KCSA Compliance And Security Frameworks — Timed 10 Questions

Question 1

An administrator is reviewing the CIS Kubernetes Benchmark for node security. Which TWO of the following settings are explicitly recommended by CIS to secure kubelet configurations? (Choose TWO)

Accepted Answer

Ensure that the --anonymous-auth argument is set to false. CIS benchmarks recommend ensuring authorization mode is webhook and disabling anonymous authentication on the kubelet.

Answer

Ensure that the --tls-cert-file argument is omitted

Question 2

An auditor is assessing compliance with NIST SP 800-53 controls for access control (AC) within a managed Kubernetes cluster. Which API object enforces fine-grained authorization decisions directly at the Kubernetes API server?

Accepted Answer

ClusterRoleBinding. Kubernetes Role-Based Access Control (RBAC), implemented via ClusterRole and Role bindings, enforces NIST-aligned access control policies at the API server layer.

Answer

ValidatingWebhookConfiguration

Answer

NetworkPolicy

Answer

ResourceQuota

Question 3

An enterprise is adopting the Cloud Native Security Framework to map their controls. Which of the 4Cs of Cloud Native Security represents the outermost layer encompassing physical data centers and hardware?

Accepted Answer

Cloud. The 4Cs of Cloud Native Security are Cloud, Clusters, Containers, and Code. Cloud is the outermost layer representing physical infrastructure and provider security.

Answer

Clusters

Answer

Code

Answer

Containers

Question 4

According to the CIS Kubernetes Benchmark, anonymous requests to the Kubernetes API server should be disabled. Which kube-apiserver flag enforces this setting?

Accepted Answer

--anonymous-auth=false. The flag --anonymous-auth=false disables anonymous requests to the secure port of the API server, fulfilling CIS benchmark requirements.

Answer

--authorization-mode=Node,RBAC

Answer

--enable-admission-plugins

Answer

--insecure-port=0

Question 5

A compliance officer wants to continuously audit Kubernetes resource manifests for misconfigurations against security best practices before they are applied. Which tool type is best suited for this shift-left compliance approach?

Accepted Answer

Static code analysis and admission controllers. Policy-as-code engines like OPA Gatekeeper or Kyverno validate and audit Kubernetes manifests prior to admission into the cluster.

Answer

Log shippers

Answer

Packet analyzers

Answer

Kernel debuggers

Question 6

A security team is implementing NIST SP 800-190 guidelines for container runtime security. Which kernel feature is leveraged by container runtimes to restrict system calls and meet least-privilege execution requirements?

Accepted Answer

Seccomp profiles. Seccomp (secure computing mode) filters system calls made by containers, aligning with NIST guidelines to restrict container capabilities and reduce attack surface.

Answer

cgroups v2

Answer

AppArmor MAC profiles

Answer

Namespaces

Question 7

A security engineer is reviewing the NIST SP 800-190 container security application and needs to identify the primary control category for securing container image registries. Under NIST guidelines, which layer is primarily responsible for verifying the integrity of images before deployment?

Accepted Answer

Registry security. NIST SP 800-190 emphasizes that image integrity must be validated at the registry and build pipeline level using cryptographic signing and vulnerability scanning.

Answer

Host OS security

Answer

Runtime orchestration security

Answer

Cluster networking

Question 8

An auditor notices that kubelet authentication is set to always allow anonymous access in a cluster configuration. According to the CIS Benchmark, what should the kubelet configuration parameter "authentication.anonymous.enabled" be set to?

Accepted Answer

false. The CIS Benchmark specifies that kubelet anonymous access must be disabled by setting authentication.anonymous.enabled to false.

Answer

strict

Answer

auto

Answer

true

Question 9

An administrator needs to evaluate an existing Kubernetes cluster against the CIS Kubernetes Benchmark. Which tool provides automated scanning specifically tailored to this benchmark?

Accepted Answer

kube-bench. Kube-bench is an open-source tool that checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes Benchmark.

Answer

kube-hunter

Answer

falco

Answer

velero

Question 10

Which CNCF project acts as a cloud-native runtime security and intrusion detection tool that monitors system calls against predefined security rules?

Accepted Answer

Falco. Falco is the CNCF incubating runtime security tool that acts as a security camera for containers, detecting anomalous behavior and policy violations.

Answer

Trivy

Answer

Fluentd

Answer

Cert-manager