KCSA Practice Test 2 — 25 Questions

Question 1

You are performing a security review of etcd cluster membership. You need to list all active members of the etcd cluster and check their health status using the command line. Which etcdctl command is correct?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

etcdctl member list and etcdctl endpoint health. etcdctl member list and etcdctl endpoint health are the standard diagnostic commands for checking etcd cluster state.

Answer

etcdctl check membership

Answer

etcdctl cluster status

Answer

kubectl get etcdmembers

Question 2

An administrator needs to evaluate an existing Kubernetes cluster against the CIS Kubernetes Benchmark. Which tool provides automated scanning specifically tailored to this benchmark?

Accepted Answer

kube-bench. Kube-bench is an open-source tool that checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes Benchmark.

Answer

kube-hunter

Answer

falco

Answer

velero

Question 3

Where are static pods for a control plane node typically defined so that the kubelet can automatically create and manage them?

Accepted Answer

In the directory specified by staticPodPath in the kubelet configuration file (default /etc/kubernetes/manifests).. Static pods are defined by manifest files placed in the directory specified by the kubelet's --pod-manifest-path flag or staticPodPath configuration setting.

Answer

In the ~/.kube/config file of the root user.

Answer

In the etcd database under the /registry/staticpods prefix.

Answer

In the kube-system namespace as standard Deployment objects.

Question 4

Which Kubernetes control plane component is responsible for noticing and responding when nodes go down or fail health checks?

Accepted Answer

kube-controller-manager. The kube-controller-manager runs node lifecycle controllers that monitor node health and update node status.

Answer

CoreDNS

Answer

etcd

Answer

kube-proxy

Question 5

Which component is responsible for executing probes (liveness, readiness, startup) against containers running on a worker node?

Accepted Answer

kubelet. The kubelet executes liveness, readiness, and startup probes directly for containers on its node.

Answer

kube-scheduler

Answer

kube-controller-manager

Answer

kube-apiserver

Question 6

Which RBAC verb allows a user to delete an existing resource in a Kubernetes namespace?

Accepted Answer

delete. The 'delete' verb specifically authorizes removing resources.

Answer

remove

Answer

purge

Answer

destroy

Question 7

When configuring Pod Security Standards on a namespace, which THREE security restrictions are enforced by the 'restricted' profile that are NOT enforced by the 'baseline' profile? (Choose THREE)

Accepted Answer

Restricting volume types to a safe subset (e.g., configMap, secret, emptyDir).. The restricted profile adds requirements such as running as a non-root user, preventing escalation of privileges, and restricting allowed volume types.

Answer

Disallowing privileged containers.

Answer

Prohibiting hostPort usage entirely.

Question 8

Which TWO of the following statements are true regarding Kubernetes Secrets and their security posture by default?

Accepted Answer

Mounting a Secret as an environment variable can expose the secret value in container logs or crash dumps.. Kubernetes Secrets are base64 encoded (not encrypted) by default in etcd, and access to them can be controlled via RBAC.

Answer

Secrets are strongly encrypted at rest using AES-256 encryption by default in etcd.

Answer

Secrets automatically expire and rotate every 30 days unless explicitly disabled.

Answer

Secrets encoded in base64 provide cryptographic security comparable to robust symmetric encryption.

Question 9

Which CNCF project acts as a cloud-native runtime security and intrusion detection tool that monitors system calls against predefined security rules?

Accepted Answer

Falco. Falco is the CNCF incubating runtime security tool that acts as a security camera for containers, detecting anomalous behavior and policy violations.

Answer

Trivy

Answer

Fluentd

Answer

Cert-manager

Question 10

An auditor reviews container runtime configurations for compliance with NIST SP 800-190 recommendations on privilege escalation. Which Kubernetes feature controls whether a process can gain more privileges than its parent process?

Accepted Answer

allowPrivilegeEscalation: false. allowPrivilegeEscalation controls whether a process can gain more privileges through mechanisms like setuid binaries, fulfilling privilege restriction controls.

Answer

automountServiceAccountToken: false

Answer

runAsUser: 1000

Answer

privileged: false

Question 11

You are hardening etcd on a dedicated control plane host. You want to ensure that etcd database files on disk are protected against unauthorized physical or filesystem access. Which control mechanism is best suited for this?

