KCSA Practice Test 5 — 25 Questions

Question 1

An administrator is hardening a Kubernetes cluster against container breakout vulnerabilities and node compromise. Which THREE security practices should be implemented?

Accepted Answer

Configure readOnlyRootFilesystem: true to prevent malicious writes to the container's root file system.. Hardening involves dropping unnecessary Linux capabilities, enforcing read-only root filesystems where applicable, and avoiding sharing host namespaces like hostNetwork or hostPID.

Answer

Run all containers as the root user (UID 0) to ensure smooth file permission handling.

Answer

Enable hostNetwork and hostPID on all production pods to improve debugging visibility.

Question 2

A security auditor notices that a deployment running in the 'production' namespace is violating the Restricted Pod Security Standard because containers are running as root. How can you enforce compliance using Pod Security Admission?

Accepted Answer

Label the 'production' namespace with 'pod-security.kubernetes.io/enforce=restricted'.. Applying the 'pod-security.kubernetes.io/enforce: restricted' label to the namespace enforces the restricted Pod Security Standard for all newly created pods.

Answer

Create a NetworkPolicy that blocks root user communication.

Answer

Enable the SecurityContextDeny legacy admission controller.

Answer

Update the kube-apiserver flags to globally block non-restricted pods without namespace labels.

Question 3

A security engineer configures a ValidatingWebhookConfiguration to intercept pod creations. The webhook service goes down due to a network partition. What happens to incoming pod creation requests by default if the webhook 'failurePolicy' is set to 'Fail'?

Accepted Answer

The API server rejects the pod creation request with an error.. When failurePolicy is set to 'Fail', if the webhook encounters an error or is unreachable, the API server rejects the request.

Answer

The kubelet automatically bypasses the webhook and starts the container locally.

Answer

The API server allows the pod creation request and logs a warning.

Answer

The API server queues the request until the webhook service recovers.

Question 4

Which THREE fields are required when defining a standard Kubernetes NetworkPolicy resource? (Choose THREE)

Accepted Answer

metadata. A NetworkPolicy requires apiVersion, kind, metadata, and spec containing at least podSelector.

Answer

securityContext

Answer

imagePullSecrets

Question 5

An external identity provider (OIDC) is integrated with your Kubernetes cluster. You want to restrict a group named 'contractors' so they can only view pods in the 'staging' namespace. Which configuration correctly maps this requirement?

Accepted Answer

A ClusterRole granting pod read access bound via a RoleBinding in the 'staging' namespace to the subject kind 'Group' with name 'contractors'.. A ClusterRole providing read access to pods, combined with a RoleBinding in the 'staging' namespace referencing the OIDC group 'contractors'.

Answer

A Namespace-scoped ServiceAccount configured with an OIDC JWT issuer URL.

Answer

A Role in the 'staging' namespace bound via a ClusterRoleBinding to the 'contractors' group.

Answer

An OIDC webhook configuration in the kube-apiserver specifying namespace boundaries.

Question 6

An administrator wishes to create a NetworkPolicy that allows incoming traffic from any pod in any namespace, provided those pods have the label 'environment=production'. How should the NetworkPolicy 'ingress' rule be structured?

Accepted Answer

Specify an ingress 'from' entry containing a 'namespaceSelector' matching the desired namespaces and a 'podSelector' matching 'environment=production'.. To select pods across namespaces, the 'from' array must use 'namespaceSelector' combined with 'podSelector'.

Answer

Add the production label to the target pod's metadata and reference it in the egress block.

Answer

Specify only a 'podSelector' with 'environment=production' without any namespace selector.

Answer

Use a cluster-wide ClusterNetworkPolicy resource with global label matching.

Question 7

Under the cloud native shared responsibility model, who is responsible for ensuring that the underlying physical servers and hardware security modules (HSMs) are secure and compliant?

Accepted Answer

The cloud service provider. The cloud provider owns the physical infrastructure, data centers, and underlying hardware.

Answer

The container registry administrator

Answer

The application developer

Answer

The Kubernetes administrator

Question 8

Which of the following best describes the principle of 'Defense-in-Depth' in cloud native security architectures?

Accepted Answer

Implementing multiple overlapping security controls across the 4Cs so that a single failure does not lead to compromise. Defense-in-depth relies on multiple layers of security controls so that if one layer fails, subsequent layers prevent a breach.

Answer

Outsourcing all security responsibilities to the cloud provider

Answer

Ensuring every developer has cluster admin access for rapid debugging

Answer

Relying entirely on a strong perimeter firewall to block all malicious actors

Question 9

What is the primary risk associated with running containers as the `root` user (`runAsUser: 0` or omitting the user directive)?

Accepted Answer

If a container escape vulnerability occurs, the attacker immediately obtains root privileges on the underlying host.. Running as root inside the container means the process has root privileges inside the container namespace, and if a container escape vulnerability exists, the attacker immediately gains root access on the host.

Answer

It prevents the kubelet from restarting the container upon failure.

Answer

It disables the container runtime engine's ability to pull images from private registries.

Answer

It forces the CNI plugin to drop network packets destined for external IPs.

Question 10

When modeling threats for a Kubernetes cluster using the STRIDE methodology, identifying scenarios where an attacker intercepts unencrypted traffic between worker nodes or between a client and the API server addresses which TWO STRIDE categories? (Choose TWO)

Accepted Answer

Tampering. Interception of unencrypted network traffic falls under Information Disclosure (reading sensitive data in transit) and Tampering (if the traffic can also be modified in flight without integrity checks).

