KCSA Compliance And Security Frameworks Practice Test 2 — 15 Questions

Question 1

Which NIST framework publication specifically addresses the security of container-based applications and orchestration systems?

Accepted Answer

NIST SP 800-190. NIST SP 800-190, 'Application Container Security Guide', specifically addresses the security of container-based applications and orchestration systems. It provides guidance on container threats, vulnerabilities, and countermeasures, making it the correct publication for this topic.

Answer

NIST SP 800-37

Answer

NIST SP 800-53

Answer

NIST SP 800-88

Question 2

A security team needs to ensure that Kubernetes nodes have secure file permissions for the kubelet configuration files, in alignment with CIS benchmarks. What should the file permissions on "/etc/kubernetes/kubelet.conf" typically be set to?

Accepted Answer

600. CIS Kubernetes Benchmark control 4.1.1 requires that kubelet configuration files such as /etc/kubernetes/kubelet.conf be owned by root:root and have permissions of 600 or more restrictive. The 600 permission means only the owner (root) can read and write the file, preventing non-privileged users from reading the kubelet's credentials — which include the client certificate and key used to authenticate to the API server. If these files were world-readable, any local user could impersonate the kubelet and potentially escalate privileges within the cluster.

Answer

777

Answer

755

Answer

644

Question 3

A security analyst wants to scan container images for known Common Vulnerabilities and Exposures (CVEs) as part of a continuous compliance pipeline. Which tool is widely used for this purpose?

Accepted Answer

Trivy. Trivy is an open-source vulnerability scanner for container images, filesystems, and Git repositories. It detects known CVEs in OS packages and application dependencies, making it ideal for continuous compliance pipelines.

Answer

Envoy

Answer

CoreDNS

Answer

Calico

Question 4

Under NIST guidelines for continuous monitoring in cloud-native environments, which Kubernetes mechanism allows operators to enforce cryptographic integrity of container images at runtime?

Accepted Answer

Image signing and verification via admission controllers. Admission controllers in Kubernetes can intercept pod creation requests and validate that container images are signed by trusted authorities before allowing them to run. By integrating image signing (e.g., Cosign/Notary) with an admission controller (e.g., OPA Gatekeeper, Kyverno, or the Sigstore policy controller), operators enforce cryptographic integrity at runtime admission. This directly satisfies NIST continuous monitoring guidance for verifying artifact integrity in cloud-native environments.

Answer

Increasing pod memory limits

Answer

Disabling the default namespace

Answer

Using ClusterRoleBindings with wildcards

Question 5

An organization requires compliance auditing of etcd access to ensure unauthorized clients cannot communicate with the data store. According to CIS benchmarks, how should etcd client communication be secured?

Accepted Answer

Mutual TLS (mTLS) client certificates. CIS Kubernetes Benchmark requires that etcd client communication be encrypted and mutually authenticated. Mutual TLS (mTLS) ensures both the client and the etcd server present certificates signed by a trusted CA, preventing unauthorized clients from connecting. This is enforced via flags like --cert-file, --key-file, --client-cert-auth, and --trusted-ca-file on the etcd server.

Answer

IPsec tunnel encapsulation

Answer

HTTP with token bearer headers

Answer

Plaintext loopback interface binding

Question 6

Which open-source auditing tool provides compliance scores and checks against Kubernetes security frameworks such as NSA-CISA and CIS?

Accepted Answer

Kubescape. Kubescape is an open-source Kubernetes security platform that scans clusters and manifests against frameworks like NSA-CISA, MITRE ATT&CK, and CIS Benchmarks, producing compliance scores and remediation guidance. It is specifically designed for Kubernetes posture management and is widely used in CNCF-aligned environments. The other options are Kubernetes components or networking tools, not auditing/compliance scanners.

Answer

Kube-dns

Answer

Metric-server

Answer

Cilium

Question 7

A security engineer needs to verify that control plane component pods (such as kube-apiserver and etcd) have correct file ownership on the control plane node. According to CIS benchmarks, who should own these manifest files located in "/etc/kubernetes/manifests"?

Accepted Answer

root:root. CIS Kubernetes Benchmark requires that control plane manifest files in /etc/kubernetes/manifests (static pod manifests for kube-apiserver, etcd, kube-controller-manager, kube-scheduler) be owned by root:root with permissions 644 or more restrictive. This prevents unprivileged users from modifying critical control plane definitions.

Answer

nobody:nogroup

Answer

daemon:daemon

Answer

kube:kube

Question 8

An auditor reviews container runtime configurations for compliance with NIST SP 800-190 recommendations on privilege escalation. Which Kubernetes feature controls whether a process can gain more privileges than its parent process?

Accepted Answer

allowPrivilegeEscalation: false. allowPrivilegeEscalation: false is the Kubernetes SecurityContext field that directly controls whether a process can gain more privileges than its parent process, aligning with NIST SP 800-190 guidance on preventing privilege escalation. When set to false, it sets the kernel's no_new_privs flag on the container process, blocking setuid/setgid binaries and file capabilities from elevating privileges. This is the precise control the auditor is looking for.

Answer

automountServiceAccountToken: false

Answer

runAsUser: 1000

Answer

privileged: false

Question 9

A compliance team is adopting the NIST SP 800-190 standard to secure their container image pipeline. Which THREE practices are recommended in this framework for managing container images? (Choose THREE)

Accepted Answer

Employ trusted base images from verified publishers. NIST SP 800-190 Section 3.1 (Image Vulnerabilities) recommends using trusted base images from verified publishers (A) to reduce the risk of inheriting vulnerabilities or malicious code from untrusted sources, since every layer of a container image becomes part of the running container. The framework also calls for vulnerability scanning throughout the image lifecycle, including in the CI/CD pipeline and the registry (B), so that known CVEs are detected before deployment and continuously re-evaluated as new vulnerabilities are disclosed. Additionally, NIST SP 800-190 recommends digitally signing images and verifying those signatures (E) to establish provenance and integrity, ensuring that only images from authorized sources are deployed and that images have not been tampered with. Option C is incorrect because storing plaintext passwords in Dockerfile ENV directives exposes secrets in image layers and metadata, directly violating NIST guidance on protecting secrets. Option D is incorrect because relying exclusively on public unverified base images increases supply-chain risk and contradicts the recommendation to use trusted, verified image sources.

Answer

Store plaintext passwords directly inside Dockerfile ENV directives

Answer

Rely exclusively on public unverified base images to speed up development

Question 10

An enterprise is enforcing the CIS Kubernetes Benchmark for control plane configuration. Which TWO parameters must be correctly configured on the kube-apiserver to meet strict compliance auditing standards? (Choose TWO)

Accepted Answer

--audit-policy-file. Option A (--audit-policy-file) is correct because the CIS Kubernetes Benchmark requires the API server to have an audit policy defined that specifies what events are recorded and at what level; without this flag the apiserver cannot apply a compliant audit policy. Option E (--audit-log-path) is correct because CIS requires audit logging to be enabled and written to a defined destination, and this flag sets the file path where audit events are persisted for compliance auditing. Option B (--service-account-lookup=false) is wrong because CIS requires service account token lookup to remain enabled (true), since disabling it weakens token validation. Option C (--enable-bootstrap-auth-only=true) is wrong because it is not a valid kube-apiserver flag and does not correspond to any CIS control. Option D (--profiling=true) is wrong because CIS recommends disabling profiling (--profiling=false) to reduce information exposure on the control plane.

Answer

--service-account-lookup=false

Answer

--enable-bootstrap-auth-only=true

Answer

--profiling=true

Question 11

When evaluating a Kubernetes cluster against security and compliance baselines, which TWO tools are commonly used for automated auditing and benchmarking? (Choose TWO)

Accepted Answer

kube-bench. kube-bench (B) is correct because it is an open-source tool from Aqua Security that automates the checks of the CIS Kubernetes Benchmark, inspecting the cluster's control plane components, kubelet, and configuration files to report pass/fail results against the benchmark. Kubescape (D) is correct because it is an ARMO tool that performs automated security and compliance scanning of Kubernetes clusters, mapping results to frameworks such as the NSA/CISA Kubernetes Hardening Guidance, MITRE ATT&CK, and CIS benchmarks. Kustomize (A) is a configuration management tool for customizing Kubernetes YAML manifests via overlays, not an auditing or benchmarking tool. Helm (C) is a package manager for deploying and managing Kubernetes applications using charts, not a compliance scanner. Kubectl (E) is the Kubernetes command-line client for interacting with the API server, not an automated auditing or benchmarking tool.

Answer

Kustomize

Answer

Helm

Answer

Kubectl

Question 12

An auditor is inspecting a Kubernetes cluster for compliance with the CIS Benchmark for etcd security. Which THREE configurations must be verified for the etcd cluster? (Choose THREE)

Accepted Answer

Peer communication is encrypted using TLS certificates. Option A is correct because the CIS Benchmark for etcd requires that peer (server-to-server) communication be encrypted with TLS certificates to protect cluster traffic between etcd members from eavesdropping or tampering. Option B is correct because enabling client certificate authentication via the --client-cert-auth=true flag ensures that only clients presenting a valid certificate signed by the trusted CA can connect to etcd, which is a core CIS control. Option E is correct because the etcd data directory (typically /var/lib/etcd) must have restrictive permissions such as 700 so that only the etcd process owner can read or write the sensitive key-value store and its WAL files. Option C does not belong because auto-compaction is a maintenance feature and the benchmark does not require it to be permanently disabled. Option D is clearly wrong because exposing etcd directly to the public internet without authentication is a severe misconfiguration that the CIS Benchmark explicitly prohibits.

Answer

etcd auto-compaction is permanently disabled

Answer

etcd is exposed directly on the public internet without authentication

Question 13

A security architect is designing role-based access control (RBAC) to comply with NIST access control principles of least privilege. Which THREE best practices should be followed when creating Roles and ClusterRoles? (Choose THREE)

Accepted Answer

Scrutinize and restrict the use of ClusterRoleBindings to cluster-wide resources. Option A is correct because ClusterRoleBindings grant permissions across the entire cluster, so they should be tightly scrutinized and reserved for genuinely cluster-scoped resources to uphold least privilege. Option B is correct because wildcards (*) in API groups, resources, or verbs grant far broader access than intended, violating least privilege and increasing blast radius; explicit permissions should be enumerated instead. Option E is correct because RBAC permissions drift over time as roles and bindings accumulate, so regular auditing is essential to detect and remove excessive or stale privileges. Options C and D are incorrect: allowing all users to read Secrets by default and granting cluster-admin to all service accounts both directly violate least privilege by providing excessive, unnecessary access.

Answer

Allow all users to read Kubernetes Secrets by default

Answer

Grant cluster-admin permissions to all application service accounts for ease of deployment

Question 14

Which TWO actions are core tenets of the "Shift-Left" security philosophy in cloud-native compliance? (Choose TWO)

Accepted Answer

Scanning infrastructure-as-code (IaC) templates for misconfigurations before deployment. Option B is correct because Shift-Left security means identifying misconfigurations in infrastructure-as-code (IaC) templates such as Terraform, CloudFormation, or Kubernetes manifests during development, before any resources are provisioned, so issues are caught early when they are cheapest and safest to fix. Option D is correct because embedding vulnerability scanning (for example SAST, SCA, or container image scanning) directly into the CI/CD pipeline enforces automated security gates on every commit or build, which is the operational core of shifting security left into the development lifecycle. Option A is wrong because disabling automated security tooling removes the very guardrails Shift-Left depends on and increases risk rather than reducing it. Option C is wrong because auditing only after a production breach is a reactive, right-side-of-development approach, the opposite of Shift-Left. Option E is wrong because relying solely on manual post-release code reviews is late, non-automated, and does not prevent defects from reaching production.

Answer

Disabling all automated security tooling to speed up commits

Answer

Waiting until a production breach occurs to audit logs

Answer

Relying entirely on manual code reviews post-release

Question 15

An enterprise security auditor is reviewing Kubernetes API server admission control configurations for compliance. Which THREE admission plugins or mechanisms are critical for enforcing security policies at admission time? (Choose THREE)

Accepted Answer

ValidatingAdmissionWebhook. ValidatingAdmissionWebhook (A) is correct because it lets the API server call external webhook endpoints to validate requests against custom security policies before persistence, enabling enforcement of organization-specific compliance rules. PodSecurity (B) is correct because it enforces the Pod Security Standards (privileged, baseline, restricted) at the namespace level via admission, blocking pods that violate the configured security profile. NodeRestriction (D) is correct because it is an admission plugin that limits kubelet credentials so a node can only modify its own Node object and Pods bound to it, preventing a compromised node from escalating cluster-wide. InsecureServing (C) is not an admission plugin but a deprecated API server serving option for unauthenticated/insecure port access, and AlwaysAllow (E) is an authorization mode that permits all requests, so neither enforces security policy at admission time.

Answer

InsecureServing

Answer

AlwaysAllow