KCSA Practice Test 3 — 25 Questions

Question 1

An attacker manages to compromise a low-privilege pod inside a Kubernetes cluster and attempts to escalate privileges or pivot to other cluster components. Which THREE of the following misconfigurations or weaknesses would significantly aid the attacker's lateral movement or privilege escalation? (Choose THREE)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The pod's ServiceAccount has a ClusterRoleBinding granting cluster-admin permissions.. Option C is correct because a ClusterRoleBinding that binds the pod's ServiceAccount to the cluster-admin ClusterRole grants that pod full, unrestricted permissions across every namespace and resource in the cluster, so a compromised pod can immediately read secrets, create privileged workloads, and take over the control plane. Option D is correct because hostNetwork: true places the pod in the node's network namespace, letting the attacker sniff node-level traffic (including kubelet, API server, and other pods' unencrypted communications) and reach services bound to the node's interfaces, which materially aids lateral movement. Option E is correct because if the instance metadata service (169.254.169.254) is reachable without IMDSv2 session-token enforcement, a compromised pod can retrieve the node's IAM credentials and use them against the cloud API, pivoting from the cluster into the underlying cloud infrastructure. Option A does not belong because KMS-backed etcd encryption at rest protects data on disk and does nothing to help an attacker already executing inside a pod. Option B does not belong because the Restricted Pod Security Standard blocks privileged settings such as hostNetwork and hostPath, so it actually hinders rather than aids escalation.

Answer

Etcd is encrypted at rest using a customer-managed KMS encryption provider.

Answer

The cluster uses a properly configured PodSecurityStandard of Restricted across all namespaces.

Question 2

Which component provides network routing and iptables/IPVS rule management across worker nodes for Kubernetes Services?

Accepted Answer

kube-proxy. kube-proxy runs on every node and is responsible for programming iptables (or IPVS, or nftables in newer versions) rules that implement Kubernetes Service virtual IPs and load balancing to backend pods. It watches the API server for Service and EndpointSlice objects and translates them into node-local dataplane rules. Without kube-proxy (or a replacement like Cilium's kube-proxy replacement), ClusterIP and NodePort services would not function.

Answer

kube-scheduler

Answer

kube-apiserver

Answer

etcd

Question 3

A security team discovers that an application container running as root has successfully mounted the host's Docker socket (`/var/run/docker.sock`). What is the primary attack vector enabled by this misconfiguration?

Accepted Answer

Container escape and full node takeover by orchestrating new sibling containers with host mounts. Mounting the host's Docker socket into a container gives that container full control over the Docker daemon, which runs as root on the host. An attacker can use the Docker API to start a new privileged container with the host filesystem mounted (e.g., -v /:/host), then chroot into it to gain root on the node — a classic container escape. This is the primary attack vector: full node takeover, and potentially lateral movement to other nodes via the cluster network or credentials.

Answer

Bypassing Kubernetes NetworkPolicies across different worker nodes

Answer

Direct modification of the etcd database state via local unix socket tunneling

Answer

Automatic escalation of RBAC roles assigned to the API server

Question 4

Which TWO actions are core tenets of the "Shift-Left" security philosophy in cloud-native compliance? (Choose TWO)

Accepted Answer

Scanning infrastructure-as-code (IaC) templates for misconfigurations before deployment. Option B is correct because Shift-Left security means identifying misconfigurations in infrastructure-as-code (IaC) templates such as Terraform, CloudFormation, or Kubernetes manifests during development, before any resources are provisioned, so issues are caught early when they are cheapest and safest to fix. Option D is correct because embedding vulnerability scanning (for example SAST, SCA, or container image scanning) directly into the CI/CD pipeline enforces automated security gates on every commit or build, which is the operational core of shifting security left into the development lifecycle. Option A is wrong because disabling automated security tooling removes the very guardrails Shift-Left depends on and increases risk rather than reducing it. Option C is wrong because auditing only after a production breach is a reactive, right-side-of-development approach, the opposite of Shift-Left. Option E is wrong because relying solely on manual post-release code reviews is late, non-automated, and does not prevent defects from reaching production.

