KCSA Practice Test 4 — 25 Questions

Question 1

Your security team has discovered that an application container image contains outdated packages with known remote code execution vulnerabilities. Which phase of the software development lifecycle is the most effective place to initially scan and remediate these vulnerabilities?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CI/CD pipeline build stage. Scanning in the CI/CD pipeline build stage catches vulnerable packages before the image is pushed to a registry or deployed, enabling remediation at the earliest point where the development team can act. This shifts security left, prevents vulnerable artifacts from propagating, and integrates with build gates that fail the pipeline on critical CVEs. Tools like Trivy, Clair, or Snyk run here.

Answer

Node OS package manager updates

Answer

Kubelet container startup phase

Answer

Kubernetes API server audit logging

Question 2

A security engineer wants to inspect container runtime logs for potential security violations or runtime errors. Which log file or mechanism on a worker node managed by systemd and containerd provides container lifecycle events?

Accepted Answer

journalctl -u containerd. On a worker node managed by systemd and containerd, container lifecycle events and runtime logs are captured by the containerd service. Using journalctl -u containerd retrieves these logs from the systemd journal, providing visibility into container start, stop, and errors. This is the correct mechanism for inspecting runtime logs at the node level.

Answer

kubectl get events --all-namespaces

Answer

/var/log/coredns.log

Answer

/var/log/kube-apiserver.log

Question 3

A security team is evaluating the attack surface of the Kubernetes control plane. They notice that the kubelet API port 10250 is accessible from the internal pod network without proper authorization checks if authentication defaults are misconfigured. What is the primary threat vector associated with an unauthenticated, accessible kubelet API?

Accepted Answer

Execution of arbitrary commands inside running containers via the kubelet exec and run endpoints. The kubelet exposes an HTTP API on port 10250 that includes endpoints such as /exec, /run, and /attach. If authentication is disabled (e.g., --anonymous-auth=true with no authorization), an attacker on the pod network can call these endpoints directly to execute arbitrary commands inside any container running on that node. This bypasses the API server entirely and grants code execution with the container's privileges, often leading to node compromise.

Answer

Direct modification of etcd key-value pairs stored on the master node

Answer

Bypassing container image vulnerability scanners running in the CI/CD pipeline

Answer

Forcing the API server to issue new root certificates via TLS bootstrapping

Question 4

An administrator wishes to inspect which admission controllers are currently enabled in a running Kubernetes cluster. Where is this typically configured in a stacked control plane?

Accepted Answer

In the kube-apiserver static pod manifest file under '/etc/kubernetes/manifests/kube-apiserver.yaml'.. In a kubeadm-provisioned stacked control plane, the kube-apiserver runs as a static pod, and its command-line flags — including --enable-admission-plugins and --disable-admission-plugins — are defined in /etc/kubernetes/manifests/kube-apiserver.yaml. Editing that manifest causes the kubelet to restart the apiserver pod with the new admission controller set.

Answer

In the CoreDNS deployment spec.

Answer

In the kubelet configuration file on each worker node.

Answer

In the cluster-wide ConfigMap named 'kube-system/cluster-admission'.

Question 5

Which Kubernetes control plane component runs controllers that handle routine tasks such as replicating pods and managing service accounts?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the control plane component that runs the built-in controllers — including the ReplicaSet controller (which maintains desired pod replica counts), the ServiceAccount controller (which creates default service accounts and tokens), and the Node, Endpoint, and Namespace controllers. It continuously reconciles observed cluster state with the desired state declared in the API server.

Answer

CoreDNS

Answer

etcd

Answer

kube-proxy

Question 6

You are troubleshooting a control plane failure where the Kubernetes API server cannot communicate with etcd because of expired client certificates. Which command-line flag on the kube-apiserver specifies the client TLS certificate used for authentication against etcd?

