KCSA Practice Test 10 — 10 Questions

Question 1

An auditor reviews container runtime configurations for compliance with NIST SP 800-190 recommendations on privilege escalation. Which Kubernetes feature controls whether a process can gain more privileges than its parent process?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

allowPrivilegeEscalation: false. allowPrivilegeEscalation: false is the Kubernetes SecurityContext field that directly controls whether a process can gain more privileges than its parent process, aligning with NIST SP 800-190 guidance on preventing privilege escalation. When set to false, it sets the kernel's no_new_privs flag on the container process, blocking setuid/setgid binaries and file capabilities from elevating privileges. This is the precise control the auditor is looking for.

Answer

automountServiceAccountToken: false

Answer

runAsUser: 1000

Answer

privileged: false

Question 2

A cluster operator is enforcing the Pod Security Standards "restricted" profile across a namespace. A developer attempts to deploy a container running as root (runAsUser: 0). What will happen during the admission phase?

Accepted Answer

The PodSecurity admission controller will reject the pod creation request.. The restricted Pod Security Standard requires containers to run as non-root, among other hardening measures. When a pod attempts to run as root (runAsUser: 0) in a namespace enforcing the restricted profile, the PodSecurity admission controller will reject the pod creation request during the admission phase. This prevents the pod from being created at all.

Answer

The pod will be created, but the kubelet will override the user ID to 65534 at runtime.

Answer

The pod will start successfully in audit mode, generating a warning event in the API server logs.

Answer

The container will drop all Linux capabilities and proceed with deployment.

Question 3

An application running in a pod needs to securely consume a database password without storing it in plaintext within the container image or deployment manifest. Which native Kubernetes resource is best suited for storing this sensitive key-value data?

Accepted Answer

Secret. A Kubernetes Secret is the native resource designed to hold sensitive key-value data such as passwords, tokens, and TLS keys, keeping them out of container images and manifests. Pods consume Secrets via environment variables or mounted volumes, and the API server stores them base64-encoded (with optional encryption at rest via EncryptionConfiguration). ConfigMaps are for non-sensitive configuration, so a database password belongs in a Secret.

Answer

PersistentVolumeClaim

Answer

ResourceQuota

Answer

ConfigMap

Question 4

You are auditing a cluster and find a pod that mounts the host's root filesystem directly into the container. Which Pod Security Standard rule does this violate?

Accepted Answer

It violates both baseline and restricted standards by using a hostPath volume.. Mounting the host's root filesystem via a hostPath volume violates both the baseline and restricted Pod Security Standards. The baseline standard prohibits hostPath volumes (except for a few specific, safe paths), and the restricted standard prohibits them entirely. Therefore, this pod violates both.

Answer

It is permitted under all standards provided the container runs as a non-root user.

Answer

It is fully compliant with the restricted standard as long as 'readOnly: true' is set.

Answer

It only violates the restricted standard; baseline permits hostPath mounts.

Question 5

Which TWO mechanisms are used by Kubernetes admission controllers to enforce security policies during the API request lifecycle?

Accepted Answer

Validating admission webhooks can reject object definitions that violate security standards.. Validating admission webhooks (A) are invoked during the admission phase of the API request lifecycle and can evaluate an object against security policies, returning a denial that causes the API server to reject the request, which is exactly how policies such as Pod Security Standards or custom constraints are enforced. Mutating admission webhooks (D) run before validating webhooks and can modify the incoming request payload, for example injecting a securityContext, defaulting runAsNonRoot, or applying seccomp/AppArmor profiles so that objects comply with security defaults before persistence. The remaining options are incorrect: kubelet (B) pulls and runs containers on nodes but does not perform image security audits as an admission mechanism, etcd (C) is only a key-value store and does not execute validation scripts or strip RBAC rules, and kube-proxy (E) implements Service load balancing at Layers 3/4 and never inspects Layer 7 API payloads.

Answer

kubelet automatically runs security audits on all container images prior to pull.

Answer

etcd executes consensus validation scripts to strip unauthorized RBAC rules.