Answer

Disabling all automated security tooling to speed up commits

Answer

Waiting until a production breach occurs to audit logs

Answer

Relying entirely on manual code reviews post-release

Question 5

An attacker with read access to Kubernetes Secrets inspects a secret containing TLS private keys. Under the STRIDE threat model, what specific threat category does this represent regarding confidentiality?

Accepted Answer

Information Disclosure. Information Disclosure is the STRIDE category that covers unauthorized access to confidential data, such as an attacker reading TLS private keys from a Kubernetes Secret. Since the attacker has read access to the secret, the confidentiality of the private keys is compromised, which is precisely Information Disclosure. This threat directly maps to the confidentiality pillar of security.

Answer

Denial of Service

Answer

Elevation of Privilege

Answer

Repudiation

Question 6

Which THREE of the following actions can compromise the security of the Kubernetes control plane if left unmitigated? (Choose THREE)

Accepted Answer

Granting wildcard cluster-admin permissions to untrusted service accounts.. Option A is correct because binding a service account to a ClusterRole with wildcard verbs/resources (e.g., via ClusterRoleBinding to cluster-admin) lets any pod using that account read secrets, create privileged workloads, and effectively take over the control plane. Option B is correct because enabling anonymous authentication (--anonymous-auth=true) on the API server or kubelet allows unauthenticated requests to reach endpoints, and combined with permissive authorization it exposes cluster data and node operations to anyone who can reach the port. Option E is correct because the API server's insecure port (--insecure-port) serves requests over plain HTTP with no authentication or authorization, so any network-reachable client can issue privileged API calls. Option C is not a compromise: Webhook authorization mode delegates decisions to the API server's SubjectAccessReview, which is the recommended secure mode for kubelet. Option D is not a compromise: encrypting etcd at rest with a valid key protects secret data and is a security best practice, not a risk.

Answer

Configuring kubelet authorization mode to Webhook.

Answer

Enabling etcd encryption at rest with a valid key.

Question 7

When designing a defense-in-depth strategy across the 4Cs, which THREE independent security controls can be applied at different layers? (Choose THREE)

Accepted Answer

Container image signing with Cosign and admission verification for Container. Option B is correct because container image signing with Cosign plus an admission controller that verifies signatures enforces supply-chain integrity at the Container layer, ensuring only trusted, unmodified images are admitted to the cluster. Option C is correct because Kubernetes NetworkPolicies provide Cluster-layer microsegmentation, restricting pod-to-pod traffic to explicitly allowed flows and limiting lateral movement if a workload is compromised. Option E is correct because SAST scanning in the CI/CD pipeline addresses the Code layer, detecting insecure code patterns and vulnerabilities before artifacts are built or deployed. Option A is not a valid independent control since relying solely on a cloud provider's default network security group creates a single point of failure and violates defense-in-depth. Option D is not a security control at all; granting all developers cluster-admin permissions violates least privilege and dramatically expands the attack surface.

Answer

Relying solely on the cloud provider's default network security group for all protection

Answer

Granting all developers cluster-admin permissions for operational speed

Question 8

An attacker who achieves remote code execution inside a misconfigured container discovers that the service account token mounted at /var/run/secrets/kubernetes.io/serviceaccount/token has cluster-wide administrative permissions. Which Kubernetes security feature should be enabled on the ServiceAccount to mitigate the risk of token theft and misuse?

Accepted Answer

Disabling automatic token mounting (automountServiceAccountToken: false) and utilizing projected volumes with bound audiences. Disabling automountServiceAccountToken and using projected volumes with bound audiences limits the blast radius of token theft because the token is only issued when explicitly requested and is scoped to a specific audience and expiry. This prevents an attacker with RCE from finding a long-lived, cluster-admin token automatically mounted in the pod filesystem. Projected tokens are also time-bound and rotated, so stolen tokens expire quickly.

