generated by the API server?

An administrator wants to limit the blast radius if an attacker compromises a worker node. Which setting ensures that the kubelet does not automatically create or modify ServiceAccount tokens for pods unless explicitly requested?

An administrator wants to ensure that a malicious container executing on a worker node cannot query the kubelet API to extract sensitive pod information. Which kubelet configuration setting controls whether requests to the kubelet require authorization?

When configuring Role-Based Access Control (RBAC), which Kubernetes object grants permissions across the entire cluster rather than within a single namespace?

You are securing a highly regulated Kubernetes cluster and need to ensure that etcd data is encrypted at rest using a custom encryption key. After creating the EncryptionConfiguration file, which API server flag must be updated to point to this file?

You are hardening etcd on a dedicated control plane host. You want to ensure that etcd database files on disk are protected against unauthorized physical or filesystem access. Which control mechanism is best suited for this?

Which service account permission model is used by default when a pod is created without specifying a service account name?

Which Kubernetes component manages the assignment of pending pods to healthy worker nodes based on resource availability and constraints?

An auditor notices that the kubelet on worker nodes is configured with --protect-kernel-defaults=true. What is the security purpose of this flag?

You are auditing a multi-tenant Kubernetes cluster and notice that users can read ServiceAccount tokens belonging to other namespaces through improper RBAC configuration. Which ClusterRole permission should be strictly avoided or audited to prevent token theft via secret inspection?

Which component is responsible for executing probes (liveness, readiness, startup) against containers running on a worker node?

You are troubleshooting a control plane failure where the Kubernetes API server cannot communicate with etcd because of expired client certificates. Which command-line flag on the kube-apiserver specifies the client TLS certificate used for authentication against etcd?

An administrator wants to secure the communication channel between the Kubernetes API server and extension API servers (such as metrics-server). Which API server flag specifies the Certificate Authority used to verify extension API server certificates?

An administrator wants to ensure that the Kubernetes API server rejects any incoming requests that do not match known API resource paths or have invalid syntax. Which admission controller helps validate request structures and schema compliance?

You are performing a security review of etcd cluster membership. You need to list all active members of the etcd cluster and check their health status using the command line. Which etcdctl command is correct?

You are tasked with securing a Kubernetes cluster where control plane nodes are hosted in a private network segment. To prevent unauthorized access to the API server from compromised internal workloads, which mechanism restricts which service accounts can access the API server?

Which protocol and default secure port does the kubelet use to listen for incoming authenticated requests from the API server and metrics collectors?

Which Kubernetes control plane component runs controllers that handle routine tasks such as replicating pods and managing service accounts?

An administrator wants to audit who created or modified specific resources in the cluster. Where are API server audit records sent if configured with the log backend?

You are troubleshooting a secure etcd cluster where a new control plane node cannot join the cluster. The logs indicate a TLS handshake failure between etcd peers. Which etcd configuration flag specifies the trusted CA certificate used to verify peer certificates?

An administrator needs to ensure that the Kubernetes API server does not allow insecure cipher suites during TLS handshakes. Which API server flag allows specifying the exact cipher suites permitted?

Which component provides network routing and iptables/IPVS rule management across worker nodes for Kubernetes Services?

An administrator wants to verify that etcd database defragmentation is performed periodically to reclaim storage space after large amounts of data churn. Which etcdctl command defragments an etcd member?

You are performing a security assessment on an existing Kubernetes cluster. You discover that the kubelet API permits users with valid service account tokens to read sensitive container environment variables and logs. How should you configure the kubelet authorization mode to prevent unauthorized token holders from reading arbitrary pod data?

You are securing a Kubernetes cluster control plane and need to ensure that the API server limits request payload sizes to prevent Denial of Service (DoS) attacks via memory exhaustion. Which mechanism or flag controls request body size limits in the Kubernetes API server?

Which TWO of the following are core security hardening best practices for the Kubernetes API server? (Choose TWO)

Which THREE of the following practices should be implemented to secure etcd in a production Kubernetes deployment? (Choose THREE)

Which TWO of the following kubelet security configurations are critical for preventing container escape and unauthorized node API access? (Choose TWO)

Which THREE of the following are key components of the Kubernetes control plane? (Choose THREE)

Which TWO of the following methods can be used to authenticate users or systems against the Kubernetes API server? (Choose TWO)

Which THREE of the following auditing or logging mechanisms should be configured on a secure Kubernetes control plane? (Choose THREE)

Which THREE of the following tasks are performed by the Kubernetes control plane's kube-controller-manager? (Choose THREE)

Which TWO of the following actions are risks associated with leaving the Kubernetes API server's insecure port enabled? (Choose TWO)

Which TWO of the following files or directories on a control plane node contain critical static pod manifests for core components? (Choose TWO)

Which TWO of the following are valid ways to harden etcd against unauthorized access and data corruption? (Choose TWO)

Which THREE of the following criteria should be evaluated when reviewing Kubernetes RBAC policies to ensure least privilege? (Choose THREE)

Which TWO of the following mechanisms help secure the kubelet API from unauthorized access and container inspection? (Choose TWO)

Which THREE of the following steps are part of proper Kubernetes control plane certificate management? (Choose THREE)

Which TWO of the following API server configuration flags help enforce cryptographic and transport security? (Choose TWO)

Which TWO of the following tasks are handled by the kube-scheduler? (Choose TWO)

Which THREE of the following actions can compromise the security of the Kubernetes control plane if left unmitigated? (Choose THREE)

Which TWO of the following metrics or health endpoints should be protected against unauthenticated access on control plane nodes? (Choose TWO)

Which THREE of the following mechanisms are used by the Kubernetes API server to authorize requests after authentication succeeds? (Choose THREE)

Which THREE of the following practices should be followed when configuring Kubernetes audit logging? (Choose THREE)

Which TWO of the following scenarios represent severe security misconfigurations in a Kubernetes cluster control plane? (Choose TWO)