KCSA Practice Test 3 — 25 Questions

Question 1

By default, how are Kubernetes Secrets stored in etcd when created without additional encryption-at-rest configurations?

Accepted Answer

Encoded in Base64 plaintext. By default, Kubernetes Secrets are stored encoded in Base64 plaintext within etcd, meaning anyone with etcd access can decode them.

Answer

Hashed using SHA-256 with a random salt

Answer

Encrypted using the node's TPM chip

Answer

Encrypted using AES-256 automatically

Question 2

An administrator wants to ensure that no container in a specific namespace runs with a root User ID (UID 0). Which security context setting should be enforced?

Accepted Answer

runAsNonRoot: true. Setting 'runAsNonRoot: true' in the security context forces the container runtime to reject containers that attempt to run as UID 0.

Answer

privileged: false

Answer

readOnlyRootFilesystem: true

Answer

allowPrivilegeEscalation: false

Question 3

Which TWO of the following API server configuration flags help enforce cryptographic and transport security? (Choose TWO)

Accepted Answer

--tls-cipher-suites to specify permitted strong cryptographic cipher suites.. --tls-min-version and --tls-cipher-suites enforce transport security standards.

Answer

--anonymous-auth to enable unauthenticated cluster access.

Answer

--insecure-port to allow unencrypted HTTP traffic.

Answer

--enable-http2=false to disable secure multiplexing.

Question 4

Under the Pod Security Standards, a developer attempts to deploy a pod with 'privileged: true' in a namespace labeled with 'pod-security.kubernetes.io/enforce=baseline'. What will happen?

Accepted Answer

The admission controller will reject the pod creation request with an error.. The 'baseline' profile prohibits privileged containers. The admission controller will reject the pod creation request.

Answer

The pod will run in a restricted sandbox environment automatically.

Answer

The pod will be created successfully, but a warning will be logged in the audit log.

Answer

The kubelet will automatically strip the 'privileged: true' setting and run the pod safely.

Question 5

You are deploying a ValidatingWebhookConfiguration to inspect incoming pod creations. What happens if the webhook fails and the 'failurePolicy' in the webhook configuration is set to 'Fail'?

Accepted Answer

The API request is rejected.. When failurePolicy is set to 'Fail', any error or timeout reaching the external webhook causes the API server to reject the API request.

Answer

The API request is allowed to proceed without validation.

Answer

The pod is created in a suspended state until the webhook recovers.

Answer

The kube-apiserver restarts automatically.

Question 6

You are reviewing admission webhook configurations and notice that timeoutSeconds is set to 3 seconds for a critical validation webhook. If the webhook server takes 4 seconds to respond, what does the API server do when failurePolicy is 'Ignore'?

Accepted Answer

It allows the API request to proceed as if the webhook succeeded.. When failurePolicy is 'Ignore', a timeout or error reaching the webhook results in the API server ignoring the failure and allowing the request to proceed.

Answer

It quarantines the pod in a Pending state.

Answer

It rejects the API request immediately.

Answer

It retries the webhook request indefinitely until it responds.

Question 7

An application pod requires access to the Kubernetes API to list other pods. To follow secure practices, you create a dedicated ServiceAccount and bind a custom Role to it. How should you configure the Pod specification to prevent the default service account token from being automatically mounted?

Accepted Answer

Set 'automountServiceAccountToken: false' in the Pod specification.. Setting 'automountServiceAccountToken: false' on either the ServiceAccount or the Pod specification prevents the automatic mounting of the token, reducing the blast radius if compromised.

Answer

Delete the 'default' ServiceAccount in the namespace.

Answer

Configure the Pod securityContext with 'readOnlyRootFilesystem: true'.

Answer

Add a deny NetworkPolicy blocking egress to the Kubernetes API service IP.

Question 8

An application pod needs to mount a Secret as environment variables. Which section of the Pod manifest should be configured to achieve this securely?

Accepted Answer

Using 'env' with 'valueFrom.secretKeyRef' or 'envFrom' with 'secretRef' in the container specification.. Environment variables can be populated from Secrets using 'envFrom' or 'env' with 'valueFrom.secretKeyRef'.

Answer

Using 'volumeMounts' pointing to a PersistentVolumeClaim bound to the Secret.

Answer

Adding the Secret name directly to the container imagePullSecrets field.

Answer

Declaring the Secret in the container securityContext block.

Question 9

Which THREE components are involved when an external client authenticates to the Kubernetes API server using OpenID Connect (OIDC)? (Choose THREE)

Accepted Answer

The OIDC Identity Provider (IdP) issuing ID tokens.. OIDC authentication involves the client (e.g. kubectl), the OIDC identity provider, and the kube-apiserver.

Answer

The CoreDNS server resolving the OIDC provider domain.

Answer

The Kubelet running on worker nodes.

Question 10

An administrator wants to audit who created or modified specific resources in the cluster. Where are API server audit records sent if configured with the log backend?

Accepted Answer

To the file path specified by --audit-log-path on the control plane host.. When using the log audit backend, audit records are written to a file path specified by --audit-log-path.

Answer

Directly to the etcd key-value store under /audit/logs.

