KCSA Compliance And Security Frameworks — 25 Questions

Question 1

An administrator is reviewing the CIS Kubernetes Benchmark for node security. Which TWO of the following settings are explicitly recommended by CIS to secure kubelet configurations? (Choose TWO)

Accepted Answer

Ensure that the --anonymous-auth argument is set to false. CIS benchmarks recommend ensuring authorization mode is webhook and disabling anonymous authentication on the kubelet.

Answer

Ensure that the --tls-cert-file argument is omitted

Question 2

An auditor is assessing compliance with NIST SP 800-53 controls for access control (AC) within a managed Kubernetes cluster. Which API object enforces fine-grained authorization decisions directly at the Kubernetes API server?

Accepted Answer

ClusterRoleBinding. Kubernetes Role-Based Access Control (RBAC), implemented via ClusterRole and Role bindings, enforces NIST-aligned access control policies at the API server layer.

Answer

ValidatingWebhookConfiguration

Answer

NetworkPolicy

Answer

ResourceQuota

Question 3

An enterprise is adopting the Cloud Native Security Framework to map their controls. Which of the 4Cs of Cloud Native Security represents the outermost layer encompassing physical data centers and hardware?

Accepted Answer

Cloud. The 4Cs of Cloud Native Security are Cloud, Clusters, Containers, and Code. Cloud is the outermost layer representing physical infrastructure and provider security.

Answer

Clusters

Answer

Code

Answer

Containers

Question 4

According to the CIS Kubernetes Benchmark, anonymous requests to the Kubernetes API server should be disabled. Which kube-apiserver flag enforces this setting?

Accepted Answer

--anonymous-auth=false. The flag --anonymous-auth=false disables anonymous requests to the secure port of the API server, fulfilling CIS benchmark requirements.

Answer

--authorization-mode=Node,RBAC

Answer

--enable-admission-plugins

Answer

--insecure-port=0

Question 5

A compliance officer wants to continuously audit Kubernetes resource manifests for misconfigurations against security best practices before they are applied. Which tool type is best suited for this shift-left compliance approach?

Accepted Answer

Static code analysis and admission controllers. Policy-as-code engines like OPA Gatekeeper or Kyverno validate and audit Kubernetes manifests prior to admission into the cluster.

Answer

Log shippers

Answer

Packet analyzers

Answer

Kernel debuggers

Question 6

A security team is implementing NIST SP 800-190 guidelines for container runtime security. Which kernel feature is leveraged by container runtimes to restrict system calls and meet least-privilege execution requirements?

Accepted Answer

Seccomp profiles. Seccomp (secure computing mode) filters system calls made by containers, aligning with NIST guidelines to restrict container capabilities and reduce attack surface.

Answer

cgroups v2

Answer

AppArmor MAC profiles

Answer

Namespaces

Question 7

A security engineer is reviewing the NIST SP 800-190 container security application and needs to identify the primary control category for securing container image registries. Under NIST guidelines, which layer is primarily responsible for verifying the integrity of images before deployment?

Accepted Answer

Registry security. NIST SP 800-190 emphasizes that image integrity must be validated at the registry and build pipeline level using cryptographic signing and vulnerability scanning.

Answer

Host OS security

Answer

Runtime orchestration security

Answer

Cluster networking

Question 8

An auditor notices that kubelet authentication is set to always allow anonymous access in a cluster configuration. According to the CIS Benchmark, what should the kubelet configuration parameter "authentication.anonymous.enabled" be set to?

Accepted Answer

false. The CIS Benchmark specifies that kubelet anonymous access must be disabled by setting authentication.anonymous.enabled to false.

Answer

strict

Answer

auto

Answer

true

Question 9

An administrator needs to evaluate an existing Kubernetes cluster against the CIS Kubernetes Benchmark. Which tool provides automated scanning specifically tailored to this benchmark?

Accepted Answer

kube-bench. Kube-bench is an open-source tool that checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes Benchmark.

Answer

kube-hunter

Answer

falco

Answer

velero

Question 10

Which CNCF project acts as a cloud-native runtime security and intrusion detection tool that monitors system calls against predefined security rules?

Accepted Answer

Falco. Falco is the CNCF incubating runtime security tool that acts as a security camera for containers, detecting anomalous behavior and policy violations.

Answer

Trivy

Answer

Fluentd

Answer

Cert-manager

Question 11

To comply with CIS benchmarks regarding pod security, an administrator wants to prevent containers from running with root privileges. Which field in a Pod Security Standard (restricted profile) enforces this?