Accepted Answer

--etcd-certfile. The kube-apiserver flag --etcd-certfile specifies the client TLS certificate that the API server presents to etcd for mutual TLS authentication. When the API server connects to etcd, it must authenticate itself using a client certificate; this flag points to the PEM-encoded certificate file. Without it, the API server cannot establish a secure connection to etcd, leading to control plane failures. The correct flag is explicitly named for the etcd client certificate, not a generic client certificate.

Answer

--etcd-private-key

Answer

--client-cert-file

Answer

--etcd-ca-file

Question 7

An organization's security team mandates that all Kubernetes worker nodes must be scanned for Common Vulnerabilities and Exposures (CVEs) on a scheduled basis. Under the 4Cs, what layer does node vulnerability scanning address?

Accepted Answer

Cluster layer. Under the 4Cs (Cloud, Cluster, Container, Code), the cluster layer encompasses the control plane components, worker nodes, kubelet, container runtime, and node OS. Scanning worker nodes for CVEs addresses vulnerabilities in the node operating system, kernel, and installed packages — squarely a cluster-layer concern. This is distinct from scanning container images (container layer) or application source (code layer).

Answer

Container layer

Answer

Cloud layer

Answer

Code layer

Question 8

An administrator is designing a security posture for a microservices application deployed in a Kubernetes cluster. According to the 4Cs of Cloud Native Security, which component falls under the 'Code' layer?

Accepted Answer

Application dependency libraries in package.json. In the 4Cs of Cloud Native Security (Cloud, Cluster, Container, Code), the 'Code' layer refers to the application code and its dependencies. Application dependency libraries in package.json (B) are part of the code layer because they are directly included in the application's build and runtime. This layer focuses on securing the software supply chain and application logic.

Answer

Container base images like Alpine Linux

Answer

Kubernetes API server authorization policies

Answer

Cloud provider IAM roles

Question 9

A cluster administrator wants to mitigate supply chain risks stemming from vulnerable base images used by developers. Where in the software lifecycle should vulnerability scanning ideally be integrated first to shift-left security?

Accepted Answer

CI/CD pipeline build and image registry push stages. Shifting left means integrating security controls as early as possible in the software development lifecycle. Scanning base images during CI/CD build and at image registry push catches vulnerable packages before they are ever deployed to the cluster, allowing developers to remediate at the source. This is the earliest practical point where image vulnerabilities can be detected and blocked.

Answer

Manual inspection of etcd database backups

Answer

Configuring kube-dns forwarding rules to external resolvers

Answer

Setting up PersistentVolume backup retention policies

Question 10

Which THREE security controls can be enforced by admission webhook policy engines (like Kyverno or OPA Gatekeeper) regarding container images? (Choose three)

Accepted Answer

Verifying cryptographic image signatures using tools like Cosign. Admission webhook policy engines such as Kyverno and OPA Gatekeeper intercept Kubernetes API admission requests and can validate container image attributes before a workload is persisted. Option A is correct because policies can invoke signature verification (e.g., Cosign keyless or key-based attestations) and reject pods whose images lack a valid cryptographic signature. Option B is correct because these engines can enforce registry allow-lists, rejecting any image reference whose registry does not match the approved enterprise registries. Option E is correct because policies can query vulnerability scan results (e.g., from Trivy or Grype reports) and block deployment of images containing unmitigated high-severity CVEs. Option C is not applicable because admission webhooks only validate Kubernetes API objects; they cannot modify kernel modules on worker nodes. Option D is likewise outside their scope, since restarting unhealthy pods is a runtime remediation handled by controllers like the kubelet or ReplicaSet, not by an admission policy.

Answer

Automatically updating kernel modules on the underlying worker node

Answer

Manually restarting unhealthy pods across worker nodes

Question 11

Your team is implementing image caching and proxying to protect against external container registry rate limits and security incidents. Which upstream project acts as a CNCF-compliant registry proxy and caching mechanism?