Answer

Configuring a default Deny-All NetworkPolicy for the kube-system namespace

Answer

Enabling the NodeRestriction admission plugin

Answer

EnablingAnonymousAuth on the kube-apiserver

Question 9

What is the primary security benefit of using immutable container base distroless images?

Accepted Answer

They eliminate unnecessary shells and package managers, drastically reducing the attack surface.. Distroless images contain only the application and its runtime dependencies, omitting package managers, shells, and other utilities. This drastically reduces the attack surface because attackers cannot easily execute shell commands, install tools, or exploit vulnerabilities in unnecessary packages. The primary security benefit is the minimized attack surface.

Answer

They prevent the API server from restarting during control plane upgrades.

Answer

They automatically encrypt persistent storage volumes attached to the pod.

Answer

They configure automatic mTLS between all pods in the cluster via CNI.

Question 10

Which THREE advanced container runtime or image security features help prevent container breakout exploits? (Choose three)

Accepted Answer

Using sandboxed container runtimes (such as Kata Containers or gVisor) for strong isolation. Option A is correct because sandboxed runtimes such as Kata Containers and gVisor insert a lightweight VM or user-space kernel boundary between the container and the host kernel, so a kernel exploit inside the container does not directly compromise the host. Option D is correct because restrictive Seccomp profiles filter the syscall table and block sensitive calls (for example, ptrace, mount, or unshare) that container breakout exploits rely on to escape isolation. Option E is correct because dropping dangerous Linux capabilities such as CAP_SYS_ADMIN, CAP_NET_RAW, and CAP_SYS_PTRACE removes the privileges needed to mount filesystems, craft raw packets, or inject into host processes, which are common breakout primitives. Option B is wrong because privileged mode disables isolation and grants all capabilities plus host device access, dramatically increasing breakout risk. Option C is wrong because mounting host /proc and /sys read-write exposes host kernel and process information and allows tampering, which weakens rather than strengthens isolation.

Answer

Running all containers in privileged mode

Answer

Mounting host /proc and /sys directories in read-write mode

Question 11

A security engineer is designing a defense-in-depth strategy for a cloud native application deployment. Which of the following best exemplifies the 'defense-in-depth' principle across the 4Cs layers?

Accepted Answer

Implementing security controls at every layer from Code to Cloud so that a compromise at one layer does not result in total system failure.. Defense-in-depth across the 4Cs means implementing security controls at every layer — Cloud, Cluster, Container, and Code — so that a compromise at one layer does not cascade into total system failure. This layered approach ensures no single point of failure exists in the security posture.

Answer

Granting cluster-admin permissions to all developers to ensure rapid troubleshooting.

Answer

Disabling authentication mechanisms to reduce operational overhead.

Answer

Applying strong firewall rules only at the perimeter of the corporate network.

Question 12

A security analyst wants to scan container images for known Common Vulnerabilities and Exposures (CVEs) as part of a continuous compliance pipeline. Which tool is widely used for this purpose?

Accepted Answer

Trivy. Trivy is an open-source vulnerability scanner for container images, filesystems, and Git repositories. It detects known CVEs in OS packages and application dependencies, making it ideal for continuous compliance pipelines.

Answer

Envoy

Answer

CoreDNS

Answer

Calico

Question 13

Which service account permission model is used by default when a pod is created without specifying a service account name?

Accepted Answer

The 'default' service account in the pod's namespace.. When a pod is created without specifying a serviceAccountName, Kubernetes automatically assigns the 'default' service account from the pod's namespace. This is a built-in behavior: every namespace has a 'default' ServiceAccount created automatically, and the admission controller injects it if none is specified. This default account typically has no extra permissions beyond basic API discovery, but it still exists and can be used for identity.

Answer

No service account is assigned.

Answer

The 'cluster-admin' service account.

Answer

The 'kube-system' privileged service account.

Question 14

Which Kubernetes control plane component is responsible for noticing and responding when nodes go down or fail health checks?

Accepted Answer

kube-controller-manager. The kube-controller-manager runs the node controller, which monitors node health via heartbeats and marks nodes NotReady or unreachable when they fail health checks, then triggers eviction of pods after the toleration period. It is the control plane component responsible for responding to node failures.

