KCSA Practice Test 17 — 15 Questions

Question 1

Which TWO of the following actions are considered best practices for securing Kubernetes Secrets? (Choose TWO)

Accepted Answer

Enable encryption at rest for Secret resources in etcd.. Option B is correct because enabling encryption at rest for Secret resources protects the data stored in etcd, so even if an attacker gains access to the etcd data files or backups, the Secret contents are encrypted rather than exposed as plaintext. Option D is correct because Kubernetes Secrets are only as secure as the RBAC policy around them; strictly limiting who and which service accounts can read Secrets reduces the risk of credential theft and follows least-privilege best practice. Option A is not a best practice because ConfigMaps are not designed for sensitive data and store values in plaintext, making database passwords easily readable. Option C is incorrect because base64 is merely an encoding, not encryption, and provides no confidentiality. Option E is not recommended because mounting Secrets as writable volumes can allow applications or attackers to modify credentials and increases the attack surface; Secrets should generally be mounted read-only unless there is a specific need.

Answer

Store database passwords in plaintext ConfigMaps for easier application ingestion.

Answer

Rely on base64 encoding as the primary encryption mechanism for sensitive data.

Answer

Mount Secrets as writable volumes so applications can update their own credentials.

Question 2

Which TWO of the following methods can be used to authenticate users or systems against the Kubernetes API server? (Choose TWO)

Accepted Answer

X.509 client certificates validated by the API server CA.. Option A is correct because the Kubernetes API server natively supports X.509 client certificate authentication: when a client presents a certificate signed by the cluster CA (configured via --client-ca-file), the API server validates it and maps the certificate's CN to a user and O to groups. Option D is correct because the API server can be configured with OIDC flags (--oidc-issuer-url, --oidc-client-id, --oidc-username-claim) to accept ID tokens issued by an external identity provider, authenticating users via the id_token JWT. Option B is wrong because basic auth with static password files is deprecated, disabled by default, and insecure, not a recommended authentication method. Option C is wrong because kube-proxy handles service traffic routing, not authentication, and packet sniffing is not an authentication mechanism. Option E is wrong because SSH access to etcd nodes is infrastructure access, not an authentication method against the Kubernetes API server.

Answer

Unencrypted HTTP basic auth files with default passwords.

Answer

Anonymous packet sniffing via kube-proxy.

Answer

Direct root SSH access to etcd nodes.

Question 3

Which TWO security features are provided by modern container runtimes like containerd or CRI-O? (Choose two)

Accepted Answer

Integration with Linux security modules (Seccomp, AppArmor, SELinux). Option A is correct because modern container runtimes such as containerd and CRI-O integrate with Linux security modules — Seccomp profiles to filter syscalls, AppArmor profiles, and SELinux labels — to constrain what container processes can do at the kernel level. Option C is correct because these runtimes rely on Linux namespaces (PID, network, mount, user, IPC, UTS) to provide process, network, filesystem, and user isolation between containers and the host. Option B is incorrect because Kubernetes RBAC roles and cluster permissions are managed by the Kubernetes API server and its authorization stack, not by the container runtime. Option D is incorrect because service mesh sidecar injection is handled by the service mesh control plane (for example, Istio's sidecar injector admission webhook), not by containerd or CRI-O. Option E is incorrect because Ingress TLS certificate generation is performed by cert-manager or similar controllers, not by the container runtime.

Answer

Management of Kubernetes RBAC roles and cluster permissions

Answer

Automatic deployment of service mesh sidecar proxies

Answer

Automatic generation of Kubernetes Ingress TLS certificates

Question 4

Which TWO of the following API server configuration flags help enforce cryptographic and transport security? (Choose TWO)

Accepted Answer

--tls-cipher-suites to specify permitted strong cryptographic cipher suites.. Option A, --tls-cipher-suites, is correct because it lets you restrict the API server to a defined list of strong, permitted TLS cipher suites, preventing negotiation of weak or deprecated ciphers and thereby hardening cryptographic security. Option B, --tls-min-version, is correct because it sets the minimum acceptable TLS protocol version (for example VersionTLS12), ensuring clients cannot downgrade to older, vulnerable TLS versions. Together these flags directly enforce cryptographic strength and transport-layer security on the kube-apiserver. Option C, --anonymous-auth, is wrong because enabling unauthenticated access weakens security rather than enforcing it. Option D, --insecure-port, is wrong because it permits unencrypted HTTP traffic, the opposite of transport security. Option E, --enable-http2=false, is wrong because disabling HTTP/2 does not enforce cryptographic or transport security and is not a security-hardening flag for this purpose.

