KCSA Kubernetes Cluster Component Security — 20 Questions

Question 1

A security scan reveals that the kubelet read-only port (typically port 1055) is active and exposes unauthenticated pod and cluster metadata. How should this vulnerability be remediated?

Accepted Answer

Set readOnlyPort: 0 in the kubelet configuration file.. The kubelet read-only port (default 10255, sometimes referenced as 1055 in older docs) serves unauthenticated, unencrypted pod and node metadata. The correct remediation is to disable it entirely by setting readOnlyPort: 0 in the kubelet configuration (or --read-only-port=0 flag), which removes the exposure at its source rather than attempting to filter it.

Answer

Configure an RBAC ClusterRoleBinding for system:anonymous.

Answer

Enable PodSecurityStandards in enforcing mode.

Answer

Apply a NetworkPolicy blocking ingress traffic to port 1055.

Question 2

An engineer needs to verify that the kubelet on worker nodes is not allowing unauthenticated requests. Which configuration parameter in the kubelet configuration file disables anonymous access?

Accepted Answer

authentication.anonymous.enabled: false. In the kubelet configuration file (KubeletConfiguration, v1beta1), anonymous authentication is controlled by the nested field authentication.anonymous.enabled. Setting it to false disables unauthenticated requests to the kubelet's HTTPS endpoint, forcing all callers to present a valid client certificate or bearer token. This is the canonical, schema-valid way to turn off anonymous access in modern Kubernetes.

Answer

anonymousAuth: "Disabled"

Answer

enableAnonymousAccess: false

Answer

readOnlyPort: 0

Question 3

An administrator wants to prevent the kubelet from automatically approving certificate signing requests (CSRs) generated by nodes joining the cluster. Which mechanism manages kubelet TLS bootstrapping approval behavior?

Accepted Answer

The CSR Approver controller in the kube-controller-manager.. The CSR Approver controller, part of the kube-controller-manager, is responsible for automatically approving or denying CertificateSigningRequests submitted by kubelets during TLS bootstrapping. It evaluates CSRs against configured policies (such as the `--cluster-signing-cert-file` and RBAC permissions on `certificates.k8s.io` resources) and issues approvals. Disabling or restricting this controller (or removing the `system:certificates.k8s.io:certificatesigningrequests:nodeclient` ClusterRole binding) prevents automatic approval of node CSRs.

Answer

The etcd consensus module.

Answer

The kube-scheduler placement policy engine.

Answer

The API server admission webhook chain.

Question 4

An administrator wants to limit the blast radius if an attacker compromises a worker node. Which setting ensures that the kubelet does not automatically create or modify ServiceAccount tokens for pods unless explicitly requested?

Accepted Answer

Set serviceAccountAutoMount: false or automountServiceAccountToken: false on service accounts or pod specs.. Setting automountServiceAccountToken: false on the ServiceAccount or in the pod spec prevents the kubelet from projecting a service account token into the pod's filesystem unless explicitly requested. This limits blast radius because a compromised pod cannot use an auto-mounted token to call the API server. The setting can be applied at the ServiceAccount level (affecting all pods using it) or per-pod (overriding the ServiceAccount default).

Answer

Configure the API server with --disable-service-accounts=true.

Answer

Set kubelet flag --encrypt-tokens=true.

Answer

Enable etcd encryption for service account tokens.

Question 5

An administrator wants to ensure that a malicious container executing on a worker node cannot query the kubelet API to extract sensitive pod information. Which kubelet configuration setting controls whether requests to the kubelet require authorization?

Accepted Answer

authorization.mode: Webhook. The kubelet's authorization.mode setting determines how it authorizes API requests. Setting it to Webhook makes the kubelet send SubjectAccessReview requests to the kube-apiserver, so only identities with proper RBAC (e.g., system:kubelet-api-admin) can access the kubelet API. This prevents a compromised container from querying the kubelet to extract pod secrets or execute commands.

Answer

protectKernelDefaults: false

Answer

tlsCertFile: /etc/certs/kubelet.crt

Answer

authentication.anonymous.enabled: true

Question 6

When configuring Role-Based Access Control (RBAC), which Kubernetes object grants permissions across the entire cluster rather than within a single namespace?

Accepted Answer

ClusterRole. A ClusterRole is a cluster-scoped RBAC object that defines permissions (rules) that can be applied across all namespaces or to cluster-scoped resources like nodes and persistent volumes. Unlike a Role, which is namespace-scoped, a ClusterRole is not bound to a single namespace and can be referenced by RoleBindings or ClusterRoleBindings to grant permissions cluster-wide. This makes it the correct answer for granting permissions across the entire cluster.

Answer

ServiceAccount

Answer

Role

Answer

PodSecurityPolicy

Question 7

An administrator wants to ensure that API requests containing deprecated API versions trigger warnings in client output and audit logs. Which API server flag controls this behavior?