Answer

CoreDNS

Answer

etcd

Answer

kube-proxy

Question 15

An administrator wants to ensure that no container in a specific namespace runs with a root User ID (UID 0). Which security context setting should be enforced?

Accepted Answer

runAsNonRoot: true. The runAsNonRoot: true security context setting instructs the kubelet to validate at container start that the image's USER is not UID 0, and to refuse to start the container if it would run as root. Setting it at the pod or container level enforces the no-root requirement across the namespace when combined with Pod Security Admission's restricted profile.

Answer

privileged: false

Answer

readOnlyRootFilesystem: true

Answer

allowPrivilegeEscalation: false

Question 16

Which component is responsible for executing probes (liveness, readiness, startup) against containers running on a worker node?

Accepted Answer

kubelet. The kubelet is the node agent that runs on every worker node and is responsible for managing Pod lifecycle on that node. It receives PodSpecs from the API server and executes the actual container runtime operations, including running liveness, readiness, and startup probes against containers via the container runtime interface (CRI). The kubelet interprets probe definitions (httpGet, tcpSocket, exec, grpc) and periodically executes them, taking action such as restarting containers on liveness failure or removing Pods from Service endpoints on readiness failure.

Answer

kube-scheduler

Answer

kube-controller-manager

Answer

kube-apiserver

Question 17

An administrator needs to grant read-only access to Pods specifically within the 'development' namespace to a new user. Which RBAC configuration correctly scopes this permission?

Accepted Answer

Create a Role for Pod read access in the 'development' namespace and bind it to the user using a RoleBinding in the same namespace.. To grant read-only access to Pods within a specific namespace, you create a Role in that namespace with the necessary permissions and bind it to the user using a RoleBinding in the same namespace. This scopes the permission to the 'development' namespace only, following the principle of least privilege.

Answer

Create a ClusterRole for Pod read access and bind it to the user using a RoleBinding in the 'development' namespace.

Answer

Annotate the user's ServiceAccount with namespace read permissions.

Answer

Create a Role for Pod read access and bind it globally using a ClusterRoleBinding.

Question 18

An administrator needs to evaluate an existing Kubernetes cluster against the CIS Kubernetes Benchmark. Which tool provides automated scanning specifically tailored to this benchmark?

Accepted Answer

kube-bench. kube-bench is an open-source tool from Aqua Security that runs automated checks directly against the CIS Kubernetes Benchmark, inspecting control plane components, kubelet configuration, and node settings. It reports PASS/FAIL/WARN results mapped to specific CIS controls, making it the purpose-built tool for benchmark evaluation.

Answer

kube-hunter

Answer

falco

Answer

velero

Question 19

An organization requires that all container images pulled into a Kubernetes cluster are cryptographically signed and verified before execution. Which tool integrates with Kubernetes admission control to enforce signature verification using Cosign?

Accepted Answer

Kyverno policy engine. Kyverno is a Kubernetes-native policy engine that runs as a dynamic admission controller and can validate, mutate, and generate resources. It supports verifying Cosign signatures on container images via its verifyImages rule, rejecting any pod whose image lacks a valid signature from a trusted key or keyless identity. This makes it the correct tool for enforcing cryptographic image verification at admission time.

Answer

Cilium CNI plugin

Answer

Metrics-server

Answer

Helm package manager

Question 20

In a cloud native environment, what is the primary security purpose of using static code analysis (SAST) and software composition analysis (SCA) tools in the CI/CD pipeline?

Accepted Answer

To identify vulnerabilities and insecure coding patterns in the Code layer before deployment. SAST tools analyze source code for insecure coding patterns such as SQL injection or hardcoded secrets, while SCA tools identify vulnerable open-source dependencies and their licenses. Both operate on the Code layer of the CI/CD pipeline, catching issues before deployment, which is far cheaper than remediating in production.

Answer

To provision cloud networking security groups automatically

Answer

To manage worker node operating system updates

Answer

To detect running process anomalies in production pods