KCSA Practice Exam 4 — 20 Questions

Question 1

Which THREE of the following are official Pod Security Standard enforcement levels recognized by Kubernetes?

Accepted Answer

baseline. The three official levels defined by Kubernetes Pod Security Standards are privileged, baseline, and restricted.

Answer

isolated

Answer

secure

Question 2

Which TWO statements are true regarding Kubernetes NetworkPolicy default behaviors?

Accepted Answer

By default, all pods in a cluster are non-isolated and accept traffic from any source.. By default, pods are non-isolated (all traffic allowed). When a NetworkPolicy selects pods and specifies ingress/egress, those specific directions become deny-by-default.

Answer

NetworkPolicies automatically block all traffic across all namespaces upon cluster installation.

Answer

Egress traffic is blocked by default even if no NetworkPolicy is created.

Answer

NetworkPolicies apply to cluster nodes rather than individual pods.

Question 3

A cluster operator is enforcing the Pod Security Standards "restricted" profile across a namespace. A developer attempts to deploy a container running as root (runAsUser: 0). What will happen during the admission phase?

Accepted Answer

The PodSecurity admission controller will reject the pod creation request.. The restricted Pod Security Standard explicitly prohibits containers from running as root and enforces a non-root user. The request will be rejected by the Pod Security admission controller.

Answer

The pod will be created, but the kubelet will override the user ID to 65534 at runtime.

Answer

The pod will start successfully in audit mode, generating a warning event in the API server logs.

Answer

The container will drop all Linux capabilities and proceed with deployment.

Question 4

Which TWO of the following mechanisms help secure the kubelet API from unauthorized access and container inspection? (Choose TWO)

Accepted Answer

Enabling Webhook authorization mode so kubelet requests are validated against API server RBAC.. Setting authorization mode to Webhook and disabling anonymous access protect the kubelet API.

Answer

Removing all TLS certificates from the kubelet configuration.

Answer

Setting kubelet authorization mode to AlwaysAllow.

Answer

Enabling the kubelet read-only port 10255.

Question 5

Which TWO of the following scenarios represent severe security misconfigurations in a Kubernetes cluster control plane? (Choose TWO)

Accepted Answer

The API server is configured with --insecure-port pointing to an active HTTP listener.. Exposing the API server insecure port and allowing anonymous authentication are severe misconfigurations.

Answer

Etcd is configured with client certificate authentication and mTLS enabled.

Answer

Kubelet authorization mode is set to Webhook.

Answer

Secrets are encrypted at rest using an EncryptionConfiguration file.

Question 6

An administrator needs to grant read-only access to Pods specifically within the 'development' namespace to a new user. Which RBAC configuration correctly scopes this permission?

Accepted Answer

Create a Role for Pod read access in the 'development' namespace and bind it to the user using a RoleBinding in the same namespace.. A Role must be used instead of a ClusterRole when scoping permissions to a single namespace. The Role must be bound via a RoleBinding within that same namespace.

Answer

Create a ClusterRole for Pod read access and bind it to the user using a RoleBinding in the 'development' namespace.

Answer

Annotate the user's ServiceAccount with namespace read permissions.

Answer

Create a Role for Pod read access and bind it globally using a ClusterRoleBinding.

Question 7

An application running in a pod needs to securely consume a database password without storing it in plaintext within the container image or deployment manifest. Which native Kubernetes resource is best suited for storing this sensitive key-value data?

Accepted Answer

Secret. Kubernetes Secrets are designed specifically to store and manage sensitive information such as passwords, OAuth tokens, and ssh keys.

Answer

PersistentVolumeClaim

Answer

ResourceQuota

Answer

ConfigMap

Question 8

Which TWO components are involved in configuring and processing admission webhooks in a Kubernetes cluster?

Accepted Answer

kube-apiserver. Admission webhooks are configured via MutatingWebhookConfiguration or ValidatingWebhookConfiguration objects, and processed by the kube-apiserver.

Answer

kube-proxy

Answer

kubelet

Answer

etcd daemon

Question 9

An application pod needs to access the Kubernetes API server securely. How does Kubernetes authenticate the pod by default when it communicates with the API server?

Accepted Answer

Using a ServiceAccount bearer token mounted inside the pod's filesystem.. Kubernetes automatically mounts a ServiceAccount token into the pod's filesystem, which the pod sends as a Bearer token to authenticate with the API server.

Answer

Using static username and password credentials stored in environment variables.

Answer

Using mutual TLS (mTLS) client certificates generated by the kubelet on startup.

Answer

Using SSH keys stored in the pod's root directory.

Question 10

An administrator wants to prevent users from creating pods that mount the host network ('hostNetwork: true'). Which tool or feature is best suited to enforce this restriction natively across the cluster?

Accepted Answer

Pod Security admission controller with baseline or restricted profile. The Pod Security admission controller's 'restricted' or 'baseline' profile automatically blocks pods that set 'hostNetwork: true'.