Accepted Answer

--runtime-config. The --runtime-config flag or deprecation tracking flags help manage deprecated API groups and versions.

Answer

--disable-deprecated-apis

Answer

--warn-deprecated-apis=true

Answer

--log-deprecated=true

Question 8

An administrator wants to secure the communication channel between the Kubernetes API server and extension API servers (such as metrics-server). Which API server flag specifies the Certificate Authority used to verify extension API server certificates?

Accepted Answer

--requestheader-client-ca-file. The --requestheader-client-ca-file flag on the kube-apiserver specifies the CA bundle used to verify client certificates presented by extension API servers (like metrics-server) when they authenticate to the main API server via the aggregation layer. This is part of the API aggregation configuration, along with --requestheader-allowed-names and --requestheader-extra-headers-prefix.

Answer

--extension-ca-file

Answer

--etcd-ca-file

Answer

--proxy-client-cert-file

Question 9

An administrator wants to ensure that the Kubernetes API server rejects any incoming requests that do not match known API resource paths or have invalid syntax. Which admission controller helps validate request structures and schema compliance?

Accepted Answer

The built-in OpenAPI schema validation and ValidatingAdmissionWebhook.. The API server validates incoming requests against the OpenAPI schema for known resource types, rejecting malformed or unknown paths before they reach admission. ValidatingAdmissionWebhook extends this by calling external webhooks that can enforce custom schema and policy validation. Together they cover structural and schema compliance for API requests.

Answer

The etcd transaction validator.

Answer

The core scheduler admission plugin.

Answer

The kube-proxy filter admission module.

Question 10

You are tasked with securing a Kubernetes cluster where control plane nodes are hosted in a private network segment. To prevent unauthorized access to the API server from compromised internal workloads, which mechanism restricts which service accounts can access the API server?

Accepted Answer

Strict RBAC Role and ClusterRole bindings adhering to the principle of least privilege.. Strict RBAC Role and ClusterRole bindings that follow the principle of least privilege are the primary mechanism to restrict which service accounts can access the API server. By binding only the necessary verbs and resources to specific service accounts, you ensure that a compromised workload cannot escalate privileges or access sensitive API endpoints. This directly addresses the requirement to prevent unauthorized access from compromised internal workloads.

Answer

Setting kubelet readOnlyPort to 8080.

Answer

Enabling anonymous access.

Answer

Disabling the Node authorizer.

Question 11

Which component acts as the local agent running on every Kubernetes worker node, responsible for maintaining pod lifecycles and container health?

Accepted Answer

kube-apiserver. The kubelet is the primary agent running on each node.

Answer

kube-proxy

Answer

kube-scheduler

Question 12

You are securing a Kubernetes cluster control plane and need to ensure that the API server limits request payload sizes to prevent Denial of Service (DoS) attacks via memory exhaustion. Which mechanism or flag controls request body size limits in the Kubernetes API server?

Accepted Answer

The API server enforces built-in request body size limits (e.g., 3MB max for standard requests) to prevent large payload attacks.. The Kubernetes API server enforces built-in request body size limits — approximately 3MB for standard requests — to prevent memory exhaustion from oversized payloads. This is a hardcoded safeguard in the apiserver's request handling path, not a configurable flag on kubelet or kube-proxy. It protects the control plane from DoS attacks that would otherwise consume memory parsing huge JSON bodies.

Answer

Set kubelet flag --max-pod-payload.

Answer

Configure kube-proxy with --max-buffer-size.

Answer

Configure etcd with --max-request-bytes flag.

Question 13

Which TWO of the following are primary benefits of enabling encryption at rest for Kubernetes secrets? (Choose THREE - wait, choose TWO)

Accepted Answer

Protects sensitive secret data from being read in plaintext if etcd storage files are accessed.. Encryption at rest protects secrets stored in etcd from being read if the etcd data store is compromised.

Answer

Automatically disables kubelet anonymous authentication.

Answer

Accelerates network packet routing across Kubernetes Services.

Answer

Replaces the need for RBAC authorization policies.

Question 14

You are hardening a production Kubernetes control plane. You need to ensure that etcd client-to-server and peer communications are strictly encrypted in transit and require mutual TLS (mTLS). Which etcd configuration flag combination enforces this requirement?

Accepted Answer

--client-cert-auth=true and --peer-client-cert-auth=true along with valid CA and key pair paths.. The flags --client-cert-auth=true and --peer-client-cert-auth=true force etcd to require and verify client certificates on both the client-facing listener (port 2379) and the peer listener (port 2380), which is exactly what mTLS demands. Combined with --cert-file, --key-file, --trusted-ca-file, --peer-cert-file, --peer-key-file, and --peer-trusted-ca-file, etcd will reject any connection that does not present a certificate signed by the trusted CA. This is the canonical CIS Kubernetes Benchmark configuration for a hardened etcd.

