KCSA Practice Test 2 — 25 Questions

Question 1

An administrator wants to prevent users from creating pods that mount the host network ('hostNetwork: true'). Which tool or feature is best suited to enforce this restriction natively across the cluster?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Pod Security admission controller with baseline or restricted profile. Pod Security admission (PSA) is the built-in Kubernetes admission controller that enforces Pod Security Standards at the namespace level using labels. The baseline and restricted profiles explicitly disallow hostNetwork: true, so labeling the namespace with pod-security.kubernetes.io/enforce: baseline (or restricted) blocks pods that request host networking. This is the native, cluster-wide enforcement mechanism.

Answer

ResourceQuota limiting network interfaces

Answer

RBAC ClusterRole restricting pod creation

Answer

NetworkPolicy with a deny-all rule

Question 2

A platform engineer needs to secure an Ingress resource using TLS termination, ensuring that sensitive private keys are stored securely within the cluster and referenced safely. Which Kubernetes resource should be created to store the TLS certificate and private key pair?

Accepted Answer

Secret of type kubernetes.io/tls. A Secret of type kubernetes.io/tls is the correct resource because it is specifically designed to hold a TLS certificate and its private key. The Ingress resource references this Secret in its tls section, and the ingress controller uses it to terminate TLS. Kubernetes treats this Secret type with appropriate handling for the required tls.crt and tls.key fields.

Answer

PersistentVolumeClaim

Answer

CertificateSigningRequest

Answer

ConfigMap

Question 3

You are performing a security review of etcd cluster membership. You need to list all active members of the etcd cluster and check their health status using the command line. Which etcdctl command is correct?

Accepted Answer

etcdctl member list and etcdctl endpoint health. etcdctl provides two distinct subcommands for this task: 'etcdctl member list' enumerates all cluster members with their IDs, peer URLs, and client URLs, while 'etcdctl endpoint health' queries each endpoint to verify it can serve requests and is not lagging. Together they satisfy the requirement to list active members and check their health.

Answer

etcdctl check membership

Answer

etcdctl cluster status

Answer

kubectl get etcdmembers

Question 4

You want to ensure that a newly created Role in namespace 'finance' cannot be modified or deleted by regular developers who have edit permissions. Which RBAC feature or design prevents unauthorized privilege escalation through Role manipulation?

Accepted Answer

The API server's built-in privilege escalation prevention check, which blocks users from granting permissions they do not hold.. Kubernetes RBAC has a built-in privilege escalation prevention check: the API server blocks a user from creating or updating a Role/ClusterRole that grants permissions the user does not already hold (unless they have the 'escalate' or 'bind' verb). This prevents a developer with edit rights from crafting a Role that grants cluster-admin and then binding to it.

Answer

Enabling Pod Security Standards on the finance namespace.

Answer

Setting the Role resource to immutable via 'immutable: true'.

Answer

A mandatory MutatingWebhookConfiguration that strips administrative verbs.

Question 5

An enterprise cluster requires that all incoming NetworkPolicies must default to denying all traffic unless explicitly allowed. A developer creates a namespace but forgets to apply any policies. What is the default behavior of Kubernetes regarding inter-pod traffic within a namespace when no NetworkPolicies are present?

Accepted Answer

All traffic between pods is allowed by default.. Kubernetes NetworkPolicies operate on an additive allow-list model: if no policy selects a pod, that pod is non-isolated and all ingress/egress traffic is permitted. The default-deny posture only takes effect once at least one NetworkPolicy selects the pod and does not explicitly allow the traffic. Therefore, a namespace with zero policies allows unrestricted inter-pod communication.

Answer

Only traffic originating from the kube-system namespace is allowed.

Answer

Traffic is allowed only if the pods share the same node.

Answer

All traffic between pods is denied by default.

Question 6

Which attack vector involves tricking a Kubernetes cluster user or service into executing unintended actions via authenticated sessions, frequently mitigated by robust CSRF defenses and proper API design?

Accepted Answer

Cross-Site Request Forgery (CSRF). Cross-Site Request Forgery (CSRF) tricks an authenticated user's browser or session into sending unintended requests to a trusted application — for example, a malicious page causing a logged-in Kubernetes dashboard user to issue API calls. Mitigations include CSRF tokens, SameSite cookies, and requiring re-authentication for sensitive operations, which is exactly what the question describes.

Answer

Denial of Service via memory leaks

Answer

Container escape via kernel flaw

Answer

Image tag mutation

Question 7

Which of the following describes a recommended security practice when managing Kubernetes Secrets?

Accepted Answer

Limit RBAC access so that only necessary users and service accounts can read secrets.. The recommended practice is to follow the principle of least privilege by restricting who can read Secrets. Kubernetes Secrets are not encrypted by default; they are only base64-encoded, so any user or service account with get/list/watch permissions on Secrets can easily decode and view sensitive data. Limiting RBAC access ensures that only authorized workloads and administrators can access specific Secrets, reducing the attack surface and potential for credential leakage.

