KCSA Kubernetes Cluster Component Security — 30 Questions

Question 1

An administrator wants to ensure that API requests containing deprecated API versions trigger warnings in client output and audit logs. Which API server flag controls this behavior?

Accepted Answer

--runtime-config. The --runtime-config flag or deprecation tracking flags help manage deprecated API groups and versions.

Answer

--disable-deprecated-apis

Answer

--warn-deprecated-apis=true

Answer

--log-deprecated=true

Question 2

Which component acts as the local agent running on every Kubernetes worker node, responsible for maintaining pod lifecycles and container health?

Accepted Answer

kube-apiserver. The kubelet is the primary agent running on each node.

Answer

kube-proxy

Answer

kube-scheduler

Question 3

Which TWO of the following are primary benefits of enabling encryption at rest for Kubernetes secrets? (Choose THREE - wait, choose TWO)

Accepted Answer

Protects sensitive secret data from being read in plaintext if etcd storage files are accessed.. Encryption at rest protects secrets stored in etcd from being read if the etcd data store is compromised.

Answer

Automatically disables kubelet anonymous authentication.

Answer

Accelerates network packet routing across Kubernetes Services.

Answer

Replaces the need for RBAC authorization policies.

Question 4

You are hardening a production Kubernetes control plane. You need to ensure that etcd client-to-server and peer communications are strictly encrypted in transit and require mutual TLS (mTLS). Which etcd configuration flag combination enforces this requirement?

Accepted Answer

--client-cert-auth=true and --peer-client-cert-auth=true along with valid CA and key pair paths.. Securing etcd requires configuring both server-side and client-side TLS certificates along with client certificate verification flags.

Answer

--auto-tls=true for all endpoints.

Answer

--insecure-transport=false combined with HTTP proxy routing.

Answer

--cipher-suites=TLS_RSA_WITH_AES_128_CBC_SHA

Question 5

A security scan reveals that the kubelet read-only port (typically port 1055) is active and exposes unauthenticated pod and cluster metadata. How should this vulnerability be remediated?

Accepted Answer

Set readOnlyPort: 0 in the kubelet configuration file.. The kubelet read-only port should be disabled by setting its value to 0 in the kubelet configuration file or startup flags.

Answer

Configure an RBAC ClusterRoleBinding for system:anonymous.

Answer

Enable PodSecurityStandards in enforcing mode.

Answer

Apply a NetworkPolicy blocking ingress traffic to port 1055.

Question 6

When configuring the Kubernetes API server authorization modes, which mode evaluates requests against Kubernetes RBAC policies?

Accepted Answer

RBAC. The RBAC (Role-Based Access Control) authorization mode uses cluster roles and bindings to govern access.

Answer

Webhook

Answer

Node

Answer

AlwaysAllow

Question 7

You are auditing the Kubernetes control plane and notice that the API server is configured with an insecure port (--insecure-port=8080). What is the primary security implication of leaving this port enabled?

Accepted Answer

It bypasses all authentication and authorization modules, granting full administrative access to anyone who reaches the port.. The insecure port serves HTTP requests without performing any authentication or authorization checks, allowing anyone who can reach the port full cluster access.

Answer

It prevents the kubelet from communicating with the control plane nodes.

Answer

It restricts API access exclusively to read-only operations.

Answer

It forces all clients to downgrade their TLS encryption cipher suites to plaintext.

Question 8

A security auditor discovers that anonymous authentication is accidentally enabled on the Kubernetes API server, allowing unauthenticated read access to cluster health endpoints. Which API server flag must be modified to disable anonymous requests?

Accepted Answer

--anonymous-auth=false. Setting --anonymous-auth=false explicitly disables requests that are not rejected by other authenticators from being treated as anonymous.

Answer

--secure-port=0

Answer

--authorization-mode=AlwaysAllow

Answer

--disable-anonymous=true

Question 9

An administrator needs to restrict kubelets so they can only modify resources associated with their own node (such as their own Node object and Pods bound to them). Which authorization mode must be enabled alongside RBAC?

Accepted Answer

Node. The Node authorization mode is a special-purpose authorization mode that specifically authorizes kubelet API requests.

Answer

ABAC

Answer

AlwaysDeny

Answer

PodSecurity

Question 10

An engineer needs to verify that the kubelet on worker nodes is not allowing unauthenticated requests. Which configuration parameter in the kubelet configuration file disables anonymous access?

Accepted Answer

authentication.anonymous.enabled: false. The authentication.anonymous.enabled setting in the kubelet configuration file controls whether anonymous requests are accepted.

Answer

anonymousAuth: "Disabled"

Answer

enableAnonymousAccess: false

Answer

readOnlyPort: 0

Question 11

An administrator needs to secure access to the Kubernetes API server from an external CI/CD pipeline. Which mechanism should be used to authenticate the pipeline using an existing external identity provider without embedding long-lived static tokens?

