KCSA Practice Test 5 — 25 Questions

Question 1

You are securing a highly regulated Kubernetes cluster and need to ensure that etcd data is encrypted at rest using a custom encryption key. After creating the EncryptionConfiguration file, which API server flag must be updated to point to this file?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

--encryption-provider-config. The kube-apiserver flag --encryption-provider-config is the correct flag that points the API server to the EncryptionConfiguration YAML file defining the encryption providers (e.g., aescbc, kms) and their keys. Without this flag, the API server ignores the file entirely and etcd data remains unencrypted at rest. The flag was introduced with the EncryptionConfiguration API (stable since Kubernetes 1.13) and is required alongside the file itself for encryption to take effect.

Answer

--data-encryption-secret

Answer

--encryption-config-path

Answer

--etcd-key-file

Question 2

A compliance officer wants to continuously audit Kubernetes resource manifests for misconfigurations against security best practices before they are applied. Which tool type is best suited for this shift-left compliance approach?

Accepted Answer

Static code analysis and admission controllers. Static code analysis tools (e.g., kube-score, Checkov, kube-linter) scan YAML manifests in CI/CD pipelines to catch misconfigurations like missing resource limits or privileged containers before deployment. Admission controllers (e.g., OPA Gatekeeper, Kyverno) enforce policies at the API server level, rejecting non-compliant resources at admission time. Together, they provide continuous, shift-left auditing that prevents misconfigured workloads from ever reaching the cluster.

Answer

Log shippers

Answer

Packet analyzers

Answer

Kernel debuggers

Question 3

Which TWO practices are essential for securing container images against supply chain vulnerabilities? (Choose two)

Accepted Answer

Using minimal base images (e.g., Distroless or Alpine) to reduce attack surface. Option D is correct because using minimal base images such as Distroless or Alpine reduces the number of installed packages, libraries, and utilities, which directly shrinks the attack surface and lowers the chance that a vulnerable component is present in the image. Option E is correct because scanning container images for known CVEs during the CI/CD pipeline catches vulnerable dependencies and OS packages before deployment, enabling remediation or blocking of the build. Option A is wrong because running container processes as root by default violates least privilege and increases the impact of a container compromise. Option B is wrong because disabling container registry authentication exposes images to unauthorized pulls and tampering. Option C is wrong because storing plain-text passwords in image environment variables leaks secrets to anyone who can inspect the image or container metadata.

Answer

Running all container processes as the root user by default

Answer

Disabling container registry authentication

Answer

Storing plain-text passwords inside image environment variables

Question 4

An organization uses AWS IAM to restrict access to their EKS cluster control plane endpoints. According to the shared responsibility model, configuring and maintaining these access entries and cluster RBAC roles is the responsibility of whom?

Accepted Answer

The customer. Under the AWS shared responsibility model, AWS is responsible for security 'of' the cloud (the infrastructure), while the customer is responsible for security 'in' the cloud. For EKS, the control plane infrastructure is managed by AWS, but configuring IAM access entries and Kubernetes RBAC roles that govern who can access the cluster is a customer responsibility.

Answer

The Linux kernel maintainers

Answer

The cloud provider only

Answer

The CNCF security committee

Question 5

An auditor notices that a secret is mounted as a volume in a pod. Where is this secret stored on the worker node filesystem by default?

Accepted Answer

In tmpfs (memory), ensuring it is not written to non-volatile disk storage.. When a secret is mounted as a volume in a pod, the kubelet writes the secret data to a tmpfs (memory-backed) filesystem on the worker node. This ensures the secret is not persisted to non-volatile disk storage by default, reducing the risk of forensic recovery from node disks. The files exist only in RAM and are removed when the pod is deleted.

Answer

In an encrypted SQLite database on the node's root partition.

Answer

In plaintext files inside /etc/kubernetes/secrets on the node's hard drive.

Answer

Inside the container image layer cache.

Question 6

Which THREE of the following mechanisms are essential for securing the Kubernetes control plane against unauthorized access and privilege escalation?

Accepted Answer

Enforcing robust Role-Based Access Control (RBAC) with least privilege principles. Option A is correct because robust RBAC with least-privilege principles ensures that users, service accounts, and controllers only receive the exact permissions they need, preventing unauthorized access and privilege escalation within the cluster. Option B is correct because requiring mutual TLS (mTLS) for all internal API server and component communications authenticates both ends of every connection, protecting against man-in-the-middle attacks, spoofing, and unauthorized components joining the control plane. Option D is correct because enabling encryption at rest for sensitive data stored in etcd protects secrets, tokens, and configuration from being read directly from the backing datastore if it is compromised. Option C is incorrect because mutable `:latest` image tags make deployments non-deterministic and can silently pull vulnerable or malicious images, weakening rather than strengthening control plane security. Option E is incorrect because setting `allowPrivilegeEscalation: true` explicitly permits containers to gain more privileges than their parent process, which directly enables privilege escalation and should be set to false.

