KCSA Practice Test 3 — 10 Questions

Question 1

When configuring a Pod to run securely, which setting in the container's securityContext should be used to explicitly drop all default Linux capabilities and only retain required ones?

Accepted Answer

capabilities.drop: ["ALL"]. In the container's securityContext, capabilities.drop: ["ALL"] removes every default Linux capability (like NET_RAW, CHOWN, SETUID) from the container process, after which you can selectively add back only what the workload needs via capabilities.add. This follows the principle of least privilege and is the canonical hardening pattern for Pods.

Answer

runAsNonRoot: true

Answer

capabilities.add: ["ALL"]

Answer

privileged: true

Question 2

A cluster administrator needs to grant read-only access to pods within the 'development' namespace using Kubernetes RBAC. Which resource kind should be used to define the permissions?

Accepted Answer

Role. A Role is a namespaced Kubernetes resource that defines permissions within a specific namespace. Since the requirement is to grant read-only access to pods in the 'development' namespace, a Role scoped to that namespace is the correct choice. It can be bound to a user, group, or service account via a RoleBinding to grant the necessary permissions.

Answer

SecurityContextConstraints

Answer

PodSecurityPolicy

Answer

ClusterRole

Question 3

A platform engineer wants to configure a container runtime security tool that monitors system calls and sends alerts about potential threats in a Kubernetes cluster. Which component of the container runtime architecture intercepts these system calls?

Accepted Answer

eBPF kernel probes. eBPF (extended Berkeley Packet Filter) kernel probes are the correct answer because they allow programs to run in the Linux kernel without changing kernel source code or loading modules. In container runtime security, tools like Falco, Tetragon, and Cilium use eBPF to hook into system calls (syscalls) and other kernel events, monitoring container behavior for threats. This interception happens at the kernel level, providing deep visibility into syscalls made by containers.

Answer

The coreDNS plugin

Answer

The Kubernetes storage controller

Answer

The kube-apiserver admission webhook

Question 4

An administrator wants to verify that etcd database defragmentation is performed periodically to reclaim storage space after large amounts of data churn. Which etcdctl command defragments an etcd member?

Accepted Answer

etcdctl defrag. The etcdctl defrag command defragments an etcd member's database, reclaiming storage space after data churn (e.g., many writes and deletes). Defragmentation compacts the underlying BoltDB file, reducing its size and improving performance. It is typically run periodically on each etcd member, often after compaction.

Answer

kubectl etcd-clean

Answer

etcdctl compact

Answer

etcdctl cleanup storage

Question 5

A compliance team is adopting the NIST SP 800-190 standard to secure their container image pipeline. Which THREE practices are recommended in this framework for managing container images? (Choose THREE)

Accepted Answer

Employ trusted base images from verified publishers. NIST SP 800-190 Section 3.1 (Image Vulnerabilities) recommends using trusted base images from verified publishers (A) to reduce the risk of inheriting vulnerabilities or malicious code from untrusted sources, since every layer of a container image becomes part of the running container. The framework also calls for vulnerability scanning throughout the image lifecycle, including in the CI/CD pipeline and the registry (B), so that known CVEs are detected before deployment and continuously re-evaluated as new vulnerabilities are disclosed. Additionally, NIST SP 800-190 recommends digitally signing images and verifying those signatures (E) to establish provenance and integrity, ensuring that only images from authorized sources are deployed and that images have not been tampered with. Option C is incorrect because storing plaintext passwords in Dockerfile ENV directives exposes secrets in image layers and metadata, directly violating NIST guidance on protecting secrets. Option D is incorrect because relying exclusively on public unverified base images increases supply-chain risk and contradicts the recommendation to use trusted, verified image sources.

Answer

Store plaintext passwords directly inside Dockerfile ENV directives

Answer

Rely exclusively on public unverified base images to speed up development

Question 6

An administrator wants to prevent users from creating pods that mount the host network ('hostNetwork: true'). Which tool or feature is best suited to enforce this restriction natively across the cluster?

Accepted Answer

Pod Security admission controller with baseline or restricted profile. Pod Security admission (PSA) is the built-in Kubernetes admission controller that enforces Pod Security Standards at the namespace level using labels. The baseline and restricted profiles explicitly disallow hostNetwork: true, so labeling the namespace with pod-security.kubernetes.io/enforce: baseline (or restricted) blocks pods that request host networking. This is the native, cluster-wide enforcement mechanism.

Answer

ResourceQuota limiting network interfaces

Answer

RBAC ClusterRole restricting pod creation

Answer

NetworkPolicy with a deny-all rule

Question 7

A platform engineer needs to secure an Ingress resource using TLS termination, ensuring that sensitive private keys are stored securely within the cluster and referenced safely. Which Kubernetes resource should be created to store the TLS certificate and private key pair?

Accepted Answer

Secret of type kubernetes.io/tls. A Secret of type kubernetes.io/tls is the correct resource because it is specifically designed to hold a TLS certificate and its private key. The Ingress resource references this Secret in its tls section, and the ingress controller uses it to terminate TLS. Kubernetes treats this Secret type with appropriate handling for the required tls.crt and tls.key fields.

Answer

PersistentVolumeClaim

Answer

CertificateSigningRequest

Answer

ConfigMap

Question 8

You are performing a security review of etcd cluster membership. You need to list all active members of the etcd cluster and check their health status using the command line. Which etcdctl command is correct?

Accepted Answer

etcdctl member list and etcdctl endpoint health. etcdctl provides two distinct subcommands for this task: 'etcdctl member list' enumerates all cluster members with their IDs, peer URLs, and client URLs, while 'etcdctl endpoint health' queries each endpoint to verify it can serve requests and is not lagging. Together they satisfy the requirement to list active members and check their health.

Answer

etcdctl check membership

Answer

etcdctl cluster status

Answer

kubectl get etcdmembers

Question 9

You want to ensure that a newly created Role in namespace 'finance' cannot be modified or deleted by regular developers who have edit permissions. Which RBAC feature or design prevents unauthorized privilege escalation through Role manipulation?

Accepted Answer

The API server's built-in privilege escalation prevention check, which blocks users from granting permissions they do not hold.. Kubernetes RBAC has a built-in privilege escalation prevention check: the API server blocks a user from creating or updating a Role/ClusterRole that grants permissions the user does not already hold (unless they have the 'escalate' or 'bind' verb). This prevents a developer with edit rights from crafting a Role that grants cluster-admin and then binding to it.

Answer

Enabling Pod Security Standards on the finance namespace.

Answer

Setting the Role resource to immutable via 'immutable: true'.

Answer

A mandatory MutatingWebhookConfiguration that strips administrative verbs.

Question 10

An enterprise cluster requires that all incoming NetworkPolicies must default to denying all traffic unless explicitly allowed. A developer creates a namespace but forgets to apply any policies. What is the default behavior of Kubernetes regarding inter-pod traffic within a namespace when no NetworkPolicies are present?

Accepted Answer

All traffic between pods is allowed by default.. Kubernetes NetworkPolicies operate on an additive allow-list model: if no policy selects a pod, that pod is non-isolated and all ingress/egress traffic is permitted. The default-deny posture only takes effect once at least one NetworkPolicy selects the pod and does not explicitly allow the traffic. Therefore, a namespace with zero policies allows unrestricted inter-pod communication.

Answer

Only traffic originating from the kube-system namespace is allowed.

Answer

Traffic is allowed only if the pods share the same node.

Answer

All traffic between pods is denied by default.