Accepted Answer

runAsNonRoot: true. The restricted Pod Security Standard profile disallows running containers as root by enforcing runAsNonRoot: true in the securityContext.

Answer

hostNetwork: true

Answer

readOnlyRootFilesystem: false

Answer

privileged: true

Question 12

A security engineer is configuring kube-apiserver audit logging to satisfy NIST compliance requirements. Which configuration file specifies which requests are logged and at what log level?

Accepted Answer

Audit policy file. An audit policy file passed via --audit-policy-file defines rules for what events are recorded and what log level is applied in Kubernetes.

Answer

kubeadm.conf

Answer

Kubelet configuration file

Answer

Admission configuration YAML

Question 13

An enterprise undergoes an ISO/IEC 27001 audit for their Kubernetes environment. The auditor requests evidence that secrets at rest are encrypted. Which configuration component enables encryption of Secret resources in etcd?

Accepted Answer

EncryptionConfiguration API. The EncryptionConfiguration resource passed to the kube-apiserver via --encryption-provider-config enables encryption of sensitive resources like Secrets at rest in etcd.

Answer

Kubelet TLS bootstrapping

Answer

SecretProviderClass CRD

Answer

ServiceAccount token volume projection

Question 14

Which NIST framework publication specifically addresses the security of container-based applications and orchestration systems?

Accepted Answer

NIST SP 800-190. NIST SP 800-190 is the Application Container Security Guide, providing specific security guidance for container environments.

Answer

NIST SP 800-37

Answer

NIST SP 800-53

Answer

NIST SP 800-88

Question 15

An auditor is reviewing compliance with CIS Kubernetes Benchmark control 1.2.20, which relates to the kube-apiserver admission control configuration. Which admission plugin is recommended by CIS to prevent default service accounts from automatically mounting API credentials?

Accepted Answer

ServiceAccount. The ServiceAccount admission controller, along with disabling automatic token mounting via serviceAccountName/automountServiceAccountToken, is governed by admission plugins. Specifically, NamespaceLifecycle and PodNodeSecurity are relevant, but for service account automation management, the ServiceAccount admission controller governs default behavior.

Answer

DefaultTolerationSeconds

Answer

AlwaysAdmit

Answer

NodeRestriction

Question 16

A security team needs to ensure that Kubernetes nodes have secure file permissions for the kubelet configuration files, in alignment with CIS benchmarks. What should the file permissions on "/etc/kubernetes/kubelet.conf" typically be set to?

Accepted Answer

600. CIS benchmarks state that configuration files containing sensitive credentials, such as kubelet.conf, must have permissions set to 600 or stricter and be owned by root:root.

Answer

777

Answer

755

Answer

644

Question 17

A security analyst wants to scan container images for known Common Vulnerabilities and Exposures (CVEs) as part of a continuous compliance pipeline. Which tool is widely used for this purpose?

Accepted Answer

Trivy. Trivy is a popular open-source vulnerability scanner for containers, filesystems, and Git repositories.

Answer

Envoy

Answer

CoreDNS

Answer

Calico

Question 18

Under NIST guidelines for continuous monitoring in cloud-native environments, which Kubernetes mechanism allows operators to enforce cryptographic integrity of container images at runtime?

Accepted Answer

Image signing and verification via admission controllers. Admission controllers like Gatekeeper or Kyverno working alongside image signature verification tools (like Cosign) enforce cryptographic image signatures before admission.

Answer

Increasing pod memory limits

Answer

Disabling the default namespace

Answer

Using ClusterRoleBindings with wildcards

Question 19

An organization requires compliance auditing of etcd access to ensure unauthorized clients cannot communicate with the data store. According to CIS benchmarks, how should etcd client communication be secured?

Accepted Answer

Mutual TLS (mTLS) client certificates. CIS benchmarks require etcd client communication to be authenticated and encrypted using mutual TLS (mTLS).

Answer

IPsec tunnel encapsulation

Answer

HTTP with token bearer headers

Answer

Plaintext loopback interface binding

Question 20

Which open-source auditing tool provides compliance scores and checks against Kubernetes security frameworks such as NSA-CISA and CIS?

Accepted Answer

Kubescape. Datree or Kubescape are prominent tools for compliance scoring. Kubescape specifically evaluates Kubernetes clusters against multiple security frameworks including CIS and NSA-CISA.

Answer

Kube-dns

Answer

Metric-server

Answer

Cilium