KCSA Practice Test 8 — 10 Questions

Question 1

Which TWO of the following files or directories on a control plane node contain critical static pod manifests for core components? (Choose TWO)

Accepted Answer

/etc/kubernetes/manifests/etcd.yaml. The /etc/kubernetes/manifests directory holds static pod yaml files for kube-apiserver, etcd, etc.

Answer

/var/lib/kubelet/config.yaml

Answer

/etc/default/kube-proxy

Answer

~/.kube/config

Question 2

Which THREE of the following mechanisms are used by the Kubernetes API server to authorize requests after authentication succeeds? (Choose THREE)

Accepted Answer

RBAC (Role-Based Access Control) authorizer.. Kubernetes supports Node, RBAC, and Webhook authorization modes.

Answer

Etcd consensus authorizer.

Answer

Kube-proxy IPVS routing authorizer.

Question 3

A security engineer wants to apply Pod Security Standards globally across an entire namespace using the modern built-in admission mechanism. Which approach should be used?

Accepted Answer

Apply labels such as 'pod-security.kubernetes.io/enforce=restricted' to the namespace metadata.. The Pod Security admission controller uses namespace labels (such as 'pod-security.kubernetes.io/enforce') to apply enforcement levels like privileged, baseline, or restricted.

Answer

Create a MutatingWebhookConfiguration that injects security contexts into every pod spec.

Answer

Modify the kubelet configuration file on every worker node to enable restricted mode.

Answer

Deploy a custom PodSecurityPolicy object targeting the namespace selector.

Question 4

Your team is storing sensitive database credentials in Kubernetes Secrets. A security review reveals that base64 encoding does not provide encryption at rest. What mechanism should you enable to ensure Secrets are encrypted when stored in etcd?

Accepted Answer

Configure an EncryptionConfiguration file and reference it via the '--encryption-provider-config' flag on the kube-apiserver.. Enabling EncryptionConfiguration with providers like aescbc or kms ensures that API server encrypts secret data before writing it to etcd.

Answer

Apply a MutatingWebhookConfiguration to automatically hash passwords using bcrypt.

Answer

Enable TLS encryption for all intra-cluster communication using kubeadm configuration.

Answer

Set the secret type to 'kubernetes.io/encrypted-secret'.

Question 5

An auditor notices that a secret is mounted as a volume in a pod. Where is this secret stored on the worker node filesystem by default?

Accepted Answer

In tmpfs (memory), ensuring it is not written to non-volatile disk storage.. Kubernetes secrets mounted as volumes are stored in tmpfs (RAM-backed memory) on the worker node, preventing them from being written to persistent disk storage.

Answer

In an encrypted SQLite database on the node's root partition.

Answer

In plaintext files inside /etc/kubernetes/secrets on the node's hard drive.

Answer

Inside the container image layer cache.

Question 6

Which TWO types of selectors can be used within a Kubernetes NetworkPolicy ingress rule to specify allowed traffic sources?

Accepted Answer

namespaceSelector. Ingress 'from' blocks support podSelector and namespaceSelector to match traffic sources.

Answer

serviceSelector

Answer

ingressSelector

Answer

nodeSelector

Question 7

Which TWO components are core parts of the Kubernetes authorization architecture? (Choose TWO)

Accepted Answer

Webhook Authorization. RBAC and Webhook are authorization modes evaluated by the API server after authentication.

Answer

CoreDNS service discovery

Answer

Kubelet node daemon

Answer

etcd key-value datastore

Question 8

Which TWO of the following are valid ways to harden etcd against unauthorized access and data corruption? (Choose TWO)

Accepted Answer

Require mutual TLS (mTLS) for all client and peer connections.. Enforcing client certificate authentication and taking regular encrypted snapshots secure etcd.

Answer

Expose etcd directly over unencrypted HTTP on port 2379.

Answer

Disable client certificate verification to allow unrestricted access.

Answer

Grant public anonymous write access to the etcd raft log.

Question 9

A cluster administrator needs to grant read-only access to pods within the 'development' namespace using Kubernetes RBAC. Which resource kind should be used to define the permissions?

Accepted Answer

Role. A Role defines permissions within a specific namespace, whereas a ClusterRole defines cluster-scoped permissions. Since the requirement is restricted to the 'development' namespace, a Role is the correct resource.

Answer

SecurityContextConstraints

Answer

PodSecurityPolicy

Answer

ClusterRole

Question 10

Which TWO tools or built-in Kubernetes features are used to secure container privileges and behaviors?

Accepted Answer

Pod Security Standards. Pod Security Standards and security contexts are core mechanisms for securing container privileges.

Answer

PersistentVolumeClaim

Answer

HorizontalPodAutoscaler

Answer

IngressController