Answer

Use ConfigMaps for passwords and Secrets for plain text configuration.

Answer

Store secret values in plain text inside public Git repositories for easy collaboration.

Answer

Disable authentication on the Kubernetes API server to simplify secret retrieval.

Question 8

A developer accidentally committed plain-text database passwords into a public Git repository. The password was stored in a Kubernetes Secret manifest. What immediate remediation step should be taken regarding the Secret?

Accepted Answer

Rotate the credential in the underlying database, then update the Kubernetes Secret with the new value.. Once a credential is exposed in a public repository, it must be treated as compromised — the only safe remediation is to rotate the password in the database and update the Kubernetes Secret with the new value. Deleting or re-encoding the Secret does nothing because the old password remains valid in the database and is already in Git history.

Answer

Apply a DenyAll NetworkPolicy to the namespace.

Answer

Delete the Secret object and restart all cluster nodes.

Answer

Change the Secret manifest encoding from base64 to hex format.

Question 9

Your team is storing sensitive database credentials in Kubernetes Secrets. A security review reveals that base64 encoding does not provide encryption at rest. What mechanism should you enable to ensure Secrets are encrypted when stored in etcd?

Accepted Answer

Configure an EncryptionConfiguration file and reference it via the '--encryption-provider-config' flag on the kube-apiserver.. To encrypt Secrets at rest in etcd, you must configure an EncryptionConfiguration file and pass it to the kube-apiserver via the --encryption-provider-config flag. This enables encryption of resources like Secrets before they are stored in etcd.

Answer

Apply a MutatingWebhookConfiguration to automatically hash passwords using bcrypt.

Answer

Enable TLS encryption for all intra-cluster communication using kubeadm configuration.

Answer

Set the secret type to 'kubernetes.io/encrypted-secret'.

Question 10

A security engineer is configuring a service mesh using Istio to ensure that all east-west traffic between microservices is mutually authenticated and encrypted. Which custom resource must be configured with a STRICT mTLS mode to enforce this requirement cluster-wide?

Accepted Answer

PeerAuthentication. PeerAuthentication is the Istio custom resource used to configure mTLS settings for workloads. Setting its mTLS mode to STRICT enforces mutual TLS for all traffic to and from the selected workloads, ensuring east-west traffic is authenticated and encrypted.

Answer

EnvoyFilter

Answer

AuthorizationPolicy

Answer

DestinationRule

Question 11

An engineer is reviewing the threat model of a Kubernetes cluster exposed to the public internet via a LoadBalancer service. Which configuration flaw most commonly leads to unintended external exposure of administrative dashboards?

Accepted Answer

Exposing management dashboards via LoadBalancer or NodePort services without authentication or IP whitelisting. The most common cause of unintended external exposure of administrative dashboards (Kubernetes Dashboard, kube-state-metrics, Prometheus, Argo CD, etc.) is exposing them via a LoadBalancer or NodePort Service without authentication or IP whitelisting. This publishes the dashboard to the public internet, and if it lacks strong auth or has default credentials, attackers can reach it directly — this is the pattern behind many real-world Kubernetes breaches. The fix is to use ClusterIP with an authenticating ingress, or restrict access via IP allowlists and strong auth.

Answer

Configuring liveness probes with HTTP GET requests instead of TCP socket checks

Answer

Setting imagePullPolicy to IfNotPresent on production deployments

Answer

Using ClusterIP service types for internal database connectivity

Question 12

Which open-source auditing tool provides compliance scores and checks against Kubernetes security frameworks such as NSA-CISA and CIS?

Accepted Answer

Kubescape. Kubescape is an open-source Kubernetes security platform that scans clusters and manifests against frameworks like NSA-CISA, MITRE ATT&CK, and CIS Benchmarks, producing compliance scores and remediation guidance. It is specifically designed for Kubernetes posture management and is widely used in CNCF-aligned environments. The other options are Kubernetes components or networking tools, not auditing/compliance scanners.

Answer

Kube-dns

Answer

Metric-server

Answer

Cilium

Question 13

A security auditor discovers that anonymous authentication is accidentally enabled on the Kubernetes API server, allowing unauthenticated read access to cluster health endpoints. Which API server flag must be modified to disable anonymous requests?

Accepted Answer

--anonymous-auth=false. The --anonymous-auth flag on kube-apiserver controls whether unauthenticated requests are treated as anonymous users (system:anonymous). Setting --anonymous-auth=false rejects requests without valid credentials with a 401 Unauthorized response, closing the exposure of health/version endpoints to unauthenticated clients. This is the documented, supported way to disable anonymous access and is enforced by CIS Kubernetes Benchmark control 1.2.1.

Answer

--secure-port=0

Answer

--authorization-mode=AlwaysAllow

Answer

--disable-anonymous=true

Question 14

Which TWO types of selectors can be used within a Kubernetes NetworkPolicy ingress rule to specify allowed traffic sources?