Accepted Answer

Harbor. Harbor is a CNCF-graduated project that provides a container image registry with a built-in proxy cache. It can be configured to proxy and cache images from external registries like Docker Hub, mitigating rate limits and ensuring a local copy for security scanning. This makes it the correct answer for a CNCF-compliant registry proxy and caching mechanism.

Answer

Fluentd

Answer

Jaeger

Answer

Prometheus

Question 12

You have deployed a NetworkPolicy in a namespace that selects backend pods, defining an 'ingress' rule with a 'from' block. No other NetworkPolicies exist in the namespace. What is the default behavior for traffic from pods not matched by the 'from' selector?

Accepted Answer

All ingress traffic from unmatched pods is denied.. When a NetworkPolicy selects a pod and defines an ingress rule with a 'from' block, it becomes an allow-list for that pod's ingress traffic. Any traffic not explicitly allowed by the 'from' selector is denied by default. This is the fundamental behavior of Kubernetes NetworkPolicy: once a pod is selected by a policy, all traffic not matching the allowed rules is blocked.

Answer

All ingress traffic remains allowed by default.

Answer

The policy fails to apply because an egress rule must also be defined.

Answer

Only traffic from other namespaces is denied; same-namespace traffic is still allowed.

Question 13

An enterprise security auditor is reviewing Kubernetes API server admission control configurations for compliance. Which THREE admission plugins or mechanisms are critical for enforcing security policies at admission time? (Choose THREE)

Accepted Answer

ValidatingAdmissionWebhook. ValidatingAdmissionWebhook (A) is correct because it lets the API server call external webhook endpoints to validate requests against custom security policies before persistence, enabling enforcement of organization-specific compliance rules. PodSecurity (B) is correct because it enforces the Pod Security Standards (privileged, baseline, restricted) at the namespace level via admission, blocking pods that violate the configured security profile. NodeRestriction (D) is correct because it is an admission plugin that limits kubelet credentials so a node can only modify its own Node object and Pods bound to it, preventing a compromised node from escalating cluster-wide. InsecureServing (C) is not an admission plugin but a deprecated API server serving option for unauthenticated/insecure port access, and AlwaysAllow (E) is an authorization mode that permits all requests, so neither enforces security policy at admission time.

Answer

InsecureServing

Answer

AlwaysAllow

Question 14

A security engineer configures a ValidatingWebhookConfiguration to intercept pod creations. The webhook service goes down due to a network partition. What happens to incoming pod creation requests by default if the webhook 'failurePolicy' is set to 'Fail'?

Accepted Answer

The API server rejects the pod creation request with an error.. When a ValidatingWebhookConfiguration has failurePolicy: Fail, the API server treats a webhook call failure (timeout, connection refused, network partition) as a denial and rejects the admission request with an error. This is the safe default for security-critical webhooks because it prevents unvalidated resources from being admitted during an outage.

Answer

The kubelet automatically bypasses the webhook and starts the container locally.

Answer

The API server allows the pod creation request and logs a warning.

Answer

The API server queues the request until the webhook service recovers.

Question 15

An auditor notices that kubelet authentication is set to always allow anonymous access in a cluster configuration. According to the CIS Benchmark, what should the kubelet configuration parameter "authentication.anonymous.enabled" be set to?

Accepted Answer

false. The CIS Kubernetes Benchmark explicitly requires that anonymous authentication to the kubelet be disabled. Setting authentication.anonymous.enabled to false ensures that unauthenticated requests to the kubelet's HTTPS endpoint are rejected, forcing all clients to authenticate. This prevents unauthorized users or workloads from querying sensitive node information or executing commands via the kubelet API.

Answer

strict

Answer

auto

Answer

true

Question 16

An auditor reviews container runtime configurations for compliance with NIST SP 800-190 recommendations on privilege escalation. Which Kubernetes feature controls whether a process can gain more privileges than its parent process?

