KCSA Hard Questions — 25 Difficult Questions

Question 1

An enterprise security auditor is reviewing Kubernetes API server admission control configurations for compliance. Which THREE admission plugins or mechanisms are critical for enforcing security policies at admission time? (Choose THREE)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ValidatingAdmissionWebhook. NodeRestriction, ValidatingAdmissionWebhook, and PodSecurity are key admission mechanisms for enforcing security policies.

Answer

InsecureServing

Answer

AlwaysAllow

Question 2

A cluster administrator wants to implement admission control auditing to record all mutating and validating requests made to the API server. Which component configuration handles this requirement?

Accepted Answer

Configure an audit policy file and pass its path to the API server via --audit-policy-file.. Kubernetes Audit Policy configuration files define what events are recorded and at what log level by the API server audit backend.

Answer

Configure the kubelet audit webhook via /etc/kubernetes/audit.json.

Answer

Enable kube-proxy audit mode using --audit-proxy=true.

Answer

Set etcd logging level to DEBUG in the etcd configuration yaml.

Question 3

An enterprise is enforcing the CIS Kubernetes Benchmark for control plane configuration. Which TWO parameters must be correctly configured on the kube-apiserver to meet strict compliance auditing standards? (Choose TWO)

Accepted Answer

--audit-policy-file. CIS benchmarks require enabling auditing via audit log path and audit policy file configuration on the kube-apiserver.

Answer

--service-account-lookup=false

Answer

--enable-bootstrap-auth-only=true

Answer

--profiling=true

Question 4

Which TWO of the following kubelet security configurations are critical for preventing container escape and unauthorized node API access? (Choose TWO)

Accepted Answer

Configure kubelet authorization mode to Webhook.. Disabling the read-only port and enforcing webhook authorization on the kubelet secure port are essential node security measures.

Answer

Enable anonymous authentication on the kubelet secure port.

Answer

Run kubelet containers in privileged mode.

Answer

Set authorization.mode to AlwaysAllow.

Question 5

An auditor is reviewing compliance with CIS Kubernetes Benchmark control 1.2.20, which relates to the kube-apiserver admission control configuration. Which admission plugin is recommended by CIS to prevent default service accounts from automatically mounting API credentials?

Accepted Answer

ServiceAccount. The ServiceAccount admission controller, along with disabling automatic token mounting via serviceAccountName/automountServiceAccountToken, is governed by admission plugins. Specifically, NamespaceLifecycle and PodNodeSecurity are relevant, but for service account automation management, the ServiceAccount admission controller governs default behavior.

Answer

DefaultTolerationSeconds

Answer

AlwaysAdmit

Answer

NodeRestriction

Question 6

An auditor is inspecting a Kubernetes cluster for compliance with the CIS Benchmark for etcd security. Which THREE configurations must be verified for the etcd cluster? (Choose THREE)

Accepted Answer

Peer communication is encrypted using TLS certificates. CIS benchmarks for etcd focus on client certificates (mTLS), peer communication encryption, and secure file permissions.

Answer

etcd auto-compaction is permanently disabled

Answer

etcd is exposed directly on the public internet without authentication

Question 7

You are tasked with securing a Kubernetes cluster where control plane nodes are hosted in a private network segment. To prevent unauthorized access to the API server from compromised internal workloads, which mechanism restricts which service accounts can access the API server?

Accepted Answer

Strict RBAC Role and ClusterRole bindings adhering to the principle of least privilege.. Role-Based Access Control (RBAC) combined with least-privilege binding ensures service accounts only access permitted API resources.

Answer

Setting kubelet readOnlyPort to 8080.

Answer

Enabling anonymous access.

Answer

Disabling the Node authorizer.

Question 8

You are reviewing security logs on a control plane node and discover that an unauthenticated user accessed the kubelet's HTTPS port (10250) to execute commands inside containers. How should you restrict kubelet authentication and authorization to prevent this?

Accepted Answer

Set authentication.anonymous.enabled: false and authorization.mode: Webhook in the kubelet configuration file.. Kubelet must be configured with authentication enabled (such as X509 client certs or webhook token auth) and authorization set to Webhook.

Answer

Enable the kubelet insecure-port flag.

Answer

Set authorization.mode: AlwaysAllow in the kubelet configuration file.

Answer

Disable the API server proxy subresource.

Question 9

You are performing a security review of etcd cluster membership. You need to list all active members of the etcd cluster and check their health status using the command line. Which etcdctl command is correct?

Accepted Answer

etcdctl member list and etcdctl endpoint health. etcdctl member list and etcdctl endpoint health are the standard diagnostic commands for checking etcd cluster state.

Answer

etcdctl check membership

Answer

etcdctl cluster status

Answer

kubectl get etcdmembers

Question 10

When configuring Pod Security Standards on a namespace, which THREE security restrictions are enforced by the 'restricted' profile that are NOT enforced by the 'baseline' profile? (Choose THREE)

Accepted Answer

Restricting volume types to a safe subset (e.g., configMap, secret, emptyDir).. The restricted profile adds requirements such as running as a non-root user, preventing escalation of privileges, and restricting allowed volume types.

Answer

Disallowing privileged containers.

Answer

Prohibiting hostPort usage entirely.

