KCSA Practice Test 19 — 15 Questions

Question 1

Which TWO actions can be performed using Kubernetes RBAC rules?

Accepted Answer

Granting permission to create deployments cluster-wide. RBAC (Role-Based Access Control) in Kubernetes governs who can perform which verbs on which resources via Roles/ClusterRoles bound with RoleBindings/ClusterBindings, so option A is correct: a ClusterRole granting the 'create' verb on 'deployments' (apps API group) bound cluster-wide allows creating deployments in any namespace. Option E is also correct: a Role granting the 'get'/'list'/'watch' verbs on 'configmaps' in a specific namespace, bound via a RoleBinding, permits reading ConfigMaps only in that namespace. Option B is wrong because encryption of Secret data at rest in etcd is handled by the API server's EncryptionConfiguration (EncryptionConfiguration with an aescbc/aesgcm/kms provider), not RBAC. Option C is wrong because PersistentVolume capacity is provisioned by StorageClasses, CSI drivers, or static PV definitions, not by RBAC rules. Option D is wrong because Pod Security Standards are enforced via the Pod Security Admission controller using namespace labels (pod-security.kubernetes.io/enforce), not RBAC.

Answer

Encrypting secret values stored in etcd

Answer

Allocating storage capacity for PersistentVolumes

Answer

Enforcing Pod Security Standards on namespaces

Question 2

A security architect is designing a multi-tenant Kubernetes platform. They need to ensure that a compromise in one tenant's namespace cannot allow packet sniffing or unauthorized traffic interception from another tenant's pods. Which Kubernetes feature should they implement to satisfy cloud native network isolation principles?

Accepted Answer

Kubernetes NetworkPolicies. Kubernetes NetworkPolicies are the native mechanism for controlling pod-to-pod traffic at L3/L4, allowing the architect to define ingress and egress rules that restrict which pods can communicate. By default, Kubernetes allows all pod-to-pod traffic within a cluster, so a compromised pod in one tenant namespace could sniff or reach pods in another. NetworkPolicies enforce isolation by selecting pods via labels and permitting only explicitly allowed flows, satisfying the cloud-native network isolation principle for multi-tenancy.

Answer

Kubernetes RBAC RoleBindings

Answer

ResourceQuotas

Answer

PodSecurityStandards

Question 3

You are configuring an Ingress resource using the NGINX Ingress Controller to expose a sensitive internal application. To prevent unauthorized clients from connecting, you want to enable mutual TLS authentication at the ingress layer. Which annotation is required in the Ingress resource definition to specify the Kubernetes Secret containing the trusted Client CA certificate?

Accepted Answer

nginx.ingress.kubernetes.io/auth-tls-secret. The annotation nginx.ingress.kubernetes.io/auth-tls-secret is the NGINX Ingress Controller directive that specifies the Kubernetes Secret containing the CA certificate used to verify client certificates for mutual TLS. When set, the controller enforces client certificate authentication at the ingress layer, rejecting connections that do not present a certificate signed by the trusted CA. This is the correct annotation for enabling mTLS with a trusted Client CA.

Answer

ingress.kubernetes.io/backend-protocol

Answer

kubernetes.io/ingress.class

Answer

nginx.ingress.kubernetes.io/ssl-redirect

Question 4

When evaluating a Kubernetes cluster against security and compliance baselines, which TWO tools are commonly used for automated auditing and benchmarking? (Choose TWO)

Accepted Answer

kube-bench. kube-bench (B) is correct because it is an open-source tool from Aqua Security that automates the checks of the CIS Kubernetes Benchmark, inspecting the cluster's control plane components, kubelet, and configuration files to report pass/fail results against the benchmark. Kubescape (D) is correct because it is an ARMO tool that performs automated security and compliance scanning of Kubernetes clusters, mapping results to frameworks such as the NSA/CISA Kubernetes Hardening Guidance, MITRE ATT&CK, and CIS benchmarks. Kustomize (A) is a configuration management tool for customizing Kubernetes YAML manifests via overlays, not an auditing or benchmarking tool. Helm (C) is a package manager for deploying and managing Kubernetes applications using charts, not a compliance scanner. Kubectl (E) is the Kubernetes command-line client for interacting with the API server, not an automated auditing or benchmarking tool.

Answer

Kustomize

Answer

Helm

Answer

Kubectl

Question 5

In a zero-trust Kubernetes architecture, an attacker attempts to exploit the Kubernetes API server via a Server-Side Request Forgery (SSRF) flaw in a poorly written custom controller. Which defense-in-depth mechanism specifically protects against unauthorized API requests originating from inside the cluster network?

Accepted Answer

Mandatory client certificate authentication and rigorous RBAC authorization on API endpoints. Client certificate authentication combined with strict RBAC ensures that every request to the API server is cryptographically tied to an authenticated identity and authorized against explicit policy, so an SSRF from a compromised controller cannot impersonate another principal or escalate privileges. Even if the attacker crafts requests from inside the cluster network, the API server rejects them without valid credentials and matching RBAC bindings. This is the core zero-trust 'never trust, always verify' control at the API boundary.

