KCSA Practice Test 2 — 30 Questions

Question 1

Which RBAC verb allows a user to delete an existing resource in a Kubernetes namespace?

Accepted Answer

delete. The 'delete' verb specifically authorizes removing resources.

Answer

remove

Answer

purge

Answer

destroy

Question 2

When configuring Pod Security Standards on a namespace, which THREE security restrictions are enforced by the 'restricted' profile that are NOT enforced by the 'baseline' profile? (Choose THREE)

Accepted Answer

Restricting volume types to a safe subset (e.g., configMap, secret, emptyDir).. The restricted profile adds requirements such as running as a non-root user, preventing escalation of privileges, and restricting allowed volume types.

Answer

Disallowing privileged containers.

Answer

Prohibiting hostPort usage entirely.

Question 3

Which TWO of the following statements are true regarding Kubernetes Secrets and their security posture by default?

Accepted Answer

Mounting a Secret as an environment variable can expose the secret value in container logs or crash dumps.. Kubernetes Secrets are base64 encoded (not encrypted) by default in etcd, and access to them can be controlled via RBAC.

Answer

Secrets are strongly encrypted at rest using AES-256 encryption by default in etcd.

Answer

Secrets automatically expire and rotate every 30 days unless explicitly disabled.

Answer

Secrets encoded in base64 provide cryptographic security comparable to robust symmetric encryption.

Question 4

Which CNCF project acts as a cloud-native runtime security and intrusion detection tool that monitors system calls against predefined security rules?

Accepted Answer

Falco. Falco is the CNCF incubating runtime security tool that acts as a security camera for containers, detecting anomalous behavior and policy violations.

Answer

Trivy

Answer

Fluentd

Answer

Cert-manager

Question 5

An auditor reviews container runtime configurations for compliance with NIST SP 800-190 recommendations on privilege escalation. Which Kubernetes feature controls whether a process can gain more privileges than its parent process?

Accepted Answer

allowPrivilegeEscalation: false. allowPrivilegeEscalation controls whether a process can gain more privileges through mechanisms like setuid binaries, fulfilling privilege restriction controls.

Answer

automountServiceAccountToken: false

Answer

runAsUser: 1000

Answer

privileged: false

Question 6

You are hardening etcd on a dedicated control plane host. You want to ensure that etcd database files on disk are protected against unauthorized physical or filesystem access. Which control mechanism is best suited for this?

Accepted Answer

Filesystem or block-level disk encryption (e.g., LUKS) on the host storage volume.. Operating system level disk encryption (such as LUKS) protects files at rest on block storage devices.

Answer

Kubernetes NetworkPolicies applied to the etcd Pod.

Answer

API server RBAC ClusterRoleBinding.

Answer

Kubelet read-only port disabling.

Question 7

Which TWO of the following methods can be used to authenticate users or systems against the Kubernetes API server? (Choose TWO)

Accepted Answer

X.509 client certificates validated by the API server CA.. OpenID Connect (OIDC) tokens and X.509 client certificates are standard native authentication methods for the API server.

Answer

Unencrypted HTTP basic auth files with default passwords.

Answer

Anonymous packet sniffing via kube-proxy.

Answer

Direct root SSH access to etcd nodes.

Question 8

A security team needs to ensure that Kubernetes nodes have secure file permissions for the kubelet configuration files, in alignment with CIS benchmarks. What should the file permissions on "/etc/kubernetes/kubelet.conf" typically be set to?

Accepted Answer

600. CIS benchmarks state that configuration files containing sensitive credentials, such as kubelet.conf, must have permissions set to 600 or stricter and be owned by root:root.

Answer

777

Answer

755

Answer

644

Question 9

Which protocol and default secure port does the kubelet use to listen for incoming authenticated requests from the API server and metrics collectors?

Accepted Answer

HTTPS on port 10250. The kubelet listens on TCP port 10250 for secure HTTPS traffic.

Answer

HTTPS on port 6443

Answer

TCP on port 2379

Answer

HTTP on port 10255

Question 10

Which TWO of the following are core security hardening best practices for the Kubernetes API server? (Choose TWO)

Accepted Answer

Ensure the insecure port (--insecure-port) is disabled or set to 0.. Disabling anonymous requests and enforcing strong TLS versions are essential API server hardening steps.

Answer

Configure the API server to use HTTP instead of HTTPS for performance.

