KCSA Compliance And Security Frameworks — Timed 15 Questions

Question 1

An administrator is reviewing the CIS Kubernetes Benchmark for node security. Which TWO of the following settings are explicitly recommended by CIS to secure kubelet configurations? (Choose TWO)

Accepted Answer

Ensure that the --anonymous-auth argument is set to false. CIS benchmarks recommend ensuring authorization mode is webhook and disabling anonymous authentication on the kubelet.

Answer

Ensure that the --tls-cert-file argument is omitted

Question 2

An auditor is assessing compliance with NIST SP 800-53 controls for access control (AC) within a managed Kubernetes cluster. Which API object enforces fine-grained authorization decisions directly at the Kubernetes API server?

Accepted Answer

ClusterRoleBinding. Kubernetes Role-Based Access Control (RBAC), implemented via ClusterRole and Role bindings, enforces NIST-aligned access control policies at the API server layer.

Answer

ValidatingWebhookConfiguration

Answer

NetworkPolicy

Answer

ResourceQuota

Question 3

An enterprise is adopting the Cloud Native Security Framework to map their controls. Which of the 4Cs of Cloud Native Security represents the outermost layer encompassing physical data centers and hardware?

Accepted Answer

Cloud. The 4Cs of Cloud Native Security are Cloud, Clusters, Containers, and Code. Cloud is the outermost layer representing physical infrastructure and provider security.

Answer

Clusters

Answer

Code

Answer

Containers

Question 4

According to the CIS Kubernetes Benchmark, anonymous requests to the Kubernetes API server should be disabled. Which kube-apiserver flag enforces this setting?

Accepted Answer

--anonymous-auth=false. The flag --anonymous-auth=false disables anonymous requests to the secure port of the API server, fulfilling CIS benchmark requirements.

Answer

--authorization-mode=Node,RBAC

Answer

--enable-admission-plugins

Answer

--insecure-port=0

Question 5

A compliance officer wants to continuously audit Kubernetes resource manifests for misconfigurations against security best practices before they are applied. Which tool type is best suited for this shift-left compliance approach?

Accepted Answer

Static code analysis and admission controllers. Policy-as-code engines like OPA Gatekeeper or Kyverno validate and audit Kubernetes manifests prior to admission into the cluster.

Answer

Log shippers

Answer

Packet analyzers

Answer

Kernel debuggers

Question 6

A security team is implementing NIST SP 800-190 guidelines for container runtime security. Which kernel feature is leveraged by container runtimes to restrict system calls and meet least-privilege execution requirements?

Accepted Answer

Seccomp profiles. Seccomp (secure computing mode) filters system calls made by containers, aligning with NIST guidelines to restrict container capabilities and reduce attack surface.

Answer

cgroups v2

Answer

AppArmor MAC profiles

Answer

Namespaces

Question 7

A security engineer is reviewing the NIST SP 800-190 container security application and needs to identify the primary control category for securing container image registries. Under NIST guidelines, which layer is primarily responsible for verifying the integrity of images before deployment?

Accepted Answer

Registry security. NIST SP 800-190 emphasizes that image integrity must be validated at the registry and build pipeline level using cryptographic signing and vulnerability scanning.

Answer

Host OS security

Answer

Runtime orchestration security

Answer

Cluster networking

Question 8

An auditor notices that kubelet authentication is set to always allow anonymous access in a cluster configuration. According to the CIS Benchmark, what should the kubelet configuration parameter "authentication.anonymous.enabled" be set to?

Accepted Answer

false. The CIS Benchmark specifies that kubelet anonymous access must be disabled by setting authentication.anonymous.enabled to false.

Answer

strict

Answer

auto

Answer

true

Question 9

An administrator needs to evaluate an existing Kubernetes cluster against the CIS Kubernetes Benchmark. Which tool provides automated scanning specifically tailored to this benchmark?

Accepted Answer

kube-bench. Kube-bench is an open-source tool that checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes Benchmark.

Answer

kube-hunter

Answer

falco

Answer

velero

Question 10

Which CNCF project acts as a cloud-native runtime security and intrusion detection tool that monitors system calls against predefined security rules?

Accepted Answer

Falco. Falco is the CNCF incubating runtime security tool that acts as a security camera for containers, detecting anomalous behavior and policy violations.

Answer

Trivy

Answer

Fluentd

Answer

Cert-manager

Question 11

To comply with CIS benchmarks regarding pod security, an administrator wants to prevent containers from running with root privileges. Which field in a Pod Security Standard (restricted profile) enforces this?

Accepted Answer

runAsNonRoot: true. The restricted Pod Security Standard profile disallows running containers as root by enforcing runAsNonRoot: true in the securityContext.

Answer

hostNetwork: true

Answer

readOnlyRootFilesystem: false

Answer

privileged: true

Question 12

A security engineer is configuring kube-apiserver audit logging to satisfy NIST compliance requirements. Which configuration file specifies which requests are logged and at what log level?

Accepted Answer

Audit policy file. An audit policy file passed via --audit-policy-file defines rules for what events are recorded and what log level is applied in Kubernetes.

Answer

kubeadm.conf

Answer

Kubelet configuration file

Answer

Admission configuration YAML

Question 13

An enterprise undergoes an ISO/IEC 27001 audit for their Kubernetes environment. The auditor requests evidence that secrets at rest are encrypted. Which configuration component enables encryption of Secret resources in etcd?

Accepted Answer

EncryptionConfiguration API. The EncryptionConfiguration resource passed to the kube-apiserver via --encryption-provider-config enables encryption of sensitive resources like Secrets at rest in etcd.

Answer

Kubelet TLS bootstrapping

Answer

SecretProviderClass CRD

Answer

ServiceAccount token volume projection

Question 14

Which NIST framework publication specifically addresses the security of container-based applications and orchestration systems?

Accepted Answer

NIST SP 800-190. NIST SP 800-190 is the Application Container Security Guide, providing specific security guidance for container environments.

Answer

NIST SP 800-37

Answer

NIST SP 800-53

Answer

NIST SP 800-88

Question 15

An auditor is reviewing compliance with CIS Kubernetes Benchmark control 1.2.20, which relates to the kube-apiserver admission control configuration. Which admission plugin is recommended by CIS to prevent default service accounts from automatically mounting API credentials?

Accepted Answer

ServiceAccount. The ServiceAccount admission controller, along with disabling automatic token mounting via serviceAccountName/automountServiceAccountToken, is governed by admission plugins. Specifically, NamespaceLifecycle and PodNodeSecurity are relevant, but for service account automation management, the ServiceAccount admission controller governs default behavior.

Answer

DefaultTolerationSeconds

Answer

AlwaysAdmit

Answer

NodeRestriction