KCSA Practice Exam 3 — 20 Questions

Question 1

An administrator wants to audit who created or modified specific resources in the cluster. Where are API server audit records sent if configured with the log backend?

Accepted Answer

To the file path specified by --audit-log-path on the control plane host.. When the Kubernetes API server is configured with the log audit backend, audit records are written to the file path specified by the --audit-log-path flag on the control plane host. This is the default and most straightforward backend for audit logging, allowing administrators to review who did what and when. The log backend writes JSON-formatted audit events to that file, which can then be rotated and analyzed.

Answer

Directly to the etcd key-value store under /audit/logs.

Answer

To the container stdout of kube-proxy.

Answer

To the kubelet systemd journal on worker nodes.

Question 2

A security analyst reviews an incident where an attacker compromised a container running with the `CAP_SYS_ADMIN` capability and subsequently escaped to the host node. Which cloud native security principle was violated during the initial pod configuration?

Accepted Answer

Principle of least privilege. The principle of least privilege (B) was violated because the container was granted the `CAP_SYS_ADMIN` capability, which is a powerful capability that allows administrative operations. Containers should run with only the minimal capabilities required. Granting such a capability increases the risk of container escape and host compromise.

Answer

Zero-trust network architecture

Answer

Shared responsibility model

Answer

Ephemeral infrastructure design

Question 3

Which Kubernetes component manages the assignment of pending pods to healthy worker nodes based on resource availability and constraints?

Accepted Answer

kube-scheduler. kube-scheduler watches for newly created Pods that have no node assigned and selects a node for them to run on. It filters nodes through predicates (resource requests, taints/tolerations, node affinity, topology spread) and then scores the remaining candidates to pick the best fit. The result is written back to the API server as a binding.

Answer

kube-proxy

Answer

kube-apiserver

Answer

etcd

Question 4

You are configuring an Ingress object with TLS termination. The TLS certificate and private key are stored in a Kubernetes Secret. Which specific secret type must be used to ensure the ingress controller recognizes and validates the TLS credentials correctly?

Accepted Answer

kubernetes.io/tls. The kubernetes.io/tls secret type is specifically designed to hold a TLS certificate and its private key, with required keys 'tls.crt' and 'tls.key'. Ingress controllers look for this type to correctly load and validate the certificate for TLS termination.

Answer

kubernetes.io/service-account-token

Answer

Opaque

Answer

kubernetes.io/dockerconfigjson

Question 5

What is the primary function of the 'automountServiceAccountToken: false' setting in a Pod specification?

Accepted Answer

It prevents the ServiceAccount API token from being automatically mounted inside the pod.. The 'automountServiceAccountToken: false' setting in a Pod specification prevents the default ServiceAccount token from being automatically mounted into the pod's filesystem. This reduces the attack surface by ensuring the pod does not have credentials to access the Kubernetes API unless explicitly mounted. It does not delete the ServiceAccount, disable RBAC, or block all API communication.

Answer

It deletes the ServiceAccount object from the cluster when the pod terminates.

Answer

It prevents the pod from communicating with the Kubernetes API server entirely.

Answer

It disables RBAC authorization checks for the pod.

Question 6

An application pod needs to access the Kubernetes API server securely. How does Kubernetes authenticate the pod by default when it communicates with the API server?

Accepted Answer

Using a ServiceAccount bearer token mounted inside the pod's filesystem.. By default, Kubernetes authenticates pods to the API server using the ServiceAccount token that is automatically mounted into the pod at /var/run/secrets/kubernetes.io/serviceaccount/token. The kubelet projects this token into the pod, and the API server validates it as a bearer token tied to the pod's ServiceAccount identity. This is the standard in-cluster authentication mechanism.

Answer

Using static username and password credentials stored in environment variables.

Answer

Using mutual TLS (mTLS) client certificates generated by the kubelet on startup.

Answer

Using SSH keys stored in the pod's root directory.

Question 7

Under the Pod Security Standards, a developer attempts to deploy a pod with 'privileged: true' in a namespace labeled with 'pod-security.kubernetes.io/enforce=baseline'. What will happen?