Answer

Repudiation

Answer

Denial of Service

Answer

Elevation of Privilege

Question 11

When managing Kubernetes clusters on Google Cloud Platform (GKE), Google manages the control plane infrastructure. Under the shared responsibility model, what is the customer primarily responsible for securing?

Accepted Answer

The Kubernetes worker node operating systems and cluster configuration. In managed Kubernetes (like GKE or EKS), the cloud provider manages the control plane, while the customer is responsible for configuring worker nodes, IAM, cluster networking, and workloads.

Answer

The physical security of the data center housing the servers

Answer

The underlying virtualization hypervisors of the physical data center

Answer

The internal etcd cluster database consensus protocol implementation

Question 12

Which TWO of the following actions are considered best practices for securing Kubernetes Secrets? (Choose TWO)

Accepted Answer

Enable encryption at rest for Secret resources in etcd.. Enabling encryption at rest in etcd and restricting RBAC access to Secrets are core practices. Base64 encoding is not security, and putting secrets in ConfigMaps is insecure.

Answer

Store database passwords in plaintext ConfigMaps for easier application ingestion.

Answer

Rely on base64 encoding as the primary encryption mechanism for sensitive data.

Answer

Mount Secrets as writable volumes so applications can update their own credentials.

Question 13

Which TWO mechanisms are used by Kubernetes admission controllers to enforce security policies during the API request lifecycle?

Accepted Answer

Validating admission webhooks can reject object definitions that violate security standards.. Mutating admission controllers can modify incoming objects before they are persisted, and Validating admission controllers can evaluate and reject non-compliant requests.

Answer

kubelet automatically runs security audits on all container images prior to pull.

Answer

etcd executes consensus validation scripts to strip unauthorized RBAC rules.

Answer

kube-proxy inspects network payloads at Layer 7 to block unauthorized API requests.

Question 14

Which THREE options represent valid ways to supply sensitive data to a container using Kubernetes native features? (Choose THREE)

Accepted Answer

Mounting the Secret as a volume in the Pod specification.. Secrets can be mounted as volumes, exposed as environment variables, or accessed via the Kubernetes API directly.

Answer

Placing the Secret inside a persistent volume formatted with LUKS encryption.

Answer

Embedding the Secret plaintext string in the container image build args.

Question 15

You need to grant a monitoring tool permission to perform HTTP GET requests against health endpoints across all pods in the cluster, but no other API access. How should you define the RBAC rules?

Accepted Answer

Create a ClusterRole with verbs ['get'] and nonResourceURLs ['/healthz', '/readyz'].. Non-resource URLs like '/healthz' or pod subresources like '/pods/{name}/proxy' are specified using 'nonResourceURLs' or subresource permissions in rules.

Answer

Assign the tool to the system:masters group.

Answer

Grant cluster-admin access and restrict requests using a kube-proxy firewall rule.

Answer

Create a ClusterRole with API groups [''] and resources ['pods/status'].

Question 16

An engineer is reviewing the threat model of a Kubernetes cluster exposed to the public internet via a LoadBalancer service. Which configuration flaw most commonly leads to unintended external exposure of administrative dashboards?

Accepted Answer

Exposing management dashboards via LoadBalancer or NodePort services without authentication or IP whitelisting. Deploying management tools (like Kubernetes dashboards, monitoring UIs, or debugging tools) with external LoadBalancer services or NodePorts without authentication or network restriction is a major threat vector.

Answer

Configuring liveness probes with HTTP GET requests instead of TCP socket checks

Answer

Setting imagePullPolicy to IfNotPresent on production deployments

Answer

Using ClusterIP service types for internal database connectivity

Question 17

A cluster administrator needs to intercept and reject any resource creation requests that do not include a mandatory security-context label. Which admission controller type should be implemented?

Accepted Answer

ValidatingAdmissionWebhook. Validating admission webhooks are executed after all mutation phases are complete and can accept or reject requests based on custom validation logic.

Answer

MutatingAdmissionWebhook

Answer

ServiceAccount

Answer

NamespaceLifecycle

Question 18

A DevOps team uses mutable image tags like `:latest` in their deployment manifests. Under supply chain threat modeling, what vulnerability does this practice introduce?

Accepted Answer

Image Tag Hijacking / Malicious substitution without manifest updates. Mutable image tags allow an attacker who compromises the image registry to overwrite the tag with a malicious binary, causing pods restarting or pulling new instances to execute compromised code without changing the deployment manifest.

Answer

Automatic revocation of TLS certificates issued by cert-manager

Answer

Exposition of etcd database credentials on public DNS servers

Answer

Escalation of RBAC permissions from Role to ClusterRole

Question 19

A security engineer wants to ensure that a pod cannot escalate its privileges to gain root access on the node. Which securityContext setting should be configured to prevent privilege escalation?

Accepted Answer

allowPrivilegeEscalation: false. Setting allowPrivilegeEscalation: false in the container's securityContext ensures that a process cannot gain more privileges than its parent process (e.g., via setuid binaries).

Answer

runAsNonRoot: false

Answer

hostNetwork: true

Answer

privileged: true

Question 20

An organization wants to analyze potential threats to their Kubernetes cluster using the STRIDE model. Which STRIDE category maps to an attacker eavesdropping on unencrypted internal cluster traffic between pods?

Accepted Answer

Information Disclosure. Information Disclosure covers the reading or gaining access to data by an unauthorized entity, such as sniffing unencrypted pod-to-pod network traffic.

Answer

Repudiation

Answer

Tampering

Answer

Denial of Service