Accepted Answer

Filesystem or block-level disk encryption (e.g., LUKS) on the host storage volume.. Operating system level disk encryption (such as LUKS) protects files at rest on block storage devices.

Answer

Kubernetes NetworkPolicies applied to the etcd Pod.

Answer

API server RBAC ClusterRoleBinding.

Answer

Kubelet read-only port disabling.

Question 12

Which TWO of the following methods can be used to authenticate users or systems against the Kubernetes API server? (Choose TWO)

Accepted Answer

X.509 client certificates validated by the API server CA.. OpenID Connect (OIDC) tokens and X.509 client certificates are standard native authentication methods for the API server.

Answer

Unencrypted HTTP basic auth files with default passwords.

Answer

Anonymous packet sniffing via kube-proxy.

Answer

Direct root SSH access to etcd nodes.

Question 13

A security team needs to ensure that Kubernetes nodes have secure file permissions for the kubelet configuration files, in alignment with CIS benchmarks. What should the file permissions on "/etc/kubernetes/kubelet.conf" typically be set to?

Accepted Answer

600. CIS benchmarks state that configuration files containing sensitive credentials, such as kubelet.conf, must have permissions set to 600 or stricter and be owned by root:root.

Answer

777

Answer

755

Answer

644

Question 14

Which protocol and default secure port does the kubelet use to listen for incoming authenticated requests from the API server and metrics collectors?

Accepted Answer

HTTPS on port 10250. The kubelet listens on TCP port 10250 for secure HTTPS traffic.

Answer

HTTPS on port 6443

Answer

TCP on port 2379

Answer

HTTP on port 10255

Question 15

Which TWO of the following are core security hardening best practices for the Kubernetes API server? (Choose TWO)

Accepted Answer

Ensure the insecure port (--insecure-port) is disabled or set to 0.. Disabling anonymous requests and enforcing strong TLS versions are essential API server hardening steps.

Answer

Configure the API server to use HTTP instead of HTTPS for performance.

Answer

Store all kubeconfig credentials in public ConfigMaps.

Answer

Grant cluster-admin permissions to all authenticated users by default.

Question 16

An organization requires compliance auditing of etcd access to ensure unauthorized clients cannot communicate with the data store. According to CIS benchmarks, how should etcd client communication be secured?

Accepted Answer

Mutual TLS (mTLS) client certificates. CIS benchmarks require etcd client communication to be authenticated and encrypted using mutual TLS (mTLS).

Answer

IPsec tunnel encapsulation

Answer

HTTP with token bearer headers

Answer

Plaintext loopback interface binding

Question 17

A security team is implementing Pod Security Standards (restricted, baseline, privileged) across namespaces. Which THREE controls are enforced under the Restricted Pod Security profile? (Choose THREE)

Accepted Answer

Requiring all capabilities to be dropped except NET_BIND_SERVICE or dropping all (capabilities.drop: [ALL]). The restricted profile enforces running as non-root, dropping capabilities, and preventing privilege escalation.

Answer

Allowing unrestricted use of the host network and host PID namespaces

Answer

Enabling privileged mode for all standard workloads

Question 18

A compliance team is adopting the NIST SP 800-190 standard to secure their container image pipeline. Which THREE practices are recommended in this framework for managing container images? (Choose THREE)

Accepted Answer

Employ trusted base images from verified publishers. NIST SP 800-190 recommends vulnerability scanning, cryptographic signing/provenance, and using trusted base images.

Answer

Store plaintext passwords directly inside Dockerfile ENV directives

Answer

Rely exclusively on public unverified base images to speed up development

Question 19

When configuring Role-Based Access Control (RBAC), which Kubernetes object grants permissions across the entire cluster rather than within a single namespace?

Accepted Answer

ClusterRole. A ClusterRole defines permissions across the entire cluster, and a ClusterRoleBinding applies them cluster-wide.

Answer

ServiceAccount

Answer

Role

Answer

PodSecurityPolicy

Question 20

An administrator wants to secure the communication channel between the Kubernetes API server and extension API servers (such as metrics-server). Which API server flag specifies the Certificate Authority used to verify extension API server certificates?

Accepted Answer

--requestheader-client-ca-file. The --requestheader-client-ca-file flag specifies the CA certificate used to sign client certificates for aggregated API servers.

Answer

--extension-ca-file

Answer

--etcd-ca-file

Answer

--proxy-client-cert-file