Accepted Answer

The admission controller will reject the pod creation request with an error.. The baseline Pod Security Standard explicitly prohibits privileged containers, so the Pod Security Admission controller will reject the pod creation request when the namespace enforces baseline. The 'enforce' label triggers rejection (not just warning) for any pod violating the baseline policy. Privileged mode is one of the restricted fields baseline forbids.

Answer

The pod will run in a restricted sandbox environment automatically.

Answer

The pod will be created successfully, but a warning will be logged in the audit log.

Answer

The kubelet will automatically strip the 'privileged: true' setting and run the pod safely.

Question 8

Where are static pods for a control plane node typically defined so that the kubelet can automatically create and manage them?

Accepted Answer

In the directory specified by staticPodPath in the kubelet configuration file (default /etc/kubernetes/manifests).. Static pods are defined as YAML manifest files placed in the directory specified by the 'staticPodPath' setting in the kubelet configuration (default /etc/kubernetes/manifests). The kubelet watches this directory and automatically creates, updates, and manages pods from any manifests it finds there, without involving the API server scheduler.

Answer

In the ~/.kube/config file of the root user.

Answer

In the etcd database under the /registry/staticpods prefix.

Answer

In the kube-system namespace as standard Deployment objects.

Question 9

Which of the following is a key component of the Kubernetes threat model concerning the compromise of node kubelets via insecure configuration?

Accepted Answer

Leaving the Kubelet read-only port (10255) enabled and accessible. The Kubelet read-only port 10255 exposes unauthenticated, unencrypted access to pod and node information (and in some configurations, more). Leaving it enabled and reachable is a well-known Kubernetes threat model item because an attacker on the network can query it to enumerate workloads, extract metadata, and potentially pivot. Hardening guidance (CIS Kubernetes Benchmark) explicitly requires disabling it via --read-only-port=0.

Answer

Enforcing Pod Security Admission in restricted mode

Answer

Using secure HTTPS client certificates for API server communication

Answer

Enabling RBAC authorization mode across the control plane

Question 10

When evaluating cloud native security principles, why is reliance on a traditional network firewall (perimeter security) considered insufficient for modern Kubernetes environments?

Accepted Answer

Because container workloads have dynamic IP addresses and high east-west traffic that perimeter firewalls cannot inspect effectively. Kubernetes pods receive ephemeral IPs from the CNI plugin and are constantly created, destroyed, and rescheduled, so static perimeter firewall rules cannot reliably identify or track workloads. Additionally, most traffic in a cluster is east-west (pod-to-pod, service-to-service), which never crosses the perimeter and therefore is invisible to a traditional firewall. This is why Kubernetes-native controls like NetworkPolicies, service meshes, and zero-trust identity are required.

Answer

Because Kubernetes natively disables all network traffic by default

Answer

Because cloud providers prohibit the use of firewalls

Answer

Because firewalls cannot run on Linux operating systems

Question 11

An attacker manages to compromise a low-privilege pod inside a Kubernetes cluster and attempts to escalate privileges or pivot to other cluster components. Which THREE of the following misconfigurations or weaknesses would significantly aid the attacker's lateral movement or privilege escalation? (Choose THREE)

Accepted Answer

The pod's ServiceAccount has a ClusterRoleBinding granting cluster-admin permissions.. Option C is correct because a ClusterRoleBinding that binds the pod's ServiceAccount to the cluster-admin ClusterRole grants that pod full, unrestricted permissions across every namespace and resource in the cluster, so a compromised pod can immediately read secrets, create privileged workloads, and take over the control plane. Option D is correct because hostNetwork: true places the pod in the node's network namespace, letting the attacker sniff node-level traffic (including kubelet, API server, and other pods' unencrypted communications) and reach services bound to the node's interfaces, which materially aids lateral movement. Option E is correct because if the instance metadata service (169.254.169.254) is reachable without IMDSv2 session-token enforcement, a compromised pod can retrieve the node's IAM credentials and use them against the cloud API, pivoting from the cluster into the underlying cloud infrastructure. Option A does not belong because KMS-backed etcd encryption at rest protects data on disk and does nothing to help an attacker already executing inside a pod. Option B does not belong because the Restricted Pod Security Standard blocks privileged settings such as hostNetwork and hostPath, so it actually hinders rather than aids escalation.

Answer

Etcd is encrypted at rest using a customer-managed KMS encryption provider.