Answer

Using mutable `:latest` image tags for all control plane system components

Answer

Setting `allowPrivilegeEscalation: true` across all default container security contexts

Question 7

An enterprise is conducting a security review of their container build and deployment pipeline. Which TWO security controls should they implement to secure the Container layer? (Choose TWO)

Accepted Answer

Scanning container images for known CVEs before deployment. Option A is correct because scanning container images for known CVEs before deployment (e.g., with Trivy, Clair, or Grype) detects vulnerable OS packages and application dependencies in image layers, preventing exploitable images from reaching the registry or runtime. Option B is correct because enforcing non-root execution and secure container security contexts (via runAsNonRoot, readOnlyRootFilesystem, dropped Linux capabilities, and seccomp/AppArmor profiles) reduces the impact of a container compromise by limiting privileges and blocking privilege-escalation paths. Option C is incorrect because unit tests in Python or Go verify application logic, not container-layer security controls. Option D is incorrect because dedicated physical server racks address physical infrastructure isolation, not the container layer. Option E is incorrect because Terraform scripts provisioning AWS VPCs secure the network layer, not the container layer itself.

Answer

Writing application unit tests in Python or Go

Answer

Procuring dedicated physical server racks from the cloud provider

Answer

Writing Terraform scripts to provision AWS VPCs

Question 8

Which THREE of the following configurations or features represent critical attack vectors or misconfigurations in a Kubernetes cluster threat model?

Accepted Answer

Mounting the host Docker socket (`/var/run/docker.sock`) into application pods. Option A is correct because mounting /var/run/docker.sock into a pod gives the container direct control over the host's Docker daemon, allowing an attacker to create privileged containers, mount host filesystems, or escape to the node. Option B is correct because the Kubelet read-only port 10255 serves unauthenticated and unencrypted API data, exposing pod specs, environment variables, and cluster details to anyone who can reach the node. Option D is correct because securityContext.privileged: true disables container isolation, granting all Linux capabilities and host device access, which makes node compromise and container escape trivial. Option C is not a vector because Pod Security Admission in restricted mode is a hardening control that enforces least-privilege pod settings. Option E is not a vector because etcd encryption at rest with a Secret encryption provider protects sensitive data in etcd rather than exposing it.

Answer

Enabling Pod Security Admission in restricted mode across all namespaces

Answer

Configuring etcd encryption at rest with a Secret encryption provider

Question 9

When modeling threats for a Kubernetes cluster using the STRIDE methodology, identifying scenarios where an attacker intercepts unencrypted traffic between worker nodes or between a client and the API server addresses which TWO STRIDE categories? (Choose TWO)

Accepted Answer

Tampering. Option C (Tampering) is correct because an attacker who intercepts unencrypted traffic between worker nodes or between a client and the API server can modify the data in transit, which directly violates integrity and matches STRIDE's Tampering category. Option E (Information Disclosure) is correct because intercepting unencrypted traffic exposes sensitive data such as credentials, tokens, or configuration details to unauthorized parties, which is exactly the confidentiality violation STRIDE classifies as Information Disclosure. Option A (Repudiation) does not apply because it concerns denying having performed an action and the lack of audit trails, not interception of traffic. Option B (Denial of Service) does not apply because it concerns availability degradation or disruption, not passive interception or modification of communications. Option D (Elevation of Privilege) does not apply because it concerns gaining higher permissions than authorized, which is not the direct result of intercepting unencrypted traffic described here.

Answer

Repudiation

Answer

Denial of Service

Answer

Elevation of Privilege

Question 10

Which THREE of the following supply chain vulnerabilities or risks can impact Kubernetes application deployments during the build or deployment phase?

Accepted Answer

Using outdated container base images containing known remote code execution CVEs. Option B is correct because outdated base images carry known RCE CVEs that are inherited by every image built FROM them, so the vulnerability is baked into the artifact during the build phase and shipped to the cluster at deployment. Option C is correct because typosquatting attacks publish malicious packages with names resembling legitimate ones on npm/PyPI, so a mistyped dependency in a Dockerfile or build script executes attacker code during image build. Option D is correct because third-party Helm charts can embed backdoored templates (e.g., privileged pods, hostPath mounts, or extra initContainers) that are rendered and applied at deployment time, compromising the workload. Option A is not a vulnerability but a hardening control that restricts pod privileges, and Option E is a detection/auditing control using webhook sinks, so neither introduces a build- or deployment-phase supply chain risk.