Accepted Answer

Configure the API server with --oidc-issuer-url and related flags to validate JSON Web Tokens issued by the IDP.. OpenID Connect (OIDC) tokens allow Kubernetes API servers to authenticate users and service accounts via an external identity provider, avoiding static tokens.

Answer

Store the administrative kubeconfig file in a public ConfigMap.

Answer

Enable anonymous requests on the API server for the CI/CD CIDR block.

Answer

Create a shared static password file and pass it via --basic-auth-file.

Question 12

Which component in the Kubernetes control plane is directly responsible for interacting with etcd to persist and retrieve cluster state?

Accepted Answer

kube-apiserver. The kube-apiserver is the only control plane component that communicates directly with etcd.

Answer

kube-controller-manager

Answer

kube-scheduler

Answer

kubelet

Question 13

An administrator wants to prevent the kubelet from automatically approving certificate signing requests (CSRs) generated by nodes joining the cluster. Which mechanism manages kubelet TLS bootstrapping approval behavior?

Accepted Answer

The CSR Approver controller in the kube-controller-manager.. Kubelet TLS bootstrapping requests can be automatically approved by the kube-controller-manager using the --controllers flag or handled manually/via external controllers.

Answer

The etcd consensus module.

Answer

The kube-scheduler placement policy engine.

Answer

The API server admission webhook chain.

Question 14

You are hardening etcd and want to ensure that sensitive data stored in Kubernetes secrets is encrypted at rest within etcd. Which API server configuration file parameter specifies how secrets should be encrypted?

Accepted Answer

--encryption-provider-config. Encryption at rest is configured using an EncryptionConfiguration file passed to the API server via the --encryption-provider-config flag.

Answer

--etcd-encryption-key

Answer

--secrets-encryption-enabled

Answer

--etcd-ca-file

Question 15

An incident response team suspects that an attacker has gained unauthorized access to the cluster via an unencrypted etcd backup file containing sensitive cluster state. Which etcd utility should be used to securely snapshot and backup etcd data?

Accepted Answer

etcdctl snapshot save. etcdctl snapshot save is the official command-line tool used to take point-in-time snapshots of the etcd key-value database.

Answer

kubectl cluster-info dump --etcd

Answer

etcd-backup-controller

Answer

kubeadm backup etcd

Question 16

Where are static pods for a control plane node typically defined so that the kubelet can automatically create and manage them?

Accepted Answer

In the directory specified by staticPodPath in the kubelet configuration file (default /etc/kubernetes/manifests).. Static pods are defined by manifest files placed in the directory specified by the kubelet's --pod-manifest-path flag or staticPodPath configuration setting.

Answer

In the ~/.kube/config file of the root user.

Answer

In the etcd database under the /registry/staticpods prefix.

Answer

In the kube-system namespace as standard Deployment objects.

Question 17

A cluster administrator wants to implement admission control auditing to record all mutating and validating requests made to the API server. Which component configuration handles this requirement?

Accepted Answer

Configure an audit policy file and pass its path to the API server via --audit-policy-file.. Kubernetes Audit Policy configuration files define what events are recorded and at what log level by the API server audit backend.

Answer

Configure the kubelet audit webhook via /etc/kubernetes/audit.json.

Answer

Enable kube-proxy audit mode using --audit-proxy=true.

Answer

Set etcd logging level to DEBUG in the etcd configuration yaml.

Question 18

You are reviewing security logs on a control plane node and discover that an unauthenticated user accessed the kubelet's HTTPS port (10250) to execute commands inside containers. How should you restrict kubelet authentication and authorization to prevent this?

Accepted Answer

Set authentication.anonymous.enabled: false and authorization.mode: Webhook in the kubelet configuration file.. Kubelet must be configured with authentication enabled (such as X509 client certs or webhook token auth) and authorization set to Webhook.

Answer

Enable the kubelet insecure-port flag.

Answer

Set authorization.mode: AlwaysAllow in the kubelet configuration file.

Answer

Disable the API server proxy subresource.

Question 19

Which file on a Kubernetes control plane node contains the startup arguments and flags for the statically hosted API server?

Accepted Answer

/etc/kubernetes/manifests/kube-apiserver.yaml. Static pods for control plane components are defined in YAML files located in /etc/kubernetes/manifests.

Answer

/etc/systemd/system/kube-apiserver.service

Answer

/etc/default/kube-apiserver

Answer

/var/lib/kubelet/config.yaml

Question 20

You need to audit the cryptographic algorithms and TLS versions permitted by the Kubernetes API server for incoming client connections. Which API server flag enforces a minimum TLS version of 1.3?

Accepted Answer

--tls-min-version=VersionTLS13. The --tls-min-version flag allows administrators to specify the minimum acceptable TLS protocol version.

Answer

--min-tls=1.3

Answer

--cipher-suites=TLS_AES_256_GCM_SHA384

Answer

--ssl-version=TLSv3