KCSA Kubernetes Cluