KCSA Compliance And Security Frameworks — 25 Questions

Question 1

A security engineer is reviewing the NIST SP 800-190 container security application and needs to identify the primary control category for securing container image registries. Under NIST guidelines, which layer is primarily responsible for verifying the integrity of images before deployment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Registry security. NIST SP 800-190 defines the container security lifecycle in layers, and the registry layer is explicitly responsible for image integrity verification, signing, and vulnerability scanning before deployment. The registry acts as the trusted source of truth, and controls like content trust (Notary), image signing (Cosign), and admission controllers that verify signatures are all registry-layer concerns. This is why 'Registry security' is the correct primary control category for verifying image integrity.

Answer

Host OS security

Answer

Runtime orchestration security

Answer

Cluster networking

Question 2

To comply with CIS benchmarks regarding pod security, an administrator wants to prevent containers from running with root privileges. Which field in a Pod Security Standard (restricted profile) enforces this?

Accepted Answer

runAsNonRoot: true. In the Kubernetes Pod Security Standards restricted profile, runAsNonRoot: true is the field that enforces containers cannot run as UID 0 (root). The restricted profile requires this at the pod or container securityContext level, and the kubelet will refuse to start the container if the image's USER is root or unset. This directly satisfies CIS Benchmark controls (e.g., 5.2.6) that prohibit root containers.

Answer

hostNetwork: true

Answer

readOnlyRootFilesystem: false

Answer

privileged: true

Question 3

An auditor is reviewing compliance with CIS Kubernetes Benchmark control 1.2.20, which relates to the kube-apiserver admission control configuration. Which admission plugin is recommended by CIS to prevent default service accounts from automatically mounting API credentials?

Accepted Answer

ServiceAccount. The ServiceAccount admission controller, along with disabling automatic token mounting via serviceAccountName/automountServiceAccountToken, is governed by admission plugins. Specifically, NamespaceLifecycle and PodNodeSecurity are relevant, but for service account automation management, the ServiceAccount admission controller governs default behavior.

Answer

DefaultTolerationSeconds

Answer

AlwaysAdmit

Answer

NodeRestriction

Question 4

An administrator is reviewing the CIS Kubernetes Benchmark for node security. Which TWO of the following settings are explicitly recommended by CIS to secure kubelet configurations? (Choose TWO)

Accepted Answer

Ensure that the --anonymous-auth argument is set to false. CIS benchmarks recommend ensuring authorization mode is webhook and disabling anonymous authentication on the kubelet.

Answer

Ensure that the --tls-cert-file argument is omitted

Question 5

A platform team is preparing for a SOC 2 Type II audit of their Kubernetes-based SaaS. The auditor asks how they ensure that container workloads cannot run with excessive privileges that would violate the principle of least privilege. The team already enforces Pod Security Standards at the namespace level. Which additional Kubernetes-native mechanism should they implement to satisfy the auditor's requirement for defense in depth?

Accepted Answer

Deploy an Open Policy Agent (OPA) Gatekeeper policy that blocks containers with allowPrivilegeEscalation set to true.. An admission controller like OPA Gatekeeper enforces policies at pod creation time, ensuring that containers cannot request privilege escalation. This provides a preventive, auditable control that complements Pod Security Standards. The other options address node authorization, API access, or network traffic, none of which directly limit container process privileges. For SOC 2, evidence of enforced least privilege at the workload level is required.

Answer

Enable the NodeRestriction admission controller to limit kubelet permissions.

Answer

Configure the kube-apiserver with --authorization-mode=RBAC,Node.

Answer

Use Kubernetes NetworkPolicies to deny all ingress traffic to the workloads.

Question 6

An auditor is assessing compliance with NIST SP 800-53 controls for access control (AC) within a managed Kubernetes cluster. Which API object enforces fine-grained authorization decisions directly at the Kubernetes API server?

Accepted Answer

ClusterRoleBinding. ClusterRoleBinding is the Kubernetes RBAC API object that binds a ClusterRole (or Role) to subjects (users, groups, service accounts) cluster-wide, and the API server evaluates these bindings during authorization. It directly enforces fine-grained authorization decisions at the API server, satisfying NIST SP 800-53 AC controls for least privilege and role-based access. Without a binding, a role grants nothing — the binding is what activates the permissions.

Answer

ValidatingWebhookConfiguration

Answer

NetworkPolicy

Answer

ResourceQuota

Question 7

An enterprise is adopting the Cloud Native Security Framework to map their controls. Which of the 4Cs of Cloud Native Security represents the outermost layer encompassing physical data centers and hardware?