Answer

To the container stdout of kube-proxy.

Answer

To the kubelet systemd journal on worker nodes.

Question 11

Which THREE of the following are official Pod Security Standard enforcement levels recognized by Kubernetes?

Accepted Answer

baseline. The three official levels defined by Kubernetes Pod Security Standards are privileged, baseline, and restricted.

Answer

isolated

Answer

secure

Question 12

Which TWO statements are true regarding Kubernetes NetworkPolicy default behaviors?

Accepted Answer

By default, all pods in a cluster are non-isolated and accept traffic from any source.. By default, pods are non-isolated (all traffic allowed). When a NetworkPolicy selects pods and specifies ingress/egress, those specific directions become deny-by-default.

Answer

NetworkPolicies automatically block all traffic across all namespaces upon cluster installation.

Answer

Egress traffic is blocked by default even if no NetworkPolicy is created.

Answer

NetworkPolicies apply to cluster nodes rather than individual pods.

Question 13

A cluster operator is enforcing the Pod Security Standards "restricted" profile across a namespace. A developer attempts to deploy a container running as root (runAsUser: 0). What will happen during the admission phase?

Accepted Answer

The PodSecurity admission controller will reject the pod creation request.. The restricted Pod Security Standard explicitly prohibits containers from running as root and enforces a non-root user. The request will be rejected by the Pod Security admission controller.

Answer

The pod will be created, but the kubelet will override the user ID to 65534 at runtime.

Answer

The pod will start successfully in audit mode, generating a warning event in the API server logs.

Answer

The container will drop all Linux capabilities and proceed with deployment.

Question 14

Which TWO of the following mechanisms help secure the kubelet API from unauthorized access and container inspection? (Choose TWO)

Accepted Answer

Enabling Webhook authorization mode so kubelet requests are validated against API server RBAC.. Setting authorization mode to Webhook and disabling anonymous access protect the kubelet API.

Answer

Removing all TLS certificates from the kubelet configuration.

Answer

Setting kubelet authorization mode to AlwaysAllow.

Answer

Enabling the kubelet read-only port 10255.

Question 15

Which TWO of the following scenarios represent severe security misconfigurations in a Kubernetes cluster control plane? (Choose TWO)

Accepted Answer

The API server is configured with --insecure-port pointing to an active HTTP listener.. Exposing the API server insecure port and allowing anonymous authentication are severe misconfigurations.

Answer

Etcd is configured with client certificate authentication and mTLS enabled.

Answer

Kubelet authorization mode is set to Webhook.

Answer

Secrets are encrypted at rest using an EncryptionConfiguration file.

Question 16

An administrator needs to grant read-only access to Pods specifically within the 'development' namespace to a new user. Which RBAC configuration correctly scopes this permission?

Accepted Answer

Create a Role for Pod read access in the 'development' namespace and bind it to the user using a RoleBinding in the same namespace.. A Role must be used instead of a ClusterRole when scoping permissions to a single namespace. The Role must be bound via a RoleBinding within that same namespace.

Answer

Create a ClusterRole for Pod read access and bind it to the user using a RoleBinding in the 'development' namespace.

Answer

Annotate the user's ServiceAccount with namespace read permissions.

Answer

Create a Role for Pod read access and bind it globally using a ClusterRoleBinding.

Question 17

An application running in a pod needs to securely consume a database password without storing it in plaintext within the container image or deployment manifest. Which native Kubernetes resource is best suited for storing this sensitive key-value data?

Accepted Answer

Secret. Kubernetes Secrets are designed specifically to store and manage sensitive information such as passwords, OAuth tokens, and ssh keys.

Answer

PersistentVolumeClaim

Answer

ResourceQuota

Answer

ConfigMap

Question 18

Which TWO components are involved in configuring and processing admission webhooks in a Kubernetes cluster?

Accepted Answer

kube-apiserver. Admission webhooks are configured via MutatingWebhookConfiguration or ValidatingWebhookConfiguration objects, and processed by the kube-apiserver.

Answer

kube-proxy

Answer

kubelet

Answer

etcd daemon

Question 19

An application pod needs to access the Kubernetes API server securely. How does Kubernetes authenticate the pod by default when it communicates with the API server?

Accepted Answer

Using a ServiceAccount bearer token mounted inside the pod's filesystem.. Kubernetes automatically mounts a ServiceAccount token into the pod's filesystem, which the pod sends as a Bearer token to authenticate with the API server.

Answer

Using static username and password credentials stored in environment variables.

Answer

Using mutual TLS (mTLS) client certificates generated by the kubelet on startup.

Answer

Using SSH keys stored in the pod's root directory.

Question 20

An administrator wants to prevent users from creating pods that mount the host network ('hostNetwork: true'). Which tool or feature is best suited to enforce this restriction natively across the cluster?

Accepted Answer

Pod Security admission controller with baseline or restricted profile. The Pod Security admission controller's 'restricted' or 'baseline' profile automatically blocks pods that set 'hostNetwork: true'.

Answer

ResourceQuota limiting network interfaces

Answer

RBAC ClusterRole restricting pod creation

Answer

NetworkPolicy with a deny-all rule