KCSA Practice Test 2 — 10 Questions

Question 1

Which THREE of the following practices should be followed when configuring Kubernetes audit logging? (Choose THREE)

Accepted Answer

Monitor audit logs regularly for suspicious authentication failures or privilege escalations.. Audit logging should use a defined policy, specify a secure log output path, and protect log files from unauthorized modification.

Answer

Store audit logs in unencrypted public ConfigMaps.

Answer

Disable audit logging entirely to maximize API server performance.

Question 2

Which TWO of the following are valid Kubernetes RBAC rule subjects that can be bound to roles or cluster roles?

Accepted Answer

User. Kubernetes RBAC supports three primary subjects: User, Group, and ServiceAccount.

Answer

Secret

Answer

Namespace

Answer

PersistentVolume

Question 3

Which TWO actions are core tenets of the "Shift-Left" security philosophy in cloud-native compliance? (Choose TWO)

Accepted Answer

Scanning infrastructure-as-code (IaC) templates for misconfigurations before deployment. Shift-left security focuses on integrating security checks early in the development lifecycle, such as in CI/CD and IaC scanning.

Answer

Disabling all automated security tooling to speed up commits

Answer

Waiting until a production breach occurs to audit logs

Answer

Relying entirely on manual code reviews post-release

Question 4

Which open-source auditing tool provides compliance scores and checks against Kubernetes security frameworks such as NSA-CISA and CIS?

Accepted Answer

Kubescape. Datree or Kubescape are prominent tools for compliance scoring. Kubescape specifically evaluates Kubernetes clusters against multiple security frameworks including CIS and NSA-CISA.

Answer

Kube-dns

Answer

Metric-server

Answer

Cilium

Question 5

According to the CIS Kubernetes Benchmark, anonymous requests to the Kubernetes API server should be disabled. Which kube-apiserver flag enforces this setting?

Accepted Answer

--anonymous-auth=false. The flag --anonymous-auth=false disables anonymous requests to the secure port of the API server, fulfilling CIS benchmark requirements.

Answer

--authorization-mode=Node,RBAC

Answer

--enable-admission-plugins

Answer

--insecure-port=0

Question 6

An auditor is reviewing compliance with CIS Kubernetes Benchmark control 1.2.20, which relates to the kube-apiserver admission control configuration. Which admission plugin is recommended by CIS to prevent default service accounts from automatically mounting API credentials?

Accepted Answer

ServiceAccount. The ServiceAccount admission controller, along with disabling automatic token mounting via serviceAccountName/automountServiceAccountToken, is governed by admission plugins. Specifically, NamespaceLifecycle and PodNodeSecurity are relevant, but for service account automation management, the ServiceAccount admission controller governs default behavior.

Answer

DefaultTolerationSeconds

Answer

AlwaysAdmit

Answer

NodeRestriction

Question 7

A security auditor discovers that anonymous authentication is accidentally enabled on the Kubernetes API server, allowing unauthenticated read access to cluster health endpoints. Which API server flag must be modified to disable anonymous requests?

Accepted Answer

--anonymous-auth=false. Setting --anonymous-auth=false explicitly disables requests that are not rejected by other authenticators from being treated as anonymous.

Answer

--secure-port=0

Answer

--authorization-mode=AlwaysAllow

Answer

--disable-anonymous=true

Question 8

Which component provides network routing and iptables/IPVS rule management across worker nodes for Kubernetes Services?

Accepted Answer

kube-proxy. kube-proxy maintains network rules on nodes allowing network communication to pods.

Answer

kube-scheduler

Answer

kube-apiserver

Answer

etcd

Question 9

Which TWO of the following actions are risks associated with leaving the Kubernetes API server's insecure port enabled? (Choose TWO)

Accepted Answer

Complete bypass of all authentication mechanisms.. The insecure port allows unauthenticated and unencrypted access.

Answer

Enforcement of strict TLS 1.3 encryption on all connections.

Answer

Mandatory mutual TLS client certificate verification.

Answer

Automatic activation of etcd encryption at rest.

Question 10

An auditor notices that kubelet authentication is set to always allow anonymous access in a cluster configuration. According to the CIS Benchmark, what should the kubelet configuration parameter "authentication.anonymous.enabled" be set to?

Accepted Answer

false. The CIS Benchmark specifies that kubelet anonymous access must be disabled by setting authentication.anonymous.enabled to false.

Answer

strict

Answer

auto

Answer

true