Answer

Configuring Horizontal Pod Autoscalers to limit request rates

Answer

Enabling Pod Security Standards in baseline mode across all namespaces

Answer

Disabling the Kubelet read-only port on all worker nodes

Question 6

You need to ensure that an ingress controller processing TLS termination uses strong cryptographic ciphers and disables outdated protocols such as TLSv1.0 and TLSv1.1. Where are these TLS configuration settings typically managed in an NGINX Ingress deployment?

Accepted Answer

Ingress controller ConfigMap parameters such as ssl-ciphers and ssl-protocols. In an NGINX Ingress deployment, TLS settings for the ingress controller are configured globally via ConfigMap parameters such as ssl-ciphers and ssl-protocols. These parameters allow administrators to specify the cipher suite and the minimum TLS version (e.g., TLSv1.2) that the controller will accept, ensuring strong cryptography and disabling outdated protocols like TLSv1.0 and TLSv1.1. This ConfigMap is typically named nginx-configuration and resides in the ingress-nginx namespace, and changes are applied by reloading the controller.

Answer

The core DNS configuration map

Answer

The kube-apiserver static pod manifest file

Answer

Persistent Volume Claim storage classes

Question 7

An enterprise Kubernetes cluster uses a service mesh with strict authorization policies configured. A developer complains that their frontend service cannot communicate with the backend database service. Upon inspecting the mesh configuration, you notice a PeerAuthentication resource set to STRICT mode. What does this setting enforce?

Accepted Answer

All incoming traffic to the targeted workloads must use mutual TLS encryption. A PeerAuthentication resource in STRICT mode enforces mutual TLS (mTLS) for all incoming traffic to the targeted workloads, meaning both client and server must present valid certificates. This ensures encryption and identity verification between services in the mesh, and plaintext traffic is rejected. It is a core Istio security primitive for zero-trust service-to-service communication.

Answer

Pod security standards must be enforced at the baseline level

Answer

Network policies must block all traffic from outside the namespace

Answer

All external ingress traffic must pass through a Web Application Firewall

Question 8

Which THREE fields are required when defining a standard Kubernetes NetworkPolicy resource? (Choose THREE)

Accepted Answer

metadata. Option A (metadata) is correct because every Kubernetes object manifest, including a NetworkPolicy, must include a metadata block that supplies at least the resource name (and optionally namespace, labels, and annotations) so the object can be identified and referenced. Option C (kind set to NetworkPolicy) is correct because the kind field declares the resource type being created, and for a network policy it must be exactly NetworkPolicy so the API server routes the object to the networking.k8s.io API group. Option E (apiVersion) is correct because the manifest must specify the API group/version, e.g. networking.k8s.io/v1, so the API server knows which schema and endpoint to use when validating and persisting the object. The unmarked options do not belong: securityContext (B) is a pod/container-level field for privileges and capabilities, not a NetworkPolicy field, and imagePullSecrets (D) is a Pod spec field for authenticating to private registries, unrelated to network policy definition.

Answer

securityContext

Answer

imagePullSecrets

Question 9

An administrator needs to analyze the STRIDE threat model category that encompasses an attacker gaining unauthorized elevation of privilege inside a Kubernetes cluster by exploiting a misconfigured RBAC ClusterRoleBinding. Which threat category does this represent?

Accepted Answer

Elevation of Privilege. Elevation of Privilege in STRIDE covers any attack where an adversary gains capabilities or access rights beyond what they were legitimately granted. Exploiting a misconfigured RBAC ClusterRoleBinding — for example, binding a powerful role like cluster-admin to a service account or user that should not have it — lets an attacker escalate from limited permissions to cluster-wide control. This is the defining characteristic of the Elevation of Privilege category, not data modification or confidentiality loss.

Answer

Tampering

Answer

Repudiation

Answer

Information Disclosure

Question 10

Which TWO actions should be taken when an image vulnerability scanner reports a critical CVE in a running production container? (Choose two)

Accepted Answer

Rebuild the container image with updated base image or patched software packages. Option B is correct because the only durable way to remove a critical CVE from a container image is to rebuild it from a patched base image or updated software packages, since running containers are immutable and cannot be patched in place. Option C is correct because after rebuilding, the updated image must be redeployed to replace the vulnerable running containers across the cluster workloads, ensuring the fix is actually in production. Option A is wrong because scaling replicas to maximum capacity multiplies the number of vulnerable instances and does nothing to remediate the CVE. Option D is wrong because setting service account tokens to anonymous mode would break authentication and massively weaken cluster security rather than fix the image flaw. Option E is wrong because deleting NetworkPolicies removes segmentation controls and exposes workloads, which is a security regression, not a remediation step.