Accepted Answer

Cloud. The Cloud layer is the outermost of the 4Cs of Cloud Native Security (Cloud, Clusters, Containers, Code), representing the underlying infrastructure — physical data centers, hardware, and the cloud provider's IaaS layer. It encompasses the security of the cloud provider's environment, including physical security, hypervisor security, and network infrastructure. The 4Cs model, popularized by Kubernetes, emphasizes that security at each inner layer depends on the outer layer.

Answer

Clusters

Answer

Code

Answer

Containers

Question 8

According to the CIS Kubernetes Benchmark, anonymous requests to the Kubernetes API server should be disabled. Which kube-apiserver flag enforces this setting?

Accepted Answer

--anonymous-auth=false. The --anonymous-auth=false flag on the kube-apiserver disables anonymous requests, as recommended by the CIS Kubernetes Benchmark. This forces all requests to be authenticated.

Answer

--authorization-mode=Node,RBAC

Answer

--enable-admission-plugins

Answer

--insecure-port=0

Question 9

A compliance officer wants to continuously audit Kubernetes resource manifests for misconfigurations against security best practices before they are applied. Which tool type is best suited for this shift-left compliance approach?

Accepted Answer

Static code analysis and admission controllers. Static code analysis tools (e.g., kube-score, Checkov, kube-linter) scan YAML manifests in CI/CD pipelines to catch misconfigurations like missing resource limits or privileged containers before deployment. Admission controllers (e.g., OPA Gatekeeper, Kyverno) enforce policies at the API server level, rejecting non-compliant resources at admission time. Together, they provide continuous, shift-left auditing that prevents misconfigured workloads from ever reaching the cluster.

Answer

Log shippers

Answer

Packet analyzers

Answer

Kernel debuggers

Question 10

A security team is implementing NIST SP 800-190 guidelines for container runtime security. Which kernel feature is leveraged by container runtimes to restrict system calls and meet least-privilege execution requirements?

Accepted Answer

Seccomp profiles. Seccomp (secure computing mode) profiles are the kernel feature that filters which system calls a container process may invoke, directly enforcing least-privilege execution at the syscall boundary. NIST SP 800-190 explicitly calls out seccomp as a runtime control to reduce the kernel attack surface. By applying a seccomp profile (e.g., RuntimeDefault or a custom allowlist), the runtime blocks dangerous syscalls like ptrace or mount that a compromised container might abuse.

Answer

cgroups v2

Answer

AppArmor MAC profiles

Answer

Namespaces

Question 11

An auditor notices that kubelet authentication is set to always allow anonymous access in a cluster configuration. According to the CIS Benchmark, what should the kubelet configuration parameter "authentication.anonymous.enabled" be set to?

Accepted Answer

false. The CIS Kubernetes Benchmark explicitly requires that anonymous authentication to the kubelet be disabled. Setting authentication.anonymous.enabled to false ensures that unauthenticated requests to the kubelet's HTTPS endpoint are rejected, forcing all clients to authenticate. This prevents unauthorized users or workloads from querying sensitive node information or executing commands via the kubelet API.

Answer

strict

Answer

auto

Answer

true

Question 12

An administrator needs to evaluate an existing Kubernetes cluster against the CIS Kubernetes Benchmark. Which tool provides automated scanning specifically tailored to this benchmark?

Accepted Answer

kube-bench. kube-bench is an open-source tool from Aqua Security that runs automated checks directly against the CIS Kubernetes Benchmark, inspecting control plane components, kubelet configuration, and node settings. It reports PASS/FAIL/WARN results mapped to specific CIS controls, making it the purpose-built tool for benchmark evaluation.

Answer

kube-hunter

Answer

falco

Answer

velero

Question 13

Which CNCF project acts as a cloud-native runtime security and intrusion detection tool that monitors system calls against predefined security rules?

Accepted Answer

Falco. Falco is the CNCF-graduated cloud-native runtime security project that detects anomalous activity and intrusions by monitoring Linux system calls (and Kubernetes audit events) against a rule engine. It uses a kernel module or eBPF probe to capture syscalls and evaluates them against YAML-defined rules, generating alerts when behavior matches known attack patterns. This makes it the canonical answer for runtime threat detection in Kubernetes environments.

