KCSA Practice Exam 4 — 20 Questions

Question 1

A security engineer is designing a defense-in-depth strategy for a cloud native application deployment. Which of the following best exemplifies the 'defense-in-depth' principle across the 4Cs layers?

Accepted Answer

Implementing security controls at every layer from Code to Cloud so that a compromise at one layer does not result in total system failure.. Defense-in-depth across the 4Cs means implementing security controls at every layer — Cloud, Cluster, Container, and Code — so that a compromise at one layer does not cascade into total system failure. This layered approach ensures no single point of failure exists in the security posture.

Answer

Granting cluster-admin permissions to all developers to ensure rapid troubleshooting.

Answer

Disabling authentication mechanisms to reduce operational overhead.

Answer

Applying strong firewall rules only at the perimeter of the corporate network.

Question 2

A security analyst wants to scan container images for known Common Vulnerabilities and Exposures (CVEs) as part of a continuous compliance pipeline. Which tool is widely used for this purpose?

Accepted Answer

Trivy. Trivy is an open-source vulnerability scanner for container images, filesystems, and Git repositories. It detects known CVEs in OS packages and application dependencies, making it ideal for continuous compliance pipelines.

Answer

Envoy

Answer

CoreDNS

Answer

Calico

Question 3

Which service account permission model is used by default when a pod is created without specifying a service account name?

Accepted Answer

The 'default' service account in the pod's namespace.. When a pod is created without specifying a serviceAccountName, Kubernetes automatically assigns the 'default' service account from the pod's namespace. This is a built-in behavior: every namespace has a 'default' ServiceAccount created automatically, and the admission controller injects it if none is specified. This default account typically has no extra permissions beyond basic API discovery, but it still exists and can be used for identity.

Answer

No service account is assigned.

Answer

The 'cluster-admin' service account.

Answer

The 'kube-system' privileged service account.

Question 4

Which Kubernetes control plane component is responsible for noticing and responding when nodes go down or fail health checks?

Accepted Answer

kube-controller-manager. The kube-controller-manager runs the node controller, which monitors node health via heartbeats and marks nodes NotReady or unreachable when they fail health checks, then triggers eviction of pods after the toleration period. It is the control plane component responsible for responding to node failures.

Answer

CoreDNS

Answer

etcd

Answer

kube-proxy

Question 5

An administrator wants to ensure that no container in a specific namespace runs with a root User ID (UID 0). Which security context setting should be enforced?

Accepted Answer

runAsNonRoot: true. The runAsNonRoot: true security context setting instructs the kubelet to validate at container start that the image's USER is not UID 0, and to refuse to start the container if it would run as root. Setting it at the pod or container level enforces the no-root requirement across the namespace when combined with Pod Security Admission's restricted profile.

Answer

privileged: false

Answer

readOnlyRootFilesystem: true

Answer

allowPrivilegeEscalation: false

Question 6

Which component is responsible for executing probes (liveness, readiness, startup) against containers running on a worker node?

Accepted Answer

kubelet. The kubelet is the node agent that runs on every worker node and is responsible for managing Pod lifecycle on that node. It receives PodSpecs from the API server and executes the actual container runtime operations, including running liveness, readiness, and startup probes against containers via the container runtime interface (CRI). The kubelet interprets probe definitions (httpGet, tcpSocket, exec, grpc) and periodically executes them, taking action such as restarting containers on liveness failure or removing Pods from Service endpoints on readiness failure.

Answer

kube-scheduler

Answer

kube-controller-manager

Answer

kube-apiserver

Question 7

An administrator needs to grant read-only access to Pods specifically within the 'development' namespace to a new user. Which RBAC configuration correctly scopes this permission?

Accepted Answer

Create a Role for Pod read access in the 'development' namespace and bind it to the user using a RoleBinding in the same namespace.. To grant read-only access to Pods within a specific namespace, you create a Role in that namespace with the necessary permissions and bind it to the user using a RoleBinding in the same namespace. This scopes the permission to the 'development' namespace only, following the principle of least privilege.

Answer

Create a ClusterRole for Pod read access and bind it to the user using a RoleBinding in the 'development' namespace.

Answer

Annotate the user's ServiceAccount with namespace read permissions.

Answer

Create a Role for Pod read access and bind it globally using a ClusterRoleBinding.

Question 8

An administrator needs to evaluate an existing Kubernetes cluster against the CIS Kubernetes Benchmark. Which tool provides automated scanning specifically tailored to this benchmark?