Answer

--anonymous-auth to enable unauthenticated cluster access.

Answer

--insecure-port to allow unencrypted HTTP traffic.

Answer

--enable-http2=false to disable secure multiplexing.

Question 5

Which TWO of the following mechanisms are standard methods used by container runtimes (such as containerd or CRI-O) to isolate container workloads from the host kernel and other containers? (Choose TWO)

Accepted Answer

Control Groups (cgroups). Option D (Control Groups, cgroups) is correct because container runtimes such as containerd and CRI-O use cgroups to limit and account for resources like CPU, memory, block I/O, and PIDs, preventing one container from starving or affecting others. Option E (Linux Namespaces) is correct because runtimes use namespaces (PID, mount, network, UTS, IPC, user, cgroup) to give each container its own isolated view of processes, filesystems, networking, and other kernel resources. Together, cgroups and namespaces are the foundational Linux kernel primitives that standard container runtimes rely on for isolation. Option A is wrong because disabling the virtual memory manager cluster-wide is neither possible nor a container isolation mechanism; it would break the host. Option B is wrong because standard runtimes like containerd and CRI-O share the host kernel and do not spin up a hypervisor per container (that describes VM-based sandboxes such as Kata Containers). Option C is wrong because running all container processes in the host root PID namespace would remove PID isolation rather than provide it.

Answer

Disabling the Linux virtual memory manager cluster-wide

Answer

Hypervisor-based hardware virtualization for every container instance

Answer

Executing all container processes inside the host root process namespace

Question 6

Which TWO of the following practices directly address security concerns within the 'Container' layer of the 4Cs of Cloud Native Security?

Accepted Answer

Scanning container images for known Common Vulnerabilities and Exposures (CVEs) prior to deployment.. Option A is correct because scanning container images for known CVEs directly hardens the container layer by detecting vulnerable packages and base-image components before the image is deployed. Option B is correct because specifying a non-root user ID in the Dockerfile (via the USER instruction) enforces least privilege inside the container, reducing the impact of a container breakout or compromised process. Option C is not part of the container layer; encrypting data at rest with cloud storage keys belongs to the cloud/infrastructure or data layer. Option D is also outside the container layer, as IAM policies for VM instances are cloud-provider identity and access controls at the infrastructure layer. Option E addresses pod-to-pod traffic segmentation in Kubernetes, which maps to the cluster layer rather than the container layer itself.

Answer

Encrypting data at rest using cloud storage encryption keys.

Answer

Configuring cloud provider IAM policies for virtual machine instances.

Answer

Setting up Kubernetes NetworkPolicies between namespaces.

Question 7

Which TWO components are involved in configuring and processing admission webhooks in a Kubernetes cluster?

Accepted Answer

kube-apiserver. The kube-apiserver (A) is the component that actually invokes admission webhooks: when a request reaches the admission chain, the API server sends an AdmissionReview request over HTTPS to each matching webhook and processes the returned AdmissionReview response to allow or deny the object. ValidatingWebhookConfiguration (B) is the cluster-scoped API resource that registers validating webhooks with the API server, specifying the webhook's clientConfig (URL or service reference), the rules that select which resources/operations trigger it, and failurePolicy, so it is essential to configuring admission webhooks. kube-proxy (C) only programs Service/Endpoint networking rules (iptables/IPVS) on nodes and plays no role in the admission chain. kubelet (D) runs pods on a node and does not evaluate admission webhooks. The etcd daemon (E) merely stores cluster state, including webhook configuration objects, but does not configure or process admission requests.

Answer

kube-proxy

Answer

kubelet

Answer

etcd daemon

Question 8

Which THREE of the following practices should be implemented to secure etcd in a production Kubernetes deployment? (Choose THREE)

Accepted Answer

Enable client certificate authentication using --client-cert-auth=true.. Option B is correct because enabling client certificate authentication with --client-cert-auth=true forces every etcd client (kube-apiserver, etcdctl, etc.) to present a valid TLS client certificate signed by the trusted CA, preventing unauthenticated access to the etcd API. Option D is correct because encrypting data at rest via an EncryptionConfiguration file (referenced with --encryption-provider-config) protects Secrets and other sensitive objects stored in etcd from being read in plaintext if the disk or backup is compromised. Option E is correct because etcd peer traffic carries cluster state and raft data, so enabling peer-to-peer encryption with mutual TLS using flags such as --peer-cert-file, --peer-key-file, --peer-trusted-ca-file, and --peer-client-cert-auth=true ensures only authenticated cluster members can exchange data. Option A is not acceptable because disabling TLS verification (e.g., --insecure-skip-tls-verify) removes server identity validation and exposes etcd to man-in-the-middle attacks, and option C is not acceptable because exposing etcd on a public IP without authentication allows anyone to read or modify the entire cluster's state.