Accepted Answer

allowPrivilegeEscalation: false. allowPrivilegeEscalation: false is the Kubernetes SecurityContext field that directly controls whether a process can gain more privileges than its parent process, aligning with NIST SP 800-190 guidance on preventing privilege escalation. When set to false, it sets the kernel's no_new_privs flag on the container process, blocking setuid/setgid binaries and file capabilities from elevating privileges. This is the precise control the auditor is looking for.

Answer

automountServiceAccountToken: false

Answer

runAsUser: 1000

Answer

privileged: false

Question 17

A cluster operator is enforcing the Pod Security Standards "restricted" profile across a namespace. A developer attempts to deploy a container running as root (runAsUser: 0). What will happen during the admission phase?

Accepted Answer

The PodSecurity admission controller will reject the pod creation request.. The restricted Pod Security Standard requires containers to run as non-root, among other hardening measures. When a pod attempts to run as root (runAsUser: 0) in a namespace enforcing the restricted profile, the PodSecurity admission controller will reject the pod creation request during the admission phase. This prevents the pod from being created at all.

Answer

The pod will be created, but the kubelet will override the user ID to 65534 at runtime.

Answer

The pod will start successfully in audit mode, generating a warning event in the API server logs.

Answer

The container will drop all Linux capabilities and proceed with deployment.

Question 18

An application running in a pod needs to securely consume a database password without storing it in plaintext within the container image or deployment manifest. Which native Kubernetes resource is best suited for storing this sensitive key-value data?

Accepted Answer

Secret. A Kubernetes Secret is the native resource designed to hold sensitive key-value data such as passwords, tokens, and TLS keys, keeping them out of container images and manifests. Pods consume Secrets via environment variables or mounted volumes, and the API server stores them base64-encoded (with optional encryption at rest via EncryptionConfiguration). ConfigMaps are for non-sensitive configuration, so a database password belongs in a Secret.

Answer

PersistentVolumeClaim

Answer

ResourceQuota

Answer

ConfigMap

Question 19

You are auditing a cluster and find a pod that mounts the host's root filesystem directly into the container. Which Pod Security Standard rule does this violate?

Accepted Answer

It violates both baseline and restricted standards by using a hostPath volume.. Mounting the host's root filesystem via a hostPath volume violates both the baseline and restricted Pod Security Standards. The baseline standard prohibits hostPath volumes (except for a few specific, safe paths), and the restricted standard prohibits them entirely. Therefore, this pod violates both.

Answer

It is permitted under all standards provided the container runs as a non-root user.

Answer

It is fully compliant with the restricted standard as long as 'readOnly: true' is set.

Answer

It only violates the restricted standard; baseline permits hostPath mounts.

Question 20

Which TWO mechanisms are used by Kubernetes admission controllers to enforce security policies during the API request lifecycle?

Accepted Answer

Validating admission webhooks can reject object definitions that violate security standards.. Validating admission webhooks (A) are invoked during the admission phase of the API request lifecycle and can evaluate an object against security policies, returning a denial that causes the API server to reject the request, which is exactly how policies such as Pod Security Standards or custom constraints are enforced. Mutating admission webhooks (D) run before validating webhooks and can modify the incoming request payload, for example injecting a securityContext, defaulting runAsNonRoot, or applying seccomp/AppArmor profiles so that objects comply with security defaults before persistence. The remaining options are incorrect: kubelet (B) pulls and runs containers on nodes but does not perform image security audits as an admission mechanism, etcd (C) is only a key-value store and does not execute validation scripts or strip RBAC rules, and kube-proxy (E) implements Service load balancing at Layers 3/4 and never inspects Layer 7 API payloads.

Answer

kubelet automatically runs security audits on all container images prior to pull.

Answer

etcd executes consensus validation scripts to strip unauthorized RBAC rules.

Answer

kube-proxy inspects network payloads at Layer 7 to block unauthorized API requests.