KCSA Practice Test — Free Kubernetes and Cloud Native Security Associate (KCSA, CNCF) (KCSA) Questions with Explanations

An application pod needs to mount a Secret as environment variables. Which section of the Pod manifest should be configured to achieve this securely?

A DevOps team is building container images using Dockerfiles. They decide to use official minimal distroless base images instead of standard Ubuntu images containing package managers and shell utilities. Which security benefit does this provide?

Under NIST guidelines for continuous monitoring in cloud-native environments, which Kubernetes mechanism allows operators to enforce cryptographic integrity of container images at runtime?

You are performing a security assessment on an existing Kubernetes cluster. You discover that the kubelet API permits users with valid service account tokens to read sensitive container environment variables and logs. How should you configure the kubelet authorization mode to prevent unauthorized token holders from reading arbitrary pod data?

An administrator wishes to defend against supply chain attacks involving malicious third-party Kubernetes operators installed from public catalogs. What security practice is most effective before installing such operators?

You are troubleshooting a container image vulnerability scan report that flagged a high-severity CVE in a base image layer. The development team wants to ensure that vulnerable container images are automatically prevented from being deployed to any namespace in the cluster. Which Kubernetes mechanism should you implement?

An organization requires compliance auditing of etcd access to ensure unauthorized clients cannot communicate with the data store. According to CIS benchmarks, how should etcd client communication be secured?

An administrator needs to configure an Ingress resource to route traffic securely to a backend service using HTTPS (TLS between the ingress controller and the backend pod). Which NGINX Ingress annotation enables this backend HTTPS communication?

An organization wants to prevent supply chain attacks where compromised base images are pulled from public registries. Which control directly addresses this risk in a cloud native environment?

A security engineer is reviewing the security posture of an enterprise Kubernetes deployment. They note that developers push container images directly to a private registry without vulnerability scanning. Which of the 4Cs is directly impacted by this gap?

When configuring a Pod to run securely, which setting in the container's securityContext should be used to explicitly drop all default Linux capabilities and only retain required ones?

A cluster administrator needs to grant read-only access to pods within the 'development' namespace using Kubernetes RBAC. Which resource kind should be used to define the permissions?

A platform engineer wants to configure a container runtime security tool that monitors system calls and sends alerts about potential threats in a Kubernetes cluster. Which component of the container runtime architecture intercepts these system calls?

An administrator wants to verify that etcd database defragmentation is performed periodically to reclaim storage space after large amounts of data churn. Which etcdctl command defragments an etcd member?

An administrator wants to prevent users from creating pods that mount the host network ('hostNetwork: true'). Which tool or feature is best suited to enforce this restriction natively across the cluster?

A platform engineer needs to secure an Ingress resource using TLS termination, ensuring that sensitive private keys are stored securely within the cluster and referenced safely. Which Kubernetes resource should be created to store the TLS certificate and private key pair?

You are performing a security review of etcd cluster membership. You need to list all active members of the etcd cluster and check their health status using the command line. Which etcdctl command is correct?

You want to ensure that a newly created Role in namespace 'finance' cannot be modified or deleted by regular developers who have edit permissions. Which RBAC feature or design prevents unauthorized privilege escalation through Role manipulation?

An enterprise cluster requires that all incoming NetworkPolicies must default to denying all traffic unless explicitly allowed. A developer creates a namespace but forgets to apply any policies. What is the default behavior of Kubernetes regarding inter-pod traffic within a namespace when no NetworkPolicies are present?

Which attack vector involves tricking a Kubernetes cluster user or service into executing unintended actions via authenticated sessions, frequently mitigated by robust CSRF defenses and proper API design?