Answer

Disable TLS verification to simplify certificate rotation.

Answer

Expose etcd on a public internet IP address without authentication for easy monitoring.

Question 9

An organization is performing a STRIDE-based threat model on their Kubernetes deployment. Which TWO of the following threats map directly to the 'Tampering' category in a Kubernetes environment?

Accepted Answer

An attacker altering container image layers stored in an insecure registry. Option A is correct because Tampering in STRIDE covers unauthorized modification of data, and altering container image layers in an insecure registry is a direct integrity attack on stored artifacts that Kubernetes nodes later pull and run. Option B is correct because modifying Kubernetes API objects—whether at rest in etcd or in transit to the API server using compromised credentials—is unauthorized alteration of cluster configuration and state, which is the canonical Tampering threat in Kubernetes. Option C is not Tampering but Denial of Service, since flooding the API server to exhaust control plane memory targets availability rather than integrity. Option D is Information Disclosure (sniffing unencrypted pod-to-pod traffic), not Tampering, because it involves reading data rather than modifying it. Option E is Repudiation, as it concerns an administrator denying an action due to missing logs, which maps to the non-repudiation property rather than integrity.

Answer

An attacker flooding the API server with requests to exhaust control plane memory

Answer

An attacker sniffing unencrypted pod-to-pod network traffic across the CNI bridge

Answer

An administrator denying that they executed a cluster deletion command due to missing logs

Question 10

Which THREE of the following represent security risks or anti-patterns in cloud native application design? (Choose THREE)

Accepted Answer

Exposing the Kubernetes dashboard or debug endpoints publicly without authentication. Option A is correct because exposing the Kubernetes dashboard or debug endpoints (e.g., /debug/pprof, actuator endpoints) to the public internet without authentication gives attackers an unauthenticated administrative or diagnostic interface, enabling cluster takeover or information disclosure. Option D is correct because running container processes as UID 0 (root) violates least privilege; if an attacker escapes or exploits the container, root inside the container eases privilege escalation, host filesystem access via mounted volumes, and bypassing of Pod Security Standards such as restricted policies requiring runAsNonRoot. Option E is correct because Kubernetes ConfigMaps store data as plaintext in etcd and are not designed for secrets; API keys and database passwords placed there are readable by anyone with get/list on ConfigMaps and are exposed in backups and manifests, so Secrets (ideally with encryption at rest and external KMS/vault integration) should be used instead. Option B does not belong because automated vulnerability scanning in CI/CD pipelines is a security best practice that detects known CVEs early, not a risk or anti-pattern. Option C does not belong because immutable infrastructure for cluster worker nodes is a recommended pattern that reduces configuration drift and limits persistent attacker footholds, not a security risk.

Answer

Implementing automated vulnerability scanning in CI/CD pipelines

Answer

Using immutable infrastructure principles for cluster worker nodes

Question 11

Which THREE of the following steps are part of proper Kubernetes control plane certificate management? (Choose THREE)

Accepted Answer

Using a trusted Certificate Authority (CA) rather than self-signed certificates where possible.. Option A is correct because using a trusted Certificate Authority (CA) instead of self-signed certificates provides a verifiable chain of trust for control plane components such as kube-apiserver, kube-controller-manager, and kube-scheduler, reducing the risk of man-in-the-middle attacks. Option B is correct because Kubernetes control plane certificates have finite validity periods (commonly one year for kubeadm-managed clusters), and regular rotation before expiration—via commands like kubeadm certs renew or automated rotation—prevents cluster outages and API server unavailability. Option D is correct because private keys for control plane components must be protected with strict file permissions such as 600 (read/write only by owner) to prevent unauthorized access, which is a standard hardening practice for files like /etc/kubernetes/pki/apiserver.key. Option C is not correct because disabling TLS verification for internal cluster components removes authentication and encryption guarantees, exposing the control plane to interception and spoofing rather than being a proper certificate management step. Option E is not correct because storing private keys in unencrypted public ConfigMaps exposes them to any user or process with read access to the API, violating key confidentiality and Kubernetes security best practices.