Answer

Store all kubeconfig credentials in public ConfigMaps.

Answer

Grant cluster-admin permissions to all authenticated users by default.

Question 11

An organization requires compliance auditing of etcd access to ensure unauthorized clients cannot communicate with the data store. According to CIS benchmarks, how should etcd client communication be secured?

Accepted Answer

Mutual TLS (mTLS) client certificates. CIS benchmarks require etcd client communication to be authenticated and encrypted using mutual TLS (mTLS).

Answer

IPsec tunnel encapsulation

Answer

HTTP with token bearer headers

Answer

Plaintext loopback interface binding

Question 12

A security team is implementing Pod Security Standards (restricted, baseline, privileged) across namespaces. Which THREE controls are enforced under the Restricted Pod Security profile? (Choose THREE)

Accepted Answer

Requiring all capabilities to be dropped except NET_BIND_SERVICE or dropping all (capabilities.drop: [ALL]). The restricted profile enforces running as non-root, dropping capabilities, and preventing privilege escalation.

Answer

Allowing unrestricted use of the host network and host PID namespaces

Answer

Enabling privileged mode for all standard workloads

Question 13

A compliance team is adopting the NIST SP 800-190 standard to secure their container image pipeline. Which THREE practices are recommended in this framework for managing container images? (Choose THREE)

Accepted Answer

Employ trusted base images from verified publishers. NIST SP 800-190 recommends vulnerability scanning, cryptographic signing/provenance, and using trusted base images.

Answer

Store plaintext passwords directly inside Dockerfile ENV directives

Answer

Rely exclusively on public unverified base images to speed up development

Question 14

When configuring Role-Based Access Control (RBAC), which Kubernetes object grants permissions across the entire cluster rather than within a single namespace?

Accepted Answer

ClusterRole. A ClusterRole defines permissions across the entire cluster, and a ClusterRoleBinding applies them cluster-wide.

Answer

ServiceAccount

Answer

Role

Answer

PodSecurityPolicy

Question 15

An administrator wants to secure the communication channel between the Kubernetes API server and extension API servers (such as metrics-server). Which API server flag specifies the Certificate Authority used to verify extension API server certificates?

Accepted Answer

--requestheader-client-ca-file. The --requestheader-client-ca-file flag specifies the CA certificate used to sign client certificates for aggregated API servers.

Answer

--extension-ca-file

Answer

--etcd-ca-file

Answer

--proxy-client-cert-file

Question 16

Which of the following describes a recommended security practice when managing Kubernetes Secrets?

Accepted Answer

Limit RBAC access so that only necessary users and service accounts can read secrets.. Restricting RBAC permissions to secrets ensures that only authorized users and workloads can read sensitive data.

Answer

Use ConfigMaps for passwords and Secrets for plain text configuration.

Answer

Store secret values in plain text inside public Git repositories for easy collaboration.

Answer

Disable authentication on the Kubernetes API server to simplify secret retrieval.

Question 17

Which THREE methods can be used to inject Kubernetes Secrets into a running pod?

Accepted Answer

Injected as environment variables. Secrets can be injected into pods via environment variables, environment variables from secret keys, or mounted as files in volumes.

Answer

Compiled directly into the container image binary

Answer

Injected through kernel sysctl parameters

Question 18

An administrator wishes to inspect which admission controllers are currently enabled in a running Kubernetes cluster. Where is this typically configured in a stacked control plane?

Accepted Answer

In the kube-apiserver static pod manifest file under '/etc/kubernetes/manifests/kube-apiserver.yaml'.. Admission controllers are configured via the '--enable-admission-plugins' flag on the kube-apiserver static pod manifest.

Answer

In the CoreDNS deployment spec.

Answer

In the kubelet configuration file on each worker node.

Answer

In the cluster-wide ConfigMap named 'kube-system/cluster-admission'.

Question 19

Which TWO entities can be assigned RBAC permissions in a Kubernetes cluster? (Choose TWO)

Accepted Answer

ServiceAccount. RBAC bindings can be assigned to Users, Groups, and ServiceAccounts.

Answer

ConfigMap

Answer

Namespace

Answer

PersistentVolume

Question 20

Which THREE of the following are key components of the Kubernetes control plane? (Choose THREE)

Accepted Answer

kube-scheduler. The API server, scheduler, and controller manager are core control plane components.

Answer

container runtime (e.g., containerd)

Answer

kube-proxy