KCSA Practice Test 1 — 30 Questions

Question 1

An enterprise security auditor is reviewing Kubernetes API server admission control configurations for compliance. Which THREE admission plugins or mechanisms are critical for enforcing security policies at admission time? (Choose THREE)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ValidatingAdmissionWebhook. NodeRestriction, ValidatingAdmissionWebhook, and PodSecurity are key admission mechanisms for enforcing security policies.

Answer

InsecureServing

Answer

AlwaysAllow

Question 2

A security engineer needs to verify that control plane component pods (such as kube-apiserver and etcd) have correct file ownership on the control plane node. According to CIS benchmarks, who should own these manifest files located in "/etc/kubernetes/manifests"?

Accepted Answer

root:root. CIS benchmarks state that control plane manifest files must be owned by the root user and root group (root:root).

Answer

nobody:nogroup

Answer

daemon:daemon

Answer

kube:kube

Question 3

A cluster administrator wants to implement admission control auditing to record all mutating and validating requests made to the API server. Which component configuration handles this requirement?

Accepted Answer

Configure an audit policy file and pass its path to the API server via --audit-policy-file.. Kubernetes Audit Policy configuration files define what events are recorded and at what log level by the API server audit backend.

Answer

Configure the kubelet audit webhook via /etc/kubernetes/audit.json.

Answer

Enable kube-proxy audit mode using --audit-proxy=true.

Answer

Set etcd logging level to DEBUG in the etcd configuration yaml.

Question 4

A compliance officer wants to continuously audit Kubernetes resource manifests for misconfigurations against security best practices before they are applied. Which tool type is best suited for this shift-left compliance approach?

Accepted Answer

Static code analysis and admission controllers. Policy-as-code engines like OPA Gatekeeper or Kyverno validate and audit Kubernetes manifests prior to admission into the cluster.

Answer

Log shippers

Answer

Packet analyzers

Answer

Kernel debuggers

Question 5

A security analyst wants to scan container images for known Common Vulnerabilities and Exposures (CVEs) as part of a continuous compliance pipeline. Which tool is widely used for this purpose?

Accepted Answer

Trivy. Trivy is a popular open-source vulnerability scanner for containers, filesystems, and Git repositories.

Answer

Envoy

Answer

CoreDNS

Answer

Calico

Question 6

When evaluating a Kubernetes cluster against security and compliance baselines, which TWO tools are commonly used for automated auditing and benchmarking? (Choose TWO)

Accepted Answer

kube-bench. Kube-bench and Kubescape are both widely recognized tools for auditing Kubernetes compliance against benchmarks.

Answer

Kustomize

Answer

Helm

Answer

Kubectl

Question 7

An enterprise is enforcing the CIS Kubernetes Benchmark for control plane configuration. Which TWO parameters must be correctly configured on the kube-apiserver to meet strict compliance auditing standards? (Choose TWO)

Accepted Answer

--audit-policy-file. CIS benchmarks require enabling auditing via audit log path and audit policy file configuration on the kube-apiserver.

Answer

--service-account-lookup=false

Answer

--enable-bootstrap-auth-only=true

Answer

--profiling=true

Question 8

Which NIST framework publication specifically addresses the security of container-based applications and orchestration systems?

Accepted Answer

NIST SP 800-190. NIST SP 800-190 is the Application Container Security Guide, providing specific security guidance for container environments.

Answer

NIST SP 800-37

Answer

NIST SP 800-53

Answer

NIST SP 800-88

Question 9

Which Kubernetes control plane component runs controllers that handle routine tasks such as replicating pods and managing service accounts?

Accepted Answer

kube-controller-manager. The kube-controller-manager houses core control loops including the replication controller, service account controller, and namespace controller.

Answer

CoreDNS

Answer

etcd

Answer

kube-proxy

Question 10

Which TWO of the following kubelet security configurations are critical for preventing container escape and unauthorized node API access? (Choose TWO)

Accepted Answer

Configure kubelet authorization mode to Webhook.. Disabling the read-only port and enforcing webhook authorization on the kubelet secure port are essential node security measures.

Answer

Enable anonymous authentication on the kubelet secure port.

Answer

Run kubelet containers in privileged mode.

Answer

Set authorization.mode to AlwaysAllow.