Answer

ResourceQuota limiting network interfaces

Answer

RBAC ClusterRole restricting pod creation

Answer

NetworkPolicy with a deny-all rule

Question 11

Which TWO of the following files or directories on a control plane node contain critical static pod manifests for core components? (Choose TWO)

Accepted Answer

/etc/kubernetes/manifests/etcd.yaml. The /etc/kubernetes/manifests directory holds static pod yaml files for kube-apiserver, etcd, etc.

Answer

/var/lib/kubelet/config.yaml

Answer

/etc/default/kube-proxy

Answer

~/.kube/config

Question 12

Which THREE of the following mechanisms are used by the Kubernetes API server to authorize requests after authentication succeeds? (Choose THREE)

Accepted Answer

RBAC (Role-Based Access Control) authorizer.. Kubernetes supports Node, RBAC, and Webhook authorization modes.

Answer

Etcd consensus authorizer.

Answer

Kube-proxy IPVS routing authorizer.

Question 13

A security engineer wants to apply Pod Security Standards globally across an entire namespace using the modern built-in admission mechanism. Which approach should be used?

Accepted Answer

Apply labels such as 'pod-security.kubernetes.io/enforce=restricted' to the namespace metadata.. The Pod Security admission controller uses namespace labels (such as 'pod-security.kubernetes.io/enforce') to apply enforcement levels like privileged, baseline, or restricted.

Answer

Create a MutatingWebhookConfiguration that injects security contexts into every pod spec.

Answer

Modify the kubelet configuration file on every worker node to enable restricted mode.

Answer

Deploy a custom PodSecurityPolicy object targeting the namespace selector.

Question 14

Your team is storing sensitive database credentials in Kubernetes Secrets. A security review reveals that base64 encoding does not provide encryption at rest. What mechanism should you enable to ensure Secrets are encrypted when stored in etcd?

Accepted Answer

Configure an EncryptionConfiguration file and reference it via the '--encryption-provider-config' flag on the kube-apiserver.. Enabling EncryptionConfiguration with providers like aescbc or kms ensures that API server encrypts secret data before writing it to etcd.

Answer

Apply a MutatingWebhookConfiguration to automatically hash passwords using bcrypt.

Answer

Enable TLS encryption for all intra-cluster communication using kubeadm configuration.

Answer

Set the secret type to 'kubernetes.io/encrypted-secret'.

Question 15

An auditor notices that a secret is mounted as a volume in a pod. Where is this secret stored on the worker node filesystem by default?

Accepted Answer

In tmpfs (memory), ensuring it is not written to non-volatile disk storage.. Kubernetes secrets mounted as volumes are stored in tmpfs (RAM-backed memory) on the worker node, preventing them from being written to persistent disk storage.

Answer

In an encrypted SQLite database on the node's root partition.

Answer

In plaintext files inside /etc/kubernetes/secrets on the node's hard drive.

Answer

Inside the container image layer cache.

Question 16

Which TWO types of selectors can be used within a Kubernetes NetworkPolicy ingress rule to specify allowed traffic sources?

Accepted Answer

namespaceSelector. Ingress 'from' blocks support podSelector and namespaceSelector to match traffic sources.

Answer

serviceSelector

Answer

ingressSelector

Answer

nodeSelector

Question 17

Which TWO components are core parts of the Kubernetes authorization architecture? (Choose TWO)

Accepted Answer

Webhook Authorization. RBAC and Webhook are authorization modes evaluated by the API server after authentication.

Answer

CoreDNS service discovery

Answer

Kubelet node daemon

Answer

etcd key-value datastore

Question 18

Which TWO of the following are valid ways to harden etcd against unauthorized access and data corruption? (Choose TWO)

Accepted Answer

Require mutual TLS (mTLS) for all client and peer connections.. Enforcing client certificate authentication and taking regular encrypted snapshots secure etcd.

Answer

Expose etcd directly over unencrypted HTTP on port 2379.

Answer

Disable client certificate verification to allow unrestricted access.

Answer

Grant public anonymous write access to the etcd raft log.

Question 19

A cluster administrator needs to grant read-only access to pods within the 'development' namespace using Kubernetes RBAC. Which resource kind should be used to define the permissions?

Accepted Answer

Role. A Role defines permissions within a specific namespace, whereas a ClusterRole defines cluster-scoped permissions. Since the requirement is restricted to the 'development' namespace, a Role is the correct resource.

Answer

SecurityContextConstraints

Answer

PodSecurityPolicy

Answer

ClusterRole

Question 20

Which TWO tools or built-in Kubernetes features are used to secure container privileges and behaviors?

Accepted Answer

Pod Security Standards. Pod Security Standards and security contexts are core mechanisms for securing container privileges.

Answer

PersistentVolumeClaim

Answer

HorizontalPodAutoscaler

Answer

IngressController