Answer

Scale the vulnerable deployment replicas to maximum capacity

Answer

Change all Kubernetes service account tokens to anonymous mode

Answer

Delete all Kubernetes NetworkPolicies to allow emergency patching traffic

Question 11

You are hardening etcd on a dedicated control plane host. You want to ensure that etcd database files on disk are protected against unauthorized physical or filesystem access. Which control mechanism is best suited for this?

Accepted Answer

Filesystem or block-level disk encryption (e.g., LUKS) on the host storage volume.. Filesystem or block-level disk encryption (e.g., LUKS on Linux) is the correct control because it protects etcd data files at rest against physical theft or unauthorized filesystem access. If an attacker steals the disk or gains raw block-device access, LUKS-encrypted volumes are unreadable without the decryption key. This directly addresses the threat model of physical or offline filesystem compromise, which is what the question asks about.

Answer

Kubernetes NetworkPolicies applied to the etcd Pod.

Answer

API server RBAC ClusterRoleBinding.

Answer

Kubelet read-only port disabling.

Question 12

What role does image scanning play in a shift-left security strategy for platform security?

Accepted Answer

Detecting vulnerabilities and misconfigurations in container images during development and CI/CD. Image scanning in a shift-left strategy involves analyzing container images during development and CI/CD to detect vulnerabilities and misconfigurations before deployment. This early detection reduces risk and remediation costs by catching issues before they reach production.

Answer

Automatically encrypting secrets stored in etcd

Answer

Generating TLS certificates for ingress controllers

Answer

Enforcing role-based access control policies

Question 13

Which TWO of the following practices are core principles of cloud native security? (Choose TWO)

Accepted Answer

Defense-in-depth across multiple architectural layers. Option A (Defense-in-depth across multiple architectural layers) is correct because cloud native security assumes no single control is sufficient; it layers protections across identity, network, compute, orchestration, and data so that a failure in one layer (e.g., a misconfigured ingress) is contained by controls in another (e.g., network policies, workload identity, runtime detection). Option E (Principle of least privilege for access and execution permissions) is correct because cloud native environments rely on fine-grained, identity-based authorization such as Kubernetes RBAC, IAM roles, and service accounts, granting only the permissions needed for a task and limiting blast radius if credentials are compromised. The unmarked options do not belong: B is wrong because cloud native security does not rely on a static perimeter firewall, since workloads are dynamic, distributed, and often exposed via APIs and service meshes; C is wrong because immutable, ephemeral infrastructure that is continuously replaced is a core cloud native practice, not static long-lived infrastructure; and D is wrong because sharing administrative credentials violates least privilege, accountability, and non-repudiation, and is replaced by federated identity and short-lived tokens.

Answer

Complete reliance on a static network perimeter firewall

Answer

Static, long-lived infrastructure that is never replaced

Answer

Sharing administrative credentials among all team members

Question 14

When modeling threats related to Kubernetes secrets management, which TWO actions help protect secrets from unauthorized access?

Accepted Answer

Integrating external secret management systems (e.g., HashiCorp Vault, AWS Secrets Manager). Option B is correct because integrating external secret management systems such as HashiCorp Vault or AWS Secrets Manager removes secrets from Kubernetes' native etcd storage and centralizes access control, auditing, and rotation in a hardened secrets store, reducing the blast radius of unauthorized access to Kubernetes Secrets. Option D is correct because enabling etcd encryption at rest via an EncryptionConfiguration with a dedicated provider (e.g., aescbc or KMS) ensures that Secret data written to etcd is encrypted, so an attacker who gains access to the etcd data files or backups cannot read plaintext secret values. Option A is wrong because granting all namespace users cluster-admin read permissions on Secrets massively expands the attack surface and violates least privilege. Option C is wrong because disabling RBAC authentication on API server endpoints removes authorization controls entirely, allowing any authenticated or anonymous caller to access resources. Option E is wrong because storing credentials in plaintext ConfigMaps in the default namespace exposes them to any user or workload with read access and provides no encryption or access restriction.

Answer

Granting all namespace users cluster-admin read permissions on Secret objects

Answer

Disabling RBAC authentication across all API server endpoints

Answer

Storing database credentials in plain text ConfigMaps in the default namespace

Question 15

An administrator needs to store sensitive database credentials securely so that they can be mounted as environment variables inside a specific pod. Which Kubernetes object is designed for this purpose?

Accepted Answer

Secret. A Secret is the correct Kubernetes object for storing sensitive data like database credentials. Secrets are designed to hold confidential information and can be mounted as environment variables or volumes in pods. They are base64-encoded by default and can be encrypted at rest if configured. ConfigMaps are for non-sensitive data, while ResourceQuota and PersistentVolume serve different purposes.

Answer

ResourceQuota

Answer

PersistentVolume

Answer

ConfigMap