Answer

kube-proxy inspects network payloads at Layer 7 to block unauthorized API requests.

Question 6

An organization wants to analyze potential threats to their Kubernetes cluster using the STRIDE model. Which STRIDE category maps to an attacker eavesdropping on unencrypted internal cluster traffic between pods?

Accepted Answer

Information Disclosure. Information Disclosure in the STRIDE model covers threats where data is exposed to unauthorized parties, such as eavesdropping on unencrypted traffic. An attacker sniffing internal cluster traffic between pods to read sensitive data is a classic Information Disclosure threat. The other STRIDE categories address different threat types, such as tampering with data or denying service.

Answer

Repudiation

Answer

Tampering

Answer

Denial of Service

Question 7

An enterprise security policy states that all infrastructure must be defined as code (IaC) and scanned for security misconfigurations before deployment. Which part of the cloud native security lifecycle does this control target?

Accepted Answer

Pre-deployment configuration and policy-as-code validation. The policy requires infrastructure to be defined as code and scanned for misconfigurations before deployment, which directly targets the pre-deployment phase of the cloud native security lifecycle. This is where configuration and policy-as-code validation occur, ensuring that security issues are caught early in the CI/CD pipeline. Tools like Checkov, tfsec, or OPA/Gatekeeper enforce these checks. Thus, option C correctly identifies this control.

Answer

Kernel patch management

Answer

Physical data center security

Answer

Runtime security monitoring

Question 8

You want to enable encryption at rest for Kubernetes Secrets in your cluster using an external KMS (Key Management Service) provider. Which component on the control plane reads the EncryptionConfiguration file and handles this encryption?

Accepted Answer

kube-apiserver. The kube-apiserver is the only component that reads the EncryptionConfiguration file (passed via --encryption-provider-config) and performs envelope encryption of Secret data before writing to etcd. It encrypts on write and decrypts on read, so etcd only ever stores ciphertext for protected resources.

Answer

kube-controller-manager

Answer

kubelet

Answer

etcd daemon directly

Question 9

What is the security risk of configuring `privileged: true` in a container's SecurityContext?

Accepted Answer

It disables container isolation, granting full access to host devices and kernel capabilities. Setting `privileged: true` in a container's SecurityContext gives the container all Linux capabilities available to the host and disables the default isolation mechanisms (namespaces, cgroups restrictions, seccomp/AppArmor defaults). The container can then access host devices like /dev, mount filesystems, load kernel modules, and effectively act as root on the node. This is why privileged containers are considered a critical security risk in Kubernetes.

Answer

It restricts the container from writing to any attached volume.

Answer

It forces the API server to reject all incoming TLS client requests.

Answer

It prevents the application from reading its own environment variables.

Question 10

Which TWO of the following are core security hardening best practices for the Kubernetes API server? (Choose TWO)

Accepted Answer

Ensure the insecure port (--insecure-port) is disabled or set to 0.. Option A is correct because the API server's insecure port (--insecure-port) serves unauthenticated, unencrypted HTTP traffic, so setting it to 0 (or disabling it) is a fundamental CIS Kubernetes Benchmark hardening step that forces all communication through the authenticated, TLS-protected secure port (default 6443). Option E is correct because anonymous authentication allows unauthenticated requests to reach the API server and be evaluated as the system:anonymous user; setting --anonymous-auth=false ensures every request must present valid credentials, preventing unauthenticated access and information disclosure. Option B is wrong because HTTP would remove TLS encryption and client authentication, weakening rather than hardening the API server. Option C is wrong because kubeconfig files contain credentials and certificates, and storing them in public ConfigMaps would expose cluster access to anyone who can read the ConfigMap. Option D is wrong because granting cluster-admin to all authenticated users violates least privilege and would give every account full control of the cluster.

Answer

Configure the API server to use HTTP instead of HTTPS for performance.

Answer

Store all kubeconfig credentials in public ConfigMaps.

Answer

Grant cluster-admin permissions to all authenticated users by default.