KCSA Practice Exam 2 — 20 Questions

Question 1

An auditor is inspecting a Kubernetes cluster for compliance with the CIS Benchmark for etcd security. Which THREE configurations must be verified for the etcd cluster? (Choose THREE)

Accepted Answer

Peer communication is encrypted using TLS certificates. CIS benchmarks for etcd focus on client certificates (mTLS), peer communication encryption, and secure file permissions.

Answer

etcd auto-compaction is permanently disabled

Answer

etcd is exposed directly on the public internet without authentication

Question 2

You are tasked with securing a Kubernetes cluster where control plane nodes are hosted in a private network segment. To prevent unauthorized access to the API server from compromised internal workloads, which mechanism restricts which service accounts can access the API server?

Accepted Answer

Strict RBAC Role and ClusterRole bindings adhering to the principle of least privilege.. Role-Based Access Control (RBAC) combined with least-privilege binding ensures service accounts only access permitted API resources.

Answer

Setting kubelet readOnlyPort to 8080.

Answer

Enabling anonymous access.

Answer

Disabling the Node authorizer.

Question 3

A security architect is designing role-based access control (RBAC) to comply with NIST access control principles of least privilege. Which THREE best practices should be followed when creating Roles and ClusterRoles? (Choose THREE)

Accepted Answer

Scrutinize and restrict the use of ClusterRoleBindings to cluster-wide resources. Least privilege requires avoiding wildcards, scoping permissions tightly, and auditing bindings.

Answer

Allow all users to read Kubernetes Secrets by default

Answer

Grant cluster-admin permissions to all application service accounts for ease of deployment

Question 4

You are reviewing security logs on a control plane node and discover that an unauthenticated user accessed the kubelet's HTTPS port (10250) to execute commands inside containers. How should you restrict kubelet authentication and authorization to prevent this?

Accepted Answer

Set authentication.anonymous.enabled: false and authorization.mode: Webhook in the kubelet configuration file.. Kubelet must be configured with authentication enabled (such as X509 client certs or webhook token auth) and authorization set to Webhook.

Answer

Enable the kubelet insecure-port flag.

Answer

Set authorization.mode: AlwaysAllow in the kubelet configuration file.

Answer

Disable the API server proxy subresource.

Question 5

An administrator needs to ensure that the Kubernetes API server does not allow insecure cipher suites during TLS handshakes. Which API server flag allows specifying the exact cipher suites permitted?

Accepted Answer

--tls-cipher-suites. The --tls-cipher-suites flag allows administrators to define an explicit array of permitted cryptographic cipher suites.

Answer

--cipher-list

Answer

--secure-ciphers

Answer

--etcd-cipher-suites

Question 6

You are performing a security review of etcd cluster membership. You need to list all active members of the etcd cluster and check their health status using the command line. Which etcdctl command is correct?

Accepted Answer

etcdctl member list and etcdctl endpoint health. etcdctl member list and etcdctl endpoint health are the standard diagnostic commands for checking etcd cluster state.

Answer

etcdctl check membership

Answer

etcdctl cluster status

Answer

kubectl get etcdmembers

Question 7

An administrator needs to evaluate an existing Kubernetes cluster against the CIS Kubernetes Benchmark. Which tool provides automated scanning specifically tailored to this benchmark?

Accepted Answer

kube-bench. Kube-bench is an open-source tool that checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes Benchmark.

Answer

kube-hunter

Answer

falco

Answer

velero

Question 8

Where are static pods for a control plane node typically defined so that the kubelet can automatically create and manage them?

Accepted Answer

In the directory specified by staticPodPath in the kubelet configuration file (default /etc/kubernetes/manifests).. Static pods are defined by manifest files placed in the directory specified by the kubelet's --pod-manifest-path flag or staticPodPath configuration setting.

Answer

In the ~/.kube/config file of the root user.

Answer

In the etcd database under the /registry/staticpods prefix.

Answer

In the kube-system namespace as standard Deployment objects.

Question 9

Which Kubernetes control plane component is responsible for noticing and responding when nodes go down or fail health checks?

Accepted Answer

kube-controller-manager. The kube-controller-manager runs node lifecycle controllers that monitor node health and update node status.

Answer

CoreDNS

Answer

etcd

Answer

kube-proxy

Question 10

Which component is responsible for executing probes (liveness, readiness, startup) against containers running on a worker node?

Accepted Answer

kubelet. The kubelet executes liveness, readiness, and startup probes directly for containers on its node.