Question 11

Which THREE of the following practices should be followed when configuring Kubernetes audit logging? (Choose THREE)

Accepted Answer

Monitor audit logs regularly for suspicious authentication failures or privilege escalations.. Audit logging should use a defined policy, specify a secure log output path, and protect log files from unauthorized modification.

Answer

Store audit logs in unencrypted public ConfigMaps.

Answer

Disable audit logging entirely to maximize API server performance.

Question 12

Which TWO of the following are valid Kubernetes RBAC rule subjects that can be bound to roles or cluster roles?

Accepted Answer

User. Kubernetes RBAC supports three primary subjects: User, Group, and ServiceAccount.

Answer

Secret

Answer

Namespace

Answer

PersistentVolume

Question 13

Which TWO actions are core tenets of the "Shift-Left" security philosophy in cloud-native compliance? (Choose TWO)

Accepted Answer

Scanning infrastructure-as-code (IaC) templates for misconfigurations before deployment. Shift-left security focuses on integrating security checks early in the development lifecycle, such as in CI/CD and IaC scanning.

Answer

Disabling all automated security tooling to speed up commits

Answer

Waiting until a production breach occurs to audit logs

Answer

Relying entirely on manual code reviews post-release

Question 14

Which open-source auditing tool provides compliance scores and checks against Kubernetes security frameworks such as NSA-CISA and CIS?

Accepted Answer

Kubescape. Datree or Kubescape are prominent tools for compliance scoring. Kubescape specifically evaluates Kubernetes clusters against multiple security frameworks including CIS and NSA-CISA.

Answer

Kube-dns

Answer

Metric-server

Answer

Cilium

Question 15

According to the CIS Kubernetes Benchmark, anonymous requests to the Kubernetes API server should be disabled. Which kube-apiserver flag enforces this setting?

Accepted Answer

--anonymous-auth=false. The flag --anonymous-auth=false disables anonymous requests to the secure port of the API server, fulfilling CIS benchmark requirements.

Answer

--authorization-mode=Node,RBAC

Answer

--enable-admission-plugins

Answer

--insecure-port=0

Question 16

An auditor is reviewing compliance with CIS Kubernetes Benchmark control 1.2.20, which relates to the kube-apiserver admission control configuration. Which admission plugin is recommended by CIS to prevent default service accounts from automatically mounting API credentials?

Accepted Answer

ServiceAccount. The ServiceAccount admission controller, along with disabling automatic token mounting via serviceAccountName/automountServiceAccountToken, is governed by admission plugins. Specifically, NamespaceLifecycle and PodNodeSecurity are relevant, but for service account automation management, the ServiceAccount admission controller governs default behavior.

Answer

DefaultTolerationSeconds

Answer

AlwaysAdmit

Answer

NodeRestriction

Question 17

A security auditor discovers that anonymous authentication is accidentally enabled on the Kubernetes API server, allowing unauthenticated read access to cluster health endpoints. Which API server flag must be modified to disable anonymous requests?

Accepted Answer

--anonymous-auth=false. Setting --anonymous-auth=false explicitly disables requests that are not rejected by other authenticators from being treated as anonymous.

Answer

--secure-port=0

Answer

--authorization-mode=AlwaysAllow

Answer

--disable-anonymous=true

Question 18

Which component provides network routing and iptables/IPVS rule management across worker nodes for Kubernetes Services?

Accepted Answer

kube-proxy. kube-proxy maintains network rules on nodes allowing network communication to pods.

Answer

kube-scheduler

Answer

kube-apiserver

Answer

etcd

Question 19

Which TWO of the following actions are risks associated with leaving the Kubernetes API server's insecure port enabled? (Choose TWO)

Accepted Answer

Complete bypass of all authentication mechanisms.. The insecure port allows unauthenticated and unencrypted access.

Answer

Enforcement of strict TLS 1.3 encryption on all connections.

Answer

Mandatory mutual TLS client certificate verification.

Answer

Automatic activation of etcd encryption at rest.

Question 20

An auditor notices that kubelet authentication is set to always allow anonymous access in a cluster configuration. According to the CIS Benchmark, what should the kubelet configuration parameter "authentication.anonymous.enabled" be set to?

Accepted Answer

false. The CIS Benchmark specifies that kubelet anonymous access must be disabled by setting authentication.anonymous.enabled to false.

Answer

strict

Answer

auto

Answer

true