Answer

--auto-tls=true for all endpoints.

Answer

--insecure-transport=false combined with HTTP proxy routing.

Answer

--cipher-suites=TLS_RSA_WITH_AES_128_CBC_SHA

Question 15

When configuring the Kubernetes API server authorization modes, which mode evaluates requests against Kubernetes RBAC policies?

Accepted Answer

RBAC. The RBAC authorization mode in the Kubernetes API server evaluates requests against Role-Based Access Control policies defined via Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings. When enabled, the API server checks whether the requesting user or service account has a binding that grants the required verb on the target resource. RBAC is the standard, fine-grained authorization mechanism in modern Kubernetes clusters.

Answer

Webhook

Answer

Node

Answer

AlwaysAllow

Question 16

You are auditing the Kubernetes control plane and notice that the API server is configured with an insecure port (--insecure-port=8080). What is the primary security implication of leaving this port enabled?

Accepted Answer

It bypasses all authentication and authorization modules, granting full administrative access to anyone who reaches the port.. The --insecure-port flag on the kube-apiserver opens an unauthenticated, unencrypted HTTP endpoint that completely bypasses the normal authentication (x509 client certs, bearer tokens, OIDC) and authorization (RBAC, ABAC, Node authorizer) chain. Any client that can reach that port — including a compromised pod on the host network or a misconfigured firewall — is treated as an anonymous, fully privileged user and can perform any API action, including creating cluster-admin bindings. This is why the flag was deprecated in Kubernetes 1.20 and removed in 1.24.

Answer

It prevents the kubelet from communicating with the control plane nodes.

Answer

It restricts API access exclusively to read-only operations.

Answer

It forces all clients to downgrade their TLS encryption cipher suites to plaintext.

Question 17

A security auditor discovers that anonymous authentication is accidentally enabled on the Kubernetes API server, allowing unauthenticated read access to cluster health endpoints. Which API server flag must be modified to disable anonymous requests?

Accepted Answer

--anonymous-auth=false. The --anonymous-auth flag on kube-apiserver controls whether unauthenticated requests are treated as anonymous users (system:anonymous). Setting --anonymous-auth=false rejects requests without valid credentials with a 401 Unauthorized response, closing the exposure of health/version endpoints to unauthenticated clients. This is the documented, supported way to disable anonymous access and is enforced by CIS Kubernetes Benchmark control 1.2.1.

Answer

--secure-port=0

Answer

--authorization-mode=AlwaysAllow

Answer

--disable-anonymous=true

Question 18

An administrator needs to restrict kubelets so they can only modify resources associated with their own node (such as their own Node object and Pods bound to them). Which authorization mode must be enabled alongside RBAC?

Accepted Answer

Node. The Node authorizer is a special-purpose authorization mode designed specifically for kubelets. It restricts each kubelet's API requests to resources tied to its own node — its own Node object, Pods bound to that node, and related objects like Secrets, ConfigMaps, and PersistentVolumes referenced by those Pods. It must be enabled alongside RBAC (and typically NodeRestriction admission) so that kubelet credentials cannot read or modify cluster-wide resources.

Answer

ABAC

Answer

AlwaysDeny

Answer

PodSecurity

Question 19

An administrator needs to secure access to the Kubernetes API server from an external CI/CD pipeline. Which mechanism should be used to authenticate the pipeline using an existing external identity provider without embedding long-lived static tokens?

Accepted Answer

Configure the API server with --oidc-issuer-url and related flags to validate JSON Web Tokens issued by the IDP.. Configuring the API server with --oidc-issuer-url, --oidc-client-id, and related flags lets it validate JSON Web Tokens (ID tokens) issued by an external OIDC identity provider, enabling short-lived, federated authentication for the CI/CD pipeline without static credentials. The pipeline obtains a token from the IdP (e.g., via client credentials or workload identity federation) and presents it as a Bearer token; the API server verifies the signature against the issuer's JWKS and maps claims to a username and groups for RBAC.

Answer

Store the administrative kubeconfig file in a public ConfigMap.

Answer

Enable anonymous requests on the API server for the CI/CD CIDR block.

Answer

Create a shared static password file and pass it via --basic-auth-file.

Question 20

Which component in the Kubernetes control plane is directly responsible for interacting with etcd to persist and retrieve cluster state?

Accepted Answer

kube-apiserver. The kube-apiserver is the only control plane component that talks directly to etcd. It exposes the REST API, validates and mutates objects via admission controllers, and persists/retrieves all cluster state in etcd. Other components (scheduler, controller-manager, kubelet) interact with the API server, never with etcd directly.

Answer

kube-controller-manager

Answer

kube-scheduler

Answer

kubelet