Question 11

An auditor reviews container runtime configurations for compliance with NIST SP 800-190 recommendations on privilege escalation. Which Kubernetes feature controls whether a process can gain more privileges than its parent process?

Accepted Answer

allowPrivilegeEscalation: false. allowPrivilegeEscalation controls whether a process can gain more privileges through mechanisms like setuid binaries, fulfilling privilege restriction controls.

Answer

automountServiceAccountToken: false

Answer

runAsUser: 1000

Answer

privileged: false

Question 12

You are hardening etcd on a dedicated control plane host. You want to ensure that etcd database files on disk are protected against unauthorized physical or filesystem access. Which control mechanism is best suited for this?

Accepted Answer

Filesystem or block-level disk encryption (e.g., LUKS) on the host storage volume.. Operating system level disk encryption (such as LUKS) protects files at rest on block storage devices.

Answer

Kubernetes NetworkPolicies applied to the etcd Pod.

Answer

API server RBAC ClusterRoleBinding.

Answer

Kubelet read-only port disabling.

Question 13

An organization requires compliance auditing of etcd access to ensure unauthorized clients cannot communicate with the data store. According to CIS benchmarks, how should etcd client communication be secured?

Accepted Answer

Mutual TLS (mTLS) client certificates. CIS benchmarks require etcd client communication to be authenticated and encrypted using mutual TLS (mTLS).

Answer

IPsec tunnel encapsulation

Answer

HTTP with token bearer headers

Answer

Plaintext loopback interface binding

Question 14

Which TWO of the following API server configuration flags help enforce cryptographic and transport security? (Choose TWO)

Accepted Answer

--tls-cipher-suites to specify permitted strong cryptographic cipher suites.. --tls-min-version and --tls-cipher-suites enforce transport security standards.

Answer

--anonymous-auth to enable unauthenticated cluster access.

Answer

--insecure-port to allow unencrypted HTTP traffic.

Answer

--enable-http2=false to disable secure multiplexing.

Question 15

You are reviewing admission webhook configurations and notice that timeoutSeconds is set to 3 seconds for a critical validation webhook. If the webhook server takes 4 seconds to respond, what does the API server do when failurePolicy is 'Ignore'?

Accepted Answer

It allows the API request to proceed as if the webhook succeeded.. When failurePolicy is 'Ignore', a timeout or error reaching the webhook results in the API server ignoring the failure and allowing the request to proceed.

Answer

It quarantines the pod in a Pending state.

Answer

It rejects the API request immediately.

Answer

It retries the webhook request indefinitely until it responds.

Question 16

An application pod requires access to the Kubernetes API to list other pods. To follow secure practices, you create a dedicated ServiceAccount and bind a custom Role to it. How should you configure the Pod specification to prevent the default service account token from being automatically mounted?

Accepted Answer

Set 'automountServiceAccountToken: false' in the Pod specification.. Setting 'automountServiceAccountToken: false' on either the ServiceAccount or the Pod specification prevents the automatic mounting of the token, reducing the blast radius if compromised.

Answer

Delete the 'default' ServiceAccount in the namespace.

Answer

Configure the Pod securityContext with 'readOnlyRootFilesystem: true'.

Answer

Add a deny NetworkPolicy blocking egress to the Kubernetes API service IP.

Question 17

Which THREE components are involved when an external client authenticates to the Kubernetes API server using OpenID Connect (OIDC)? (Choose THREE)

Accepted Answer

The OIDC Identity Provider (IdP) issuing ID tokens.. OIDC authentication involves the client (e.g. kubectl), the OIDC identity provider, and the kube-apiserver.

Answer

The CoreDNS server resolving the OIDC provider domain.

Answer

The Kubelet running on worker nodes.

Question 18

Which TWO statements are true regarding Kubernetes NetworkPolicy default behaviors?

Accepted Answer

By default, all pods in a cluster are non-isolated and accept traffic from any source.. By default, pods are non-isolated (all traffic allowed). When a NetworkPolicy selects pods and specifies ingress/egress, those specific directions become deny-by-default.

Answer

NetworkPolicies automatically block all traffic across all namespaces upon cluster installation.

Answer

Egress traffic is blocked by default even if no NetworkPolicy is created.

Answer

NetworkPolicies apply to cluster nodes rather than individual pods.

Question 19

Which TWO of the following mechanisms help secure the kubelet API from unauthorized access and container inspection? (Choose TWO)

Accepted Answer

Enabling Webhook authorization mode so kubelet requests are validated against API server RBAC.. Setting authorization mode to Webhook and disabling anonymous access protect the kubelet API.

Answer

Removing all TLS certificates from the kubelet configuration.

Answer

Setting kubelet authorization mode to AlwaysAllow.

Answer

Enabling the kubelet read-only port 10255.

Question 20

Which TWO of the following scenarios represent severe security misconfigurations in a Kubernetes cluster control plane? (Choose TWO)

Accepted Answer

The API server is configured with --insecure-port pointing to an active HTTP listener.. Exposing the API server insecure port and allowing anonymous authentication are severe misconfigurations.

Answer

Etcd is configured with client certificate authentication and mTLS enabled.

Answer

Kubelet authorization mode is set to Webhook.

Answer

Secrets are encrypted at rest using an EncryptionConfiguration file.