KCSA Practice Test 7 — 10 Questions

Question 1

A security engineer is designing a defense-in-depth strategy for a cloud native application deployment. Which of the following best exemplifies the 'defense-in-depth' principle across the 4Cs layers?

Accepted Answer

Implementing security controls at every layer from Code to Cloud so that a compromise at one layer does not result in total system failure.. Defense-in-depth across the 4Cs means implementing security controls at every layer — Cloud, Cluster, Container, and Code — so that a compromise at one layer does not cascade into total system failure. This layered approach ensures no single point of failure exists in the security posture.

Answer

Granting cluster-admin permissions to all developers to ensure rapid troubleshooting.

Answer

Disabling authentication mechanisms to reduce operational overhead.

Answer

Applying strong firewall rules only at the perimeter of the corporate network.

Question 2

A security analyst wants to scan container images for known Common Vulnerabilities and Exposures (CVEs) as part of a continuous compliance pipeline. Which tool is widely used for this purpose?

Accepted Answer

Trivy. Trivy is an open-source vulnerability scanner for container images, filesystems, and Git repositories. It detects known CVEs in OS packages and application dependencies, making it ideal for continuous compliance pipelines.

Answer

Envoy

Answer

CoreDNS

Answer

Calico

Question 3

Which service account permission model is used by default when a pod is created without specifying a service account name?

Accepted Answer

The 'default' service account in the pod's namespace.. When a pod is created without specifying a serviceAccountName, Kubernetes automatically assigns the 'default' service account from the pod's namespace. This is a built-in behavior: every namespace has a 'default' ServiceAccount created automatically, and the admission controller injects it if none is specified. This default account typically has no extra permissions beyond basic API discovery, but it still exists and can be used for identity.

Answer

No service account is assigned.

Answer

The 'cluster-admin' service account.

Answer

The 'kube-system' privileged service account.

Question 4

Which Kubernetes control plane component is responsible for noticing and responding when nodes go down or fail health checks?

Accepted Answer

kube-controller-manager. The kube-controller-manager runs the node controller, which monitors node health via heartbeats and marks nodes NotReady or unreachable when they fail health checks, then triggers eviction of pods after the toleration period. It is the control plane component responsible for responding to node failures.

Answer

CoreDNS

Answer

etcd

Answer

kube-proxy

Question 5

An administrator wants to ensure that no container in a specific namespace runs with a root User ID (UID 0). Which security context setting should be enforced?

Accepted Answer

runAsNonRoot: true. The runAsNonRoot: true security context setting instructs the kubelet to validate at container start that the image's USER is not UID 0, and to refuse to start the container if it would run as root. Setting it at the pod or container level enforces the no-root requirement across the namespace when combined with Pod Security Admission's restricted profile.

Answer

privileged: false

Answer

readOnlyRootFilesystem: true

Answer

allowPrivilegeEscalation: false

Question 6

Which component is responsible for executing probes (liveness, readiness, startup) against containers running on a worker node?

Accepted Answer

kubelet. The kubelet is the node agent that runs on every worker node and is responsible for managing Pod lifecycle on that node. It receives PodSpecs from the API server and executes the actual container runtime operations, including running liveness, readiness, and startup probes against containers via the container runtime interface (CRI). The kubelet interprets probe definitions (httpGet, tcpSocket, exec, grpc) and periodically executes them, taking action such as restarting containers on liveness failure or removing Pods from Service endpoints on readiness failure.

Answer

kube-scheduler

Answer

kube-controller-manager

Answer

kube-apiserver

Question 7

An administrator needs to grant read-only access to Pods specifically within the 'development' namespace to a new user. Which RBAC configuration correctly scopes this permission?

Accepted Answer

Create a Role for Pod read access in the 'development' namespace and bind it to the user using a RoleBinding in the same namespace.. To grant read-only access to Pods within a specific namespace, you create a Role in that namespace with the necessary permissions and bind it to the user using a RoleBinding in the same namespace. This scopes the permission to the 'development' namespace only, following the principle of least privilege.

Answer

Create a ClusterRole for Pod read access and bind it to the user using a RoleBinding in the 'development' namespace.

Answer

Annotate the user's ServiceAccount with namespace read permissions.

Answer

Create a Role for Pod read access and bind it globally using a ClusterRoleBinding.

Question 8

An administrator needs to evaluate an existing Kubernetes cluster against the CIS Kubernetes Benchmark. Which tool provides automated scanning specifically tailored to this benchmark?

Accepted Answer

kube-bench. kube-bench is an open-source tool from Aqua Security that runs automated checks directly against the CIS Kubernetes Benchmark, inspecting control plane components, kubelet configuration, and node settings. It reports PASS/FAIL/WARN results mapped to specific CIS controls, making it the purpose-built tool for benchmark evaluation.

Answer

kube-hunter

Answer

falco

Answer

velero

Question 9

An organization requires that all container images pulled into a Kubernetes cluster are cryptographically signed and verified before execution. Which tool integrates with Kubernetes admission control to enforce signature verification using Cosign?

Accepted Answer

Kyverno policy engine. Kyverno is a Kubernetes-native policy engine that runs as a dynamic admission controller and can validate, mutate, and generate resources. It supports verifying Cosign signatures on container images via its verifyImages rule, rejecting any pod whose image lacks a valid signature from a trusted key or keyless identity. This makes it the correct tool for enforcing cryptographic image verification at admission time.

Answer

Cilium CNI plugin

Answer

Metrics-server

Answer

Helm package manager

Question 10

In a cloud native environment, what is the primary security purpose of using static code analysis (SAST) and software composition analysis (SCA) tools in the CI/CD pipeline?

Accepted Answer

To identify vulnerabilities and insecure coding patterns in the Code layer before deployment. SAST tools analyze source code for insecure coding patterns such as SQL injection or hardcoded secrets, while SCA tools identify vulnerable open-source dependencies and their licenses. Both operate on the Code layer of the CI/CD pipeline, catching issues before deployment, which is far cheaper than remediating in production.

Answer

To provision cloud networking security groups automatically

Answer

To manage worker node operating system updates

Answer

To detect running process anomalies in production pods