Answer

Enforcing Pod Security Standards in baseline mode in production namespaces

Answer

Enabling Kubernetes audit logging with webhook sinks

Question 11

An attacker with compromised Kubernetes credentials attempts to hide malicious activity by deleting Kubernetes audit logs on the worker node. Where should audit logs ideally be stored and managed in a securely hardened cluster to prevent tampering and ensure non-repudiation?

Accepted Answer

Forwarded to an external centralized SIEM or secure remote storage backend. Audit logs must be shipped off-node to an external, append-only or WORM-capable backend (SIEM, syslog server, object storage with immutability) so that a compromised node or cluster credential cannot delete or alter them. Kubernetes audit policy is configured on the API server via --audit-policy-file and --audit-log-path/--audit-webhook-config-file, and forwarding to a remote endpoint preserves non-repudiation because the attacker's blast radius no longer includes the log store. Centralized storage also enables correlation across nodes and clusters, which is essential for forensic reconstruction after an incident.

Answer

Written to the container image layer cache of the local container runtime

Answer

Stored inside unencrypted ConfigMaps within the default namespace

Answer

Saved locally in an ephemeral emptyDir volume inside the kube-system namespace

Question 12

Which file on a Kubernetes control plane node contains the startup arguments and flags for the statically hosted API server?

Accepted Answer

/etc/kubernetes/manifests/kube-apiserver.yaml. On kubeadm-provisioned control plane nodes, the API server runs as a static Pod, and its manifest — including all command-line flags such as --advertise-address, --etcd-servers, and --authorization-mode — lives at /etc/kubernetes/manifests/kube-apiserver.yaml. The kubelet watches this directory and starts/restarts the static Pod whenever the file changes, so editing this YAML is how administrators modify API server startup arguments.

Answer

/etc/systemd/system/kube-apiserver.service

Answer

/etc/default/kube-apiserver

Answer

/var/lib/kubelet/config.yaml

Question 13

A security team discovers that a vulnerability in a third-party open-source npm library has been exploited inside a running container in a production Kubernetes cluster. Based on the 4Cs of Cloud Native Security, which layer should be modified first to fix the root cause of this vulnerability?

Accepted Answer

Code layer. In the 4Cs of Cloud Native Security (Cloud, Cluster, Container, Code), the Code layer refers to the application code and its dependencies. Since the vulnerability is in a third-party npm library used by the application, fixing the root cause requires updating or patching that library in the application code, which is part of the Code layer.

Answer

Container layer

Answer

Cluster layer

Answer

Cloud layer

Question 14

You are reviewing a security alert indicating that a container running in your Kubernetes cluster attempted to modify host kernel parameters via /proc/sys. Which security configuration was likely missing or misconfigured for this container?

Accepted Answer

The container was run in privileged mode or lacked necessary capability and filesystem hardening. Modifying host kernel parameters via /proc/sys requires write access to the host's sysctl interface, which is only possible if the container is running in privileged mode or has been granted dangerous capabilities (e.g., CAP_SYS_ADMIN) and lacks filesystem hardening such as a read-only /proc/sys mount or seccomp/AppArmor restrictions. A properly hardened container using Pod Security Standards (restricted) or a securityContext with readOnlyRootFilesystem, dropped capabilities, and no privileged flag would block this.

Answer

The CoreDNS deployment had too few replicas

Answer

The Ingress controller did not enable TLS termination

Answer

The PersistentVolumeClaim lacked a storage class

Question 15

Which THREE of the following features or configurations are associated with securing Ingress traffic in a Kubernetes cluster? (Choose THREE)

Accepted Answer

Configuring TLS blocks in the Ingress resource referencing a kubernetes.io/tls Secret.. Option A is correct because a Kubernetes Ingress resource secures traffic by defining a TLS block that references a kubernetes.io/tls Secret containing the certificate and private key, enabling the Ingress controller to terminate TLS for the specified hosts. Option C is correct because Ingress controllers commonly support annotations or middleware (for example NGINX Ingress annotations or Traefik middleware) that attach WAF modules or OAuth/OIDC authentication filters to protect inbound HTTP(S) traffic before it reaches backend Services. Option E is correct because annotations such as nginx.ingress.kubernetes.io/force-ssl-redirect or ssl-redirect enforce HTTP-to-HTTPS redirection, ensuring clients are automatically upgraded to encrypted connections. Option B is incorrect because bypassing kube-proxy to expose Pod clusterIPs directly to the internet is not a supported or secure Ingress practice and defeats the purpose of controlled ingress. Option D is incorrect because removing all NetworkPolicies weakens cluster security and is unrelated to securing Ingress traffic; NetworkPolicies govern pod-to-pod traffic, not Ingress TLS or authentication.