Answer

The cluster uses a properly configured PodSecurityStandard of Restricted across all namespaces.

Question 12

Which component provides network routing and iptables/IPVS rule management across worker nodes for Kubernetes Services?

Accepted Answer

kube-proxy. kube-proxy runs on every node and is responsible for programming iptables (or IPVS, or nftables in newer versions) rules that implement Kubernetes Service virtual IPs and load balancing to backend pods. It watches the API server for Service and EndpointSlice objects and translates them into node-local dataplane rules. Without kube-proxy (or a replacement like Cilium's kube-proxy replacement), ClusterIP and NodePort services would not function.

Answer

kube-scheduler

Answer

kube-apiserver

Answer

etcd

Question 13

A security team discovers that an application container running as root has successfully mounted the host's Docker socket (`/var/run/docker.sock`). What is the primary attack vector enabled by this misconfiguration?

Accepted Answer

Container escape and full node takeover by orchestrating new sibling containers with host mounts. Mounting the host's Docker socket into a container gives that container full control over the Docker daemon, which runs as root on the host. An attacker can use the Docker API to start a new privileged container with the host filesystem mounted (e.g., -v /:/host), then chroot into it to gain root on the node — a classic container escape. This is the primary attack vector: full node takeover, and potentially lateral movement to other nodes via the cluster network or credentials.

Answer

Bypassing Kubernetes NetworkPolicies across different worker nodes

Answer

Direct modification of the etcd database state via local unix socket tunneling

Answer

Automatic escalation of RBAC roles assigned to the API server

Question 14

Which TWO actions are core tenets of the "Shift-Left" security philosophy in cloud-native compliance? (Choose TWO)

Accepted Answer

Scanning infrastructure-as-code (IaC) templates for misconfigurations before deployment. Option B is correct because Shift-Left security means identifying misconfigurations in infrastructure-as-code (IaC) templates such as Terraform, CloudFormation, or Kubernetes manifests during development, before any resources are provisioned, so issues are caught early when they are cheapest and safest to fix. Option D is correct because embedding vulnerability scanning (for example SAST, SCA, or container image scanning) directly into the CI/CD pipeline enforces automated security gates on every commit or build, which is the operational core of shifting security left into the development lifecycle. Option A is wrong because disabling automated security tooling removes the very guardrails Shift-Left depends on and increases risk rather than reducing it. Option C is wrong because auditing only after a production breach is a reactive, right-side-of-development approach, the opposite of Shift-Left. Option E is wrong because relying solely on manual post-release code reviews is late, non-automated, and does not prevent defects from reaching production.

Answer

Disabling all automated security tooling to speed up commits

Answer

Waiting until a production breach occurs to audit logs

Answer

Relying entirely on manual code reviews post-release

Question 15

An attacker with read access to Kubernetes Secrets inspects a secret containing TLS private keys. Under the STRIDE threat model, what specific threat category does this represent regarding confidentiality?

Accepted Answer

Information Disclosure. Information Disclosure is the STRIDE category that covers unauthorized access to confidential data, such as an attacker reading TLS private keys from a Kubernetes Secret. Since the attacker has read access to the secret, the confidentiality of the private keys is compromised, which is precisely Information Disclosure. This threat directly maps to the confidentiality pillar of security.

Answer

Denial of Service

Answer

Elevation of Privilege

Answer

Repudiation

Question 16

Which THREE of the following actions can compromise the security of the Kubernetes control plane if left unmitigated? (Choose THREE)

Accepted Answer

Granting wildcard cluster-admin permissions to untrusted service accounts.. Option A is correct because binding a service account to a ClusterRole with wildcard verbs/resources (e.g., via ClusterRoleBinding to cluster-admin) lets any pod using that account read secrets, create privileged workloads, and effectively take over the control plane. Option B is correct because enabling anonymous authentication (--anonymous-auth=true) on the API server or kubelet allows unauthenticated requests to reach endpoints, and combined with permissive authorization it exposes cluster data and node operations to anyone who can reach the port. Option E is correct because the API server's insecure port (--insecure-port) serves requests over plain HTTP with no authentication or authorization, so any network-reachable client can issue privileged API calls. Option C is not a compromise: Webhook authorization mode delegates decisions to the API server's SubjectAccessReview, which is the recommended secure mode for kubelet. Option D is not a compromise: encrypting etcd at rest with a valid key protects secret data and is a security best practice, not a risk.