Answer

Disabling TLS verification for all internal cluster components.

Answer

Storing all private keys in unencrypted public ConfigMaps.

Question 12

Which THREE of the following auditing or logging mechanisms should be configured on a secure Kubernetes control plane? (Choose THREE)

Accepted Answer

Kubernetes API server audit logging configured with an audit policy file.. Option A is correct because the Kubernetes API server audit logging, driven by an audit policy file (--audit-policy-file), records who did what, when, and where against the API server, which is essential for detecting unauthorized or anomalous control-plane actions. Option C is correct because kubelet system and container execution logs on worker nodes capture pod lifecycle events, container runtime activity, and node-level failures, providing the workload-side visibility needed to correlate with control-plane audit events. Option E is correct because etcd audit and operational logging records database transactions and peer health, which is critical since etcd stores all cluster state and secrets, and its integrity and quorum health directly determine control-plane security and availability. Option B is not appropriate because routing all cluster traffic through an unencrypted proxy log exposes sensitive data and violates the requirement for encrypted, integrity-protected control-plane communications. Option D is not appropriate because disabling all log outputs destroys the audit trail and violates compliance and forensic requirements; disk exhaustion should instead be managed with log rotation, retention policies, and monitoring.

Answer

Routing all cluster traffic through an unencrypted proxy log.

Answer

Disabling all log outputs to prevent disk space exhaustion.

Question 13

A cluster administrator is conducting a threat analysis regarding supply chain vulnerabilities in container registries and deployment pipelines. Which TWO of the following practices directly mitigate supply chain threats in Kubernetes? (Choose TWO)

Accepted Answer

Enforcing cryptographic image signing and verification using tools like Sigstore Cosign. Option B is correct because enforcing cryptographic image signing and verification with tools like Sigstore Cosign ensures that only images signed by trusted publishers can be admitted and run in the cluster, directly preventing tampered or malicious images from entering the supply chain. Option D is correct because integrating automated vulnerability scanning into the CI/CD pipeline before images are pushed to the registry catches known CVEs and misconfigurations at build time, stopping vulnerable artifacts from ever reaching production. Option A is incorrect because CPU limits on worker nodes have no bearing on supply chain integrity; they only affect resource scheduling and performance. Option C is incorrect because static IP addresses for worker nodes address network stability and routing, not the authenticity or integrity of container images. Option E is incorrect because disabling the default service account token automount reduces the blast radius of a compromised pod's API credentials, but it does not mitigate supply chain threats such as image tampering or vulnerable dependencies.

Answer

Increasing the CPU limits on all worker nodes to handle larger container images

Answer

Configuring static IP addresses for all worker nodes in the private subnet

Answer

Disabling the default token automount on all namespaces globally

Question 14

You are troubleshooting a secure etcd cluster where a new control plane node cannot join the cluster. The logs indicate a TLS handshake failure between etcd peers. Which etcd configuration flag specifies the trusted CA certificate used to verify peer certificates?

Accepted Answer

--peer-trusted-ca-file. etcd uses separate TLS configurations for client-facing and peer-to-peer traffic. The --peer-trusted-ca-file flag specifies the CA bundle that etcd uses to verify the certificates presented by its peer etcd members during mutual TLS handshakes. Since the failure is a peer TLS handshake, the peer-specific CA flag is the correct one to check and configure.

Answer

--trusted-ca-file

Answer

--peer-client-cert-auth

Answer

--etcd-ca-file

Question 15

An administrator suspects that someone is attempting brute-force attacks against the Kubernetes API server. Where should the administrator look to inspect authentication failures generated by the API server?

Accepted Answer

API server audit logs configured via --audit-log-path.. The kube-apiserver audit log, enabled with flags like --audit-log-path, --audit-policy-file, and --audit-log-maxage, records every request including authentication failures, the requesting user, source IP, and response status. Brute-force attempts appear as repeated 401 Unauthorized responses from the same source, making the audit log the authoritative source for this investigation.

Answer

The etcd WAL (Write-Ahead Log) files.

Answer

The kubelet container logs on worker nodes.

Answer

The kube-proxy packet capture logs.