Answer

Directly exposing internal Pod clusterIPs to the public internet via kube-proxy bypass rules.

Answer

Removing all network policies so the Ingress controller can freely probe unmanaged host ports.

Question 16

Which TWO actions help secure Ingress traffic in a Kubernetes cluster? (Choose two)

Accepted Answer

Enforcing TLS termination with strong cipher suites and valid certificates. Option B is correct because enforcing TLS termination at the ingress layer with strong cipher suites and valid certificates encrypts client-to-cluster traffic and prevents downgrade or weak-crypto attacks, directly securing Ingress traffic. Option D is correct because restricting the ingress controller's exposure (e.g., limiting its Service to a LoadBalancer with tight firewall rules or a private IP) and placing a WAF in front of it filters malicious HTTP/HTTPS requests such as SQLi and XSS before they reach backend pods. Option A is wrong because exposing debugging endpoints over unencrypted HTTP on port 80 increases the attack surface and leaks sensitive data. Option C is wrong because disabling authentication at the ingress gateway removes access control, allowing anonymous or unauthorized users to reach services. Option E is wrong because storing TLS private keys in plaintext ConfigMaps exposes them to anyone with read access to the namespace, breaking key confidentiality.

Answer

Exposing all internal debugging endpoints via unencrypted HTTP on port 80

Answer

Disabling all authentication mechanisms at the ingress gateway

Answer

Storing TLS private keys in plaintext ConfigMaps

Question 17

What is the purpose of the Pod Security Standards 'baseline' profile?

Accepted Answer

To prevent known privilege escalations while maintaining broad compatibility for standard applications.. The baseline profile is designed to prevent known privilege escalations — such as privileged containers, hostNetwork, hostPID, and adding dangerous capabilities — while remaining broadly compatible with standard applications. It sits between the permissive 'privileged' profile and the highly restrictive 'restricted' profile. This makes it the default recommendation for general-purpose namespaces that need meaningful security without breaking typical workloads.

Answer

To disable all security controls and permit unrestricted container execution.

Answer

To automatically encrypt all container environment variables.

Answer

To enforce the highest level of security, restricting pods to hardened sandbox environments.

Question 18

A security engineer is hardening a Kubernetes cluster and wants to ensure that all container images are pulled only from an approved internal container registry (e.g., registry.internal.corp). Which Kubernetes mechanism can enforce this restriction across all namespaces?

Accepted Answer

Deploying a validating admission policy or webhook to check image registry URLs. A validating admission policy or webhook is the correct mechanism because Kubernetes admission controllers intercept API requests before objects are persisted, allowing enforcement of image registry restrictions cluster-wide. Tools like OPA Gatekeeper, Kyverno, or the built-in ValidatingAdmissionPolicy (K8s 1.26+) can reject any Pod whose image field does not match an approved registry prefix such as registry.internal.corp. This enforcement applies across all namespaces without modifying individual workloads.

Answer

Configuring NodePort service selectors

Answer

Enabling horizontal pod autoscaling

Answer

Modifying the kube-proxy IPVS configuration

Question 19

Which TWO of the following tasks are handled by the kube-scheduler? (Choose TWO)

Accepted Answer

Evaluating pending pods and selecting suitable worker nodes for placement.. Option B is correct because the kube-scheduler's core function is to watch for newly created Pods that have no node assigned (Pending) and select a suitable node for them via its scheduling cycle. Option C is correct because during that scheduling cycle the kube-scheduler applies filtering and scoring predicates that include node taints/tolerations and node/pod affinity and anti-affinity rules to pick the best fit. Option A is not a scheduler task: X.509 client certificates for bootstrapping are issued by the kubelet's TLS bootstrap process via the CSR API and controller-manager signers. Option D is not a scheduler task: etcd encryption keys are managed through the kube-apiserver's EncryptionConfiguration and kube-controller-manager, not the scheduler. Option E is not a scheduler task: liveness probes are executed by the kubelet on each node, not by the scheduler.

Answer

Generating X.509 client certificates for cluster bootstrapping.

Answer

Managing encryption keys inside the etcd database.

Answer

Executing container liveness probes inside running pods.

Question 20

Which NIST framework publication specifically addresses the security of container-based applications and orchestration systems?

Accepted Answer

NIST SP 800-190. NIST SP 800-190, 'Application Container Security Guide', specifically addresses the security of container-based applications and orchestration systems. It provides guidance on container threats, vulnerabilities, and countermeasures, making it the correct publication for this topic.

Answer

NIST SP 800-37

Answer

NIST SP 800-53

Answer

NIST SP 800-88