Answer

kube-scheduler

Answer

kube-controller-manager

Answer

kube-apiserver

Question 11

Which RBAC verb allows a user to delete an existing resource in a Kubernetes namespace?

Accepted Answer

delete. The 'delete' verb specifically authorizes removing resources.

Answer

remove

Answer

purge

Answer

destroy

Question 12

When configuring Pod Security Standards on a namespace, which THREE security restrictions are enforced by the 'restricted' profile that are NOT enforced by the 'baseline' profile? (Choose THREE)

Accepted Answer

Restricting volume types to a safe subset (e.g., configMap, secret, emptyDir).. The restricted profile adds requirements such as running as a non-root user, preventing escalation of privileges, and restricting allowed volume types.

Answer

Disallowing privileged containers.

Answer

Prohibiting hostPort usage entirely.

Question 13

Which TWO of the following statements are true regarding Kubernetes Secrets and their security posture by default?

Accepted Answer

Mounting a Secret as an environment variable can expose the secret value in container logs or crash dumps.. Kubernetes Secrets are base64 encoded (not encrypted) by default in etcd, and access to them can be controlled via RBAC.

Answer

Secrets are strongly encrypted at rest using AES-256 encryption by default in etcd.

Answer

Secrets automatically expire and rotate every 30 days unless explicitly disabled.

Answer

Secrets encoded in base64 provide cryptographic security comparable to robust symmetric encryption.

Question 14

Which CNCF project acts as a cloud-native runtime security and intrusion detection tool that monitors system calls against predefined security rules?

Accepted Answer

Falco. Falco is the CNCF incubating runtime security tool that acts as a security camera for containers, detecting anomalous behavior and policy violations.

Answer

Trivy

Answer

Fluentd

Answer

Cert-manager

Question 15

An auditor reviews container runtime configurations for compliance with NIST SP 800-190 recommendations on privilege escalation. Which Kubernetes feature controls whether a process can gain more privileges than its parent process?

Accepted Answer

allowPrivilegeEscalation: false. allowPrivilegeEscalation controls whether a process can gain more privileges through mechanisms like setuid binaries, fulfilling privilege restriction controls.

Answer

automountServiceAccountToken: false

Answer

runAsUser: 1000

Answer

privileged: false

Question 16

You are hardening etcd on a dedicated control plane host. You want to ensure that etcd database files on disk are protected against unauthorized physical or filesystem access. Which control mechanism is best suited for this?

Accepted Answer

Filesystem or block-level disk encryption (e.g., LUKS) on the host storage volume.. Operating system level disk encryption (such as LUKS) protects files at rest on block storage devices.

Answer

Kubernetes NetworkPolicies applied to the etcd Pod.

Answer

API server RBAC ClusterRoleBinding.

Answer

Kubelet read-only port disabling.

Question 17

Which TWO of the following methods can be used to authenticate users or systems against the Kubernetes API server? (Choose TWO)

Accepted Answer

X.509 client certificates validated by the API server CA.. OpenID Connect (OIDC) tokens and X.509 client certificates are standard native authentication methods for the API server.

Answer

Unencrypted HTTP basic auth files with default passwords.

Answer

Anonymous packet sniffing via kube-proxy.

Answer

Direct root SSH access to etcd nodes.

Question 18

A security team needs to ensure that Kubernetes nodes have secure file permissions for the kubelet configuration files, in alignment with CIS benchmarks. What should the file permissions on "/etc/kubernetes/kubelet.conf" typically be set to?

Accepted Answer

600. CIS benchmarks state that configuration files containing sensitive credentials, such as kubelet.conf, must have permissions set to 600 or stricter and be owned by root:root.

Answer

777

Answer

755

Answer

644

Question 19

Which protocol and default secure port does the kubelet use to listen for incoming authenticated requests from the API server and metrics collectors?

Accepted Answer

HTTPS on port 10250. The kubelet listens on TCP port 10250 for secure HTTPS traffic.

Answer

HTTPS on port 6443

Answer

TCP on port 2379

Answer

HTTP on port 10255

Question 20

Which TWO of the following are core security hardening best practices for the Kubernetes API server? (Choose TWO)

Accepted Answer

Ensure the insecure port (--insecure-port) is disabled or set to 0.. Disabling anonymous requests and enforcing strong TLS versions are essential API server hardening steps.

Answer

Configure the API server to use HTTP instead of HTTPS for performance.

Answer

Store all kubeconfig credentials in public ConfigMaps.

Answer

Grant cluster-admin permissions to all authenticated users by default.