Answer

Configuring kubelet authorization mode to Webhook.

Answer

Enabling etcd encryption at rest with a valid key.

Question 17

When designing a defense-in-depth strategy across the 4Cs, which THREE independent security controls can be applied at different layers? (Choose THREE)

Accepted Answer

Container image signing with Cosign and admission verification for Container. Option B is correct because container image signing with Cosign plus an admission controller that verifies signatures enforces supply-chain integrity at the Container layer, ensuring only trusted, unmodified images are admitted to the cluster. Option C is correct because Kubernetes NetworkPolicies provide Cluster-layer microsegmentation, restricting pod-to-pod traffic to explicitly allowed flows and limiting lateral movement if a workload is compromised. Option E is correct because SAST scanning in the CI/CD pipeline addresses the Code layer, detecting insecure code patterns and vulnerabilities before artifacts are built or deployed. Option A is not a valid independent control since relying solely on a cloud provider's default network security group creates a single point of failure and violates defense-in-depth. Option D is not a security control at all; granting all developers cluster-admin permissions violates least privilege and dramatically expands the attack surface.

Answer

Relying solely on the cloud provider's default network security group for all protection

Answer

Granting all developers cluster-admin permissions for operational speed

Question 18

An attacker who achieves remote code execution inside a misconfigured container discovers that the service account token mounted at /var/run/secrets/kubernetes.io/serviceaccount/token has cluster-wide administrative permissions. Which Kubernetes security feature should be enabled on the ServiceAccount to mitigate the risk of token theft and misuse?

Accepted Answer

Disabling automatic token mounting (automountServiceAccountToken: false) and utilizing projected volumes with bound audiences. Disabling automountServiceAccountToken and using projected volumes with bound audiences limits the blast radius of token theft because the token is only issued when explicitly requested and is scoped to a specific audience and expiry. This prevents an attacker with RCE from finding a long-lived, cluster-admin token automatically mounted in the pod filesystem. Projected tokens are also time-bound and rotated, so stolen tokens expire quickly.

Answer

Configuring a default Deny-All NetworkPolicy for the kube-system namespace

Answer

Enabling the NodeRestriction admission plugin

Answer

EnablingAnonymousAuth on the kube-apiserver

Question 19

What is the primary security benefit of using immutable container base distroless images?

Accepted Answer

They eliminate unnecessary shells and package managers, drastically reducing the attack surface.. Distroless images contain only the application and its runtime dependencies, omitting package managers, shells, and other utilities. This drastically reduces the attack surface because attackers cannot easily execute shell commands, install tools, or exploit vulnerabilities in unnecessary packages. The primary security benefit is the minimized attack surface.

Answer

They prevent the API server from restarting during control plane upgrades.

Answer

They automatically encrypt persistent storage volumes attached to the pod.

Answer

They configure automatic mTLS between all pods in the cluster via CNI.

Question 20

Which THREE advanced container runtime or image security features help prevent container breakout exploits? (Choose three)

Accepted Answer

Using sandboxed container runtimes (such as Kata Containers or gVisor) for strong isolation. Option A is correct because sandboxed runtimes such as Kata Containers and gVisor insert a lightweight VM or user-space kernel boundary between the container and the host kernel, so a kernel exploit inside the container does not directly compromise the host. Option D is correct because restrictive Seccomp profiles filter the syscall table and block sensitive calls (for example, ptrace, mount, or unshare) that container breakout exploits rely on to escape isolation. Option E is correct because dropping dangerous Linux capabilities such as CAP_SYS_ADMIN, CAP_NET_RAW, and CAP_SYS_PTRACE removes the privileges needed to mount filesystems, craft raw packets, or inject into host processes, which are common breakout primitives. Option B is wrong because privileged mode disables isolation and grants all capabilities plus host device access, dramatically increasing breakout risk. Option C is wrong because mounting host /proc and /sys read-write exposes host kernel and process information and allows tampering, which weakens rather than strengthens isolation.

Answer

Running all containers in privileged mode

Answer

Mounting host /proc and /sys directories in read-write mode