Accepted Answer

namespaceSelector. In a Kubernetes NetworkPolicy ingress rule, the from field accepts three selector-based peer types: ipBlock, namespaceSelector, and podSelector. Option B (namespaceSelector) is correct because it selects entire namespaces by their labels, allowing traffic from all pods in matching namespaces (or, when combined with a podSelector in the same from element, only matching pods in matching namespaces). Option E (podSelector) is correct because it selects pods by their labels within the policy's own namespace, defining which pods may send traffic to the selected pods. Option A (serviceSelector) is incorrect because NetworkPolicy peers are never defined by Service; Services are not valid peer selectors in the API. Option C (ingressSelector) is incorrect because no such selector type exists in the NetworkPolicy spec. Option D (nodeSelector) is incorrect because NetworkPolicy operates at the pod/namespace/IP level and cannot select peers by node labels.

Answer

serviceSelector

Answer

ingressSelector

Answer

nodeSelector

Question 15

Which of the following best describes the principle of 'Defense-in-Depth' in cloud native security architectures?

Accepted Answer

Implementing multiple overlapping security controls across the 4Cs so that a single failure does not lead to compromise. Defense-in-Depth means layering multiple independent, overlapping security controls across the 4Cs (Cloud, Cluster, Container, Code) so that the failure of any single control does not result in full compromise. In cloud native terms this includes network policies, RBAC, Pod Security Admission, image scanning, mTLS, runtime detection, and secrets encryption — each compensating for gaps in the others.

Answer

Outsourcing all security responsibilities to the cloud provider

Answer

Ensuring every developer has cluster admin access for rapid debugging

Answer

Relying entirely on a strong perimeter firewall to block all malicious actors

Question 16

An administrator wants to audit who created or modified specific resources in the cluster. Where are API server audit records sent if configured with the log backend?

Accepted Answer

To the file path specified by --audit-log-path on the control plane host.. When the Kubernetes API server is configured with the log audit backend, audit records are written to the file path specified by the --audit-log-path flag on the control plane host. This is the default and most straightforward backend for audit logging, allowing administrators to review who did what and when. The log backend writes JSON-formatted audit events to that file, which can then be rotated and analyzed.

Answer

Directly to the etcd key-value store under /audit/logs.

Answer

To the container stdout of kube-proxy.

Answer

To the kubelet systemd journal on worker nodes.

Question 17

A security analyst reviews an incident where an attacker compromised a container running with the `CAP_SYS_ADMIN` capability and subsequently escaped to the host node. Which cloud native security principle was violated during the initial pod configuration?

Accepted Answer

Principle of least privilege. The principle of least privilege (B) was violated because the container was granted the `CAP_SYS_ADMIN` capability, which is a powerful capability that allows administrative operations. Containers should run with only the minimal capabilities required. Granting such a capability increases the risk of container escape and host compromise.

Answer

Zero-trust network architecture

Answer

Shared responsibility model

Answer

Ephemeral infrastructure design

Question 18

Which Kubernetes component manages the assignment of pending pods to healthy worker nodes based on resource availability and constraints?

Accepted Answer

kube-scheduler. kube-scheduler watches for newly created Pods that have no node assigned and selects a node for them to run on. It filters nodes through predicates (resource requests, taints/tolerations, node affinity, topology spread) and then scores the remaining candidates to pick the best fit. The result is written back to the API server as a binding.

Answer

kube-proxy

Answer

kube-apiserver

Answer

etcd

Question 19

You are configuring an Ingress object with TLS termination. The TLS certificate and private key are stored in a Kubernetes Secret. Which specific secret type must be used to ensure the ingress controller recognizes and validates the TLS credentials correctly?

Accepted Answer

kubernetes.io/tls. The kubernetes.io/tls secret type is specifically designed to hold a TLS certificate and its private key, with required keys 'tls.crt' and 'tls.key'. Ingress controllers look for this type to correctly load and validate the certificate for TLS termination.

Answer

kubernetes.io/service-account-token

Answer

Opaque

Answer

kubernetes.io/dockerconfigjson

Question 20

What is the primary function of the 'automountServiceAccountToken: false' setting in a Pod specification?

Accepted Answer

It prevents the ServiceAccount API token from being automatically mounted inside the pod.. The 'automountServiceAccountToken: false' setting in a Pod specification prevents the default ServiceAccount token from being automatically mounted into the pod's filesystem. This reduces the attack surface by ensuring the pod does not have credentials to access the Kubernetes API unless explicitly mounted. It does not delete the ServiceAccount, disable RBAC, or block all API communication.

Answer

It deletes the ServiceAccount object from the cluster when the pod terminates.

Answer

It prevents the pod from communicating with the Kubernetes API server entirely.

Answer

It disables RBAC authorization checks for the pod.