KCSA Practice Test 6 — 10 Questions

Question 1

By default, how are Kubernetes Secrets stored in etcd when created without additional encryption-at-rest configurations?

Accepted Answer

Encoded in Base64 plaintext. By default, Kubernetes Secrets are stored encoded in Base64 plaintext within etcd, meaning anyone with etcd access can decode them.

Answer

Hashed using SHA-256 with a random salt

Answer

Encrypted using the node's TPM chip

Answer

Encrypted using AES-256 automatically

Question 2

An administrator wants to ensure that no container in a specific namespace runs with a root User ID (UID 0). Which security context setting should be enforced?

Accepted Answer

runAsNonRoot: true. Setting 'runAsNonRoot: true' in the security context forces the container runtime to reject containers that attempt to run as UID 0.

Answer

privileged: false

Answer

readOnlyRootFilesystem: true

Answer

allowPrivilegeEscalation: false

Question 3

Which TWO of the following API server configuration flags help enforce cryptographic and transport security? (Choose TWO)

Accepted Answer

--tls-cipher-suites to specify permitted strong cryptographic cipher suites.. --tls-min-version and --tls-cipher-suites enforce transport security standards.

Answer

--anonymous-auth to enable unauthenticated cluster access.

Answer

--insecure-port to allow unencrypted HTTP traffic.

Answer

--enable-http2=false to disable secure multiplexing.

Question 4

Under the Pod Security Standards, a developer attempts to deploy a pod with 'privileged: true' in a namespace labeled with 'pod-security.kubernetes.io/enforce=baseline'. What will happen?

Accepted Answer

The admission controller will reject the pod creation request with an error.. The 'baseline' profile prohibits privileged containers. The admission controller will reject the pod creation request.

Answer

The pod will run in a restricted sandbox environment automatically.

Answer

The pod will be created successfully, but a warning will be logged in the audit log.

Answer

The kubelet will automatically strip the 'privileged: true' setting and run the pod safely.

Question 5

You are deploying a ValidatingWebhookConfiguration to inspect incoming pod creations. What happens if the webhook fails and the 'failurePolicy' in the webhook configuration is set to 'Fail'?

Accepted Answer

The API request is rejected.. When failurePolicy is set to 'Fail', any error or timeout reaching the external webhook causes the API server to reject the API request.

Answer

The API request is allowed to proceed without validation.

Answer

The pod is created in a suspended state until the webhook recovers.

Answer

The kube-apiserver restarts automatically.

Question 6

You are reviewing admission webhook configurations and notice that timeoutSeconds is set to 3 seconds for a critical validation webhook. If the webhook server takes 4 seconds to respond, what does the API server do when failurePolicy is 'Ignore'?

Accepted Answer

It allows the API request to proceed as if the webhook succeeded.. When failurePolicy is 'Ignore', a timeout or error reaching the webhook results in the API server ignoring the failure and allowing the request to proceed.

Answer

It quarantines the pod in a Pending state.

Answer

It rejects the API request immediately.

Answer

It retries the webhook request indefinitely until it responds.

Question 7

An application pod requires access to the Kubernetes API to list other pods. To follow secure practices, you create a dedicated ServiceAccount and bind a custom Role to it. How should you configure the Pod specification to prevent the default service account token from being automatically mounted?

Accepted Answer

Set 'automountServiceAccountToken: false' in the Pod specification.. Setting 'automountServiceAccountToken: false' on either the ServiceAccount or the Pod specification prevents the automatic mounting of the token, reducing the blast radius if compromised.

Answer

Delete the 'default' ServiceAccount in the namespace.

Answer

Configure the Pod securityContext with 'readOnlyRootFilesystem: true'.

Answer

Add a deny NetworkPolicy blocking egress to the Kubernetes API service IP.

Question 8

An application pod needs to mount a Secret as environment variables. Which section of the Pod manifest should be configured to achieve this securely?

Accepted Answer

Using 'env' with 'valueFrom.secretKeyRef' or 'envFrom' with 'secretRef' in the container specification.. Environment variables can be populated from Secrets using 'envFrom' or 'env' with 'valueFrom.secretKeyRef'.

Answer

Using 'volumeMounts' pointing to a PersistentVolumeClaim bound to the Secret.

Answer

Adding the Secret name directly to the container imagePullSecrets field.

Answer

Declaring the Secret in the container securityContext block.

Question 9

Which THREE components are involved when an external client authenticates to the Kubernetes API server using OpenID Connect (OIDC)? (Choose THREE)

Accepted Answer

The OIDC Identity Provider (IdP) issuing ID tokens.. OIDC authentication involves the client (e.g. kubectl), the OIDC identity provider, and the kube-apiserver.

Answer

The CoreDNS server resolving the OIDC provider domain.

Answer

The Kubelet running on worker nodes.

Question 10

An administrator wants to audit who created or modified specific resources in the cluster. Where are API server audit records sent if configured with the log backend?

Accepted Answer

To the file path specified by --audit-log-path on the control plane host.. When using the log audit backend, audit records are written to a file path specified by --audit-log-path.

Answer

Directly to the etcd key-value store under /audit/logs.

Answer

To the container stdout of kube-proxy.

Answer

To the kubelet systemd journal on worker nodes.