Answer

Trivy

Answer

Fluentd

Answer

Cert-manager

Question 14

A security engineer is configuring kube-apiserver audit logging to satisfy NIST compliance requirements. Which configuration file specifies which requests are logged and at what log level?

Accepted Answer

Audit policy file. The audit policy file is the Kubernetes resource that defines which requests are logged and at what level (None, Metadata, Request, RequestResponse). It is passed to the kube-apiserver via the --audit-policy-file flag, and the apiserver evaluates each request against the policy rules to determine logging behavior. Other configuration files govern different components and do not control audit logging.

Answer

kubeadm.conf

Answer

Kubelet configuration file

Answer

Admission configuration YAML

Question 15

An enterprise undergoes an ISO/IEC 27001 audit for their Kubernetes environment. The auditor requests evidence that secrets at rest are encrypted. Which configuration component enables encryption of Secret resources in etcd?

Accepted Answer

EncryptionConfiguration API. The EncryptionConfiguration API in Kubernetes defines how etcd encrypts Secret and other resources at rest, specifying providers (e.g., aesgcm, aescbc, kms) and key material. Auditors verifying ISO/IEC 27001 encryption-at-rest controls for Kubernetes look for this configuration as evidence. It is the authoritative component for encrypting Secret resources in etcd.

Answer

Kubelet TLS bootstrapping

Answer

SecretProviderClass CRD

Answer

ServiceAccount token volume projection

Question 16

Which NIST framework publication specifically addresses the security of container-based applications and orchestration systems?

Accepted Answer

NIST SP 800-190. NIST SP 800-190, 'Application Container Security Guide', specifically addresses the security of container-based applications and orchestration systems. It provides guidance on container threats, vulnerabilities, and countermeasures, making it the correct publication for this topic.

Answer

NIST SP 800-37

Answer

NIST SP 800-53

Answer

NIST SP 800-88

Question 17

A security team needs to ensure that Kubernetes nodes have secure file permissions for the kubelet configuration files, in alignment with CIS benchmarks. What should the file permissions on "/etc/kubernetes/kubelet.conf" typically be set to?

Accepted Answer

600. CIS Kubernetes Benchmark control 4.1.1 requires that kubelet configuration files such as /etc/kubernetes/kubelet.conf be owned by root:root and have permissions of 600 or more restrictive. The 600 permission means only the owner (root) can read and write the file, preventing non-privileged users from reading the kubelet's credentials — which include the client certificate and key used to authenticate to the API server. If these files were world-readable, any local user could impersonate the kubelet and potentially escalate privileges within the cluster.

Answer

777

Answer

755

Answer

644

Question 18

A security analyst wants to scan container images for known Common Vulnerabilities and Exposures (CVEs) as part of a continuous compliance pipeline. Which tool is widely used for this purpose?

Accepted Answer

Trivy. Trivy is an open-source vulnerability scanner for container images, filesystems, and Git repositories. It detects known CVEs in OS packages and application dependencies, making it ideal for continuous compliance pipelines.

Answer

Envoy

Answer

CoreDNS

Answer

Calico

Question 19

Under NIST guidelines for continuous monitoring in cloud-native environments, which Kubernetes mechanism allows operators to enforce cryptographic integrity of container images at runtime?

Accepted Answer

Image signing and verification via admission controllers. Admission controllers in Kubernetes can intercept pod creation requests and validate that container images are signed by trusted authorities before allowing them to run. By integrating image signing (e.g., Cosign/Notary) with an admission controller (e.g., OPA Gatekeeper, Kyverno, or the Sigstore policy controller), operators enforce cryptographic integrity at runtime admission. This directly satisfies NIST continuous monitoring guidance for verifying artifact integrity in cloud-native environments.

Answer

Increasing pod memory limits

Answer

Disabling the default namespace

Answer

Using ClusterRoleBindings with wildcards

Question 20

An organization requires compliance auditing of etcd access to ensure unauthorized clients cannot communicate with the data store. According to CIS benchmarks, how should etcd client communication be secured?

Accepted Answer

Mutual TLS (mTLS) client certificates. CIS Kubernetes Benchmark requires that etcd client communication be encrypted and mutually authenticated. Mutual TLS (mTLS) ensures both the client and the etcd server present certificates signed by a trusted CA, preventing unauthorized clients from connecting. This is enforced via flags like --cert-file, --key-file, --client-cert-auth, and --trusted-ca-file on the etcd server.

Answer

IPsec tunnel encapsulation

Answer

HTTP with token bearer headers

Answer

Plaintext loopback interface binding