Accepted Answer

kube-bench. kube-bench is an open-source tool from Aqua Security that runs automated checks directly against the CIS Kubernetes Benchmark, inspecting control plane components, kubelet configuration, and node settings. It reports PASS/FAIL/WARN results mapped to specific CIS controls, making it the purpose-built tool for benchmark evaluation.

Answer

kube-hunter

Answer

falco

Answer

velero

Question 9

An organization requires that all container images pulled into a Kubernetes cluster are cryptographically signed and verified before execution. Which tool integrates with Kubernetes admission control to enforce signature verification using Cosign?

Accepted Answer

Kyverno policy engine. Kyverno is a Kubernetes-native policy engine that runs as a dynamic admission controller and can validate, mutate, and generate resources. It supports verifying Cosign signatures on container images via its verifyImages rule, rejecting any pod whose image lacks a valid signature from a trusted key or keyless identity. This makes it the correct tool for enforcing cryptographic image verification at admission time.

Answer

Cilium CNI plugin

Answer

Metrics-server

Answer

Helm package manager

Question 10

In a cloud native environment, what is the primary security purpose of using static code analysis (SAST) and software composition analysis (SCA) tools in the CI/CD pipeline?

Accepted Answer

To identify vulnerabilities and insecure coding patterns in the Code layer before deployment. SAST tools analyze source code for insecure coding patterns such as SQL injection or hardcoded secrets, while SCA tools identify vulnerable open-source dependencies and their licenses. Both operate on the Code layer of the CI/CD pipeline, catching issues before deployment, which is far cheaper than remediating in production.

Answer

To provision cloud networking security groups automatically

Answer

To manage worker node operating system updates

Answer

To detect running process anomalies in production pods

Question 11

A security team implements mutual TLS (mTLS) between all microservices using Istio Service Mesh. Which principle of cloud native security does this implementation primarily exemplify?

Accepted Answer

Zero-trust network segmentation and encryption in transit. Implementing mTLS between all microservices with Istio exemplifies zero-trust network segmentation and encryption in transit. Zero-trust assumes no implicit trust based on network location; every service must authenticate and encrypt its traffic. mTLS provides both mutual authentication (both sides present certificates) and encryption, which is the core of zero-trust service-to-service communication.

Answer

Perimeter-based network defense

Answer

Shared fate computing

Answer

Physical host isolation

Question 12

Why should container images be built using multi-stage builds in Dockerfiles from a security perspective?

Accepted Answer

They exclude build-time tools, package managers, and source code from the final production image, reducing attack surface. Multi-stage builds let you use one stage (with compilers, package managers, source code, and build tools) to produce artifacts, then copy only the final binaries into a minimal runtime stage. The production image therefore excludes build-time tooling and source, shrinking the attack surface and eliminating many CVEs that come from build dependencies.

Answer

They encrypt the container image layer storage in the registry

Answer

They automatically enable kernel-level eBPF monitoring

Answer

They enforce mTLS encryption for all container network traffic

Question 13

An auditor is reviewing the Kubernetes attack surface and notes that a container is running with privileged: true in its securityContext. Which threat model risk does this setting introduce?

Accepted Answer

It disables container isolation, granting the container root-equivalent access to the underlying host node.. Setting privileged: true in a container's securityContext disables the container's isolation from the host by granting it all Linux capabilities and access to host devices. This effectively gives the container root-equivalent control over the underlying node, allowing it to escape the container boundary, access host filesystems, and compromise the node and potentially the whole cluster.

Answer

It prevents the container from writing to ephemeral storage volumes.

Answer

It forces the kubelet to restart the container continuously due to failing readiness probes.

Answer

It completely disables the Kubernetes DNS resolution service for the pod.

Question 14

When discussing cloud native security, what does 'ephemeral infrastructure' refer to, and why is it beneficial for security?

Accepted Answer

Short-lived workloads and nodes that are frequently destroyed and recreated, reducing an attacker's persistence window. Ephemeral infrastructure refers to short-lived workloads and nodes that are frequently destroyed and recreated rather than persisting indefinitely. In cloud native environments, this reduces an attacker's persistence window because any compromise is contained to a brief lifespan, and immutable redeployments wipe out unauthorized changes. This design principle is central to Kubernetes and container security, where pods and nodes are treated as disposable.

Answer

Network connections that automatically drop after one second

Answer

Virtual machines stored in volatile RAM without disk storage

Answer

Infrastructure that is permanent and never updated to prevent downtime

Question 15

An organization is building a secure software supply chain for Kubernetes. They want to ensure that containers running in the cluster were built from verified source code and passed automated security gates. Which tool combination supports this attestation and verification pipeline?

Accepted Answer

Cosign for cryptographic image signing, SBOM generation, and admission controllers for policy enforcement. Cosign provides cryptographic signing and verification of container images, and can attach SBOMs and attestations (e.g., SLSA provenance) to images in OCI registries. Admission controllers such as Kyverno, OPA Gatekeeper, or Sigstore's policy-controller then enforce at admission time that only images with valid signatures/attestations are admitted to the cluster. Together they form the attestation-and-verification pipeline the question describes.

Answer

HorizontalPodAutoscaler and Metrics Server integration

Answer

kube-proxy for CNI routing and CoreDNS for internal name resolution

Answer

etcd snapshots and kubeadm control plane bootstrapping scripts

Question 16

Your security team has discovered that an application container image contains outdated packages with known remote code execution vulnerabilities. Which phase of the software development lifecycle is the most effective place to initially scan and remediate these vulnerabilities?

Accepted Answer

CI/CD pipeline build stage. Scanning in the CI/CD pipeline build stage catches vulnerable packages before the image is pushed to a registry or deployed, enabling remediation at the earliest point where the development team can act. This shifts security left, prevents vulnerable artifacts from propagating, and integrates with build gates that fail the pipeline on critical CVEs. Tools like Trivy, Clair, or Snyk run here.

Answer

Node OS package manager updates

Answer

Kubelet container startup phase

Answer

Kubernetes API server audit logging

Question 17

A security engineer wants to inspect container runtime logs for potential security violations or runtime errors. Which log file or mechanism on a worker node managed by systemd and containerd provides container lifecycle events?

Accepted Answer

journalctl -u containerd. On a worker node managed by systemd and containerd, container lifecycle events and runtime logs are captured by the containerd service. Using journalctl -u containerd retrieves these logs from the systemd journal, providing visibility into container start, stop, and errors. This is the correct mechanism for inspecting runtime logs at the node level.

Answer

kubectl get events --all-namespaces

Answer

/var/log/coredns.log

Answer

/var/log/kube-apiserver.log

Question 18

A security team is evaluating the attack surface of the Kubernetes control plane. They notice that the kubelet API port 10250 is accessible from the internal pod network without proper authorization checks if authentication defaults are misconfigured. What is the primary threat vector associated with an unauthenticated, accessible kubelet API?

Accepted Answer

Execution of arbitrary commands inside running containers via the kubelet exec and run endpoints. The kubelet exposes an HTTP API on port 10250 that includes endpoints such as /exec, /run, and /attach. If authentication is disabled (e.g., --anonymous-auth=true with no authorization), an attacker on the pod network can call these endpoints directly to execute arbitrary commands inside any container running on that node. This bypasses the API server entirely and grants code execution with the container's privileges, often leading to node compromise.

Answer

Direct modification of etcd key-value pairs stored on the master node

Answer

Bypassing container image vulnerability scanners running in the CI/CD pipeline

Answer

Forcing the API server to issue new root certificates via TLS bootstrapping

Question 19

An administrator wishes to inspect which admission controllers are currently enabled in a running Kubernetes cluster. Where is this typically configured in a stacked control plane?

Accepted Answer

In the kube-apiserver static pod manifest file under '/etc/kubernetes/manifests/kube-apiserver.yaml'.. In a kubeadm-provisioned stacked control plane, the kube-apiserver runs as a static pod, and its command-line flags — including --enable-admission-plugins and --disable-admission-plugins — are defined in /etc/kubernetes/manifests/kube-apiserver.yaml. Editing that manifest causes the kubelet to restart the apiserver pod with the new admission controller set.

Answer

In the CoreDNS deployment spec.

Answer

In the kubelet configuration file on each worker node.

Answer

In the cluster-wide ConfigMap named 'kube-system/cluster-admission'.

Question 20

Which Kubernetes control plane component runs controllers that handle routine tasks such as replicating pods and managing service accounts?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the control plane component that runs the built-in controllers — including the ReplicaSet controller (which maintains desired pod replica counts), the ServiceAccount controller (which creates default service accounts and tokens), and the Node, Endpoint, and Namespace controllers. It continuously reconciles observed cluster state with the desired state declared in the API server.

Answer

CoreDNS

Answer

etcd

Answer

kube-proxy