KCSA Practice Exam 3 — 20 Questions

Question 1

An organization requires compliance auditing of etcd access to ensure unauthorized clients cannot communicate with the data store. According to CIS benchmarks, how should etcd client communication be secured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Mutual TLS (mTLS) client certificates. CIS benchmarks require etcd client communication to be authenticated and encrypted using mutual TLS (mTLS).

Answer

IPsec tunnel encapsulation

Answer

HTTP with token bearer headers

Answer

Plaintext loopback interface binding

Question 2

A security team is implementing Pod Security Standards (restricted, baseline, privileged) across namespaces. Which THREE controls are enforced under the Restricted Pod Security profile? (Choose THREE)

Accepted Answer

Requiring all capabilities to be dropped except NET_BIND_SERVICE or dropping all (capabilities.drop: [ALL]). The restricted profile enforces running as non-root, dropping capabilities, and preventing privilege escalation.

Answer

Allowing unrestricted use of the host network and host PID namespaces

Answer

Enabling privileged mode for all standard workloads

Question 3

A compliance team is adopting the NIST SP 800-190 standard to secure their container image pipeline. Which THREE practices are recommended in this framework for managing container images? (Choose THREE)

Accepted Answer

Employ trusted base images from verified publishers. NIST SP 800-190 recommends vulnerability scanning, cryptographic signing/provenance, and using trusted base images.

Answer

Store plaintext passwords directly inside Dockerfile ENV directives

Answer

Rely exclusively on public unverified base images to speed up development

Question 4

When configuring Role-Based Access Control (RBAC), which Kubernetes object grants permissions across the entire cluster rather than within a single namespace?

Accepted Answer

ClusterRole. A ClusterRole defines permissions across the entire cluster, and a ClusterRoleBinding applies them cluster-wide.

Answer

ServiceAccount

Answer

Role

Answer

PodSecurityPolicy

Question 5

An administrator wants to secure the communication channel between the Kubernetes API server and extension API servers (such as metrics-server). Which API server flag specifies the Certificate Authority used to verify extension API server certificates?

Accepted Answer

--requestheader-client-ca-file. The --requestheader-client-ca-file flag specifies the CA certificate used to sign client certificates for aggregated API servers.

Answer

--extension-ca-file

Answer

--etcd-ca-file

Answer

--proxy-client-cert-file

Question 6

Which of the following describes a recommended security practice when managing Kubernetes Secrets?

Accepted Answer

Limit RBAC access so that only necessary users and service accounts can read secrets.. Restricting RBAC permissions to secrets ensures that only authorized users and workloads can read sensitive data.

Answer

Use ConfigMaps for passwords and Secrets for plain text configuration.

Answer

Store secret values in plain text inside public Git repositories for easy collaboration.

Answer

Disable authentication on the Kubernetes API server to simplify secret retrieval.

Question 7

Which THREE methods can be used to inject Kubernetes Secrets into a running pod?

Accepted Answer

Injected as environment variables. Secrets can be injected into pods via environment variables, environment variables from secret keys, or mounted as files in volumes.

Answer

Compiled directly into the container image binary

Answer

Injected through kernel sysctl parameters

Question 8

An administrator wishes to inspect which admission controllers are currently enabled in a running Kubernetes cluster. Where is this typically configured in a stacked control plane?

Accepted Answer

In the kube-apiserver static pod manifest file under '/etc/kubernetes/manifests/kube-apiserver.yaml'.. Admission controllers are configured via the '--enable-admission-plugins' flag on the kube-apiserver static pod manifest.

Answer

In the CoreDNS deployment spec.

Answer

In the kubelet configuration file on each worker node.

Answer

In the cluster-wide ConfigMap named 'kube-system/cluster-admission'.

Question 9

Which TWO entities can be assigned RBAC permissions in a Kubernetes cluster? (Choose TWO)

Accepted Answer

ServiceAccount. RBAC bindings can be assigned to Users, Groups, and ServiceAccounts.

Answer

ConfigMap

Answer

Namespace

Answer

PersistentVolume

Question 10

Which THREE of the following are key components of the Kubernetes control plane? (Choose THREE)

Accepted Answer

kube-scheduler. The API server, scheduler, and controller manager are core control plane components.

Answer

container runtime (e.g., containerd)

Answer

kube-proxy

Question 11

By default, how are Kubernetes Secrets stored in etcd when created without additional encryption-at-rest configurations?

Accepted Answer

Encoded in Base64 plaintext. By default, Kubernetes Secrets are stored encoded in Base64 plaintext within etcd, meaning anyone with etcd access can decode them.

Answer

Hashed using SHA-256 with a random salt

Answer

Encrypted using the node's TPM chip

Answer

Encrypted using AES-256 automatically

Question 12

An administrator wants to ensure that no container in a specific namespace runs with a root User ID (UID 0). Which security context setting should be enforced?

Accepted Answer

runAsNonRoot: true. Setting 'runAsNonRoot: true' in the security context forces the container runtime to reject containers that attempt to run as UID 0.

Answer

privileged: false

Answer

readOnlyRootFilesystem: true

Answer

allowPrivilegeEscalation: false

Question 13

Which TWO of the following API server configuration flags help enforce cryptographic and transport security? (Choose TWO)

Accepted Answer

--tls-cipher-suites to specify permitted strong cryptographic cipher suites.. --tls-min-version and --tls-cipher-suites enforce transport security standards.

Answer

--anonymous-auth to enable unauthenticated cluster access.

Answer

--insecure-port to allow unencrypted HTTP traffic.

Answer

--enable-http2=false to disable secure multiplexing.

Question 14

Under the Pod Security Standards, a developer attempts to deploy a pod with 'privileged: true' in a namespace labeled with 'pod-security.kubernetes.io/enforce=baseline'. What will happen?

Accepted Answer

The admission controller will reject the pod creation request with an error.. The 'baseline' profile prohibits privileged containers. The admission controller will reject the pod creation request.

Answer

The pod will run in a restricted sandbox environment automatically.

Answer

The pod will be created successfully, but a warning will be logged in the audit log.

Answer

The kubelet will automatically strip the 'privileged: true' setting and run the pod safely.

Question 15

You are deploying a ValidatingWebhookConfiguration to inspect incoming pod creations. What happens if the webhook fails and the 'failurePolicy' in the webhook configuration is set to 'Fail'?

Accepted Answer

The API request is rejected.. When failurePolicy is set to 'Fail', any error or timeout reaching the external webhook causes the API server to reject the API request.

Answer

The API request is allowed to proceed without validation.

Answer

The pod is created in a suspended state until the webhook recovers.

Answer

The kube-apiserver restarts automatically.

Question 16

You are reviewing admission webhook configurations and notice that timeoutSeconds is set to 3 seconds for a critical validation webhook. If the webhook server takes 4 seconds to respond, what does the API server do when failurePolicy is 'Ignore'?

Accepted Answer

It allows the API request to proceed as if the webhook succeeded.. When failurePolicy is 'Ignore', a timeout or error reaching the webhook results in the API server ignoring the failure and allowing the request to proceed.

Answer

It quarantines the pod in a Pending state.

Answer

It rejects the API request immediately.

Answer

It retries the webhook request indefinitely until it responds.

Question 17

An application pod requires access to the Kubernetes API to list other pods. To follow secure practices, you create a dedicated ServiceAccount and bind a custom Role to it. How should you configure the Pod specification to prevent the default service account token from being automatically mounted?

Accepted Answer

Set 'automountServiceAccountToken: false' in the Pod specification.. Setting 'automountServiceAccountToken: false' on either the ServiceAccount or the Pod specification prevents the automatic mounting of the token, reducing the blast radius if compromised.

Answer

Delete the 'default' ServiceAccount in the namespace.

Answer

Configure the Pod securityContext with 'readOnlyRootFilesystem: true'.

Answer

Add a deny NetworkPolicy blocking egress to the Kubernetes API service IP.

Question 18

An application pod needs to mount a Secret as environment variables. Which section of the Pod manifest should be configured to achieve this securely?

Accepted Answer

Using 'env' with 'valueFrom.secretKeyRef' or 'envFrom' with 'secretRef' in the container specification.. Environment variables can be populated from Secrets using 'envFrom' or 'env' with 'valueFrom.secretKeyRef'.

Answer

Using 'volumeMounts' pointing to a PersistentVolumeClaim bound to the Secret.

Answer

Adding the Secret name directly to the container imagePullSecrets field.

Answer

Declaring the Secret in the container securityContext block.

Question 19

Which THREE components are involved when an external client authenticates to the Kubernetes API server using OpenID Connect (OIDC)? (Choose THREE)

Accepted Answer

The OIDC Identity Provider (IdP) issuing ID tokens.. OIDC authentication involves the client (e.g. kubectl), the OIDC identity provider, and the kube-apiserver.

Answer

The CoreDNS server resolving the OIDC provider domain.

Answer

The Kubelet running on worker nodes.

Question 20

An administrator wants to audit who created or modified specific resources in the cluster. Where are API server audit records sent if configured with the log backend?

Accepted Answer

To the file path specified by --audit-log-path on the control plane host.. When using the log audit backend, audit records are written to a file path specified by --audit-log-path.

Answer

Directly to the etcd key-value store under /audit/logs.

Answer

To the container stdout of kube-proxy.

Answer

To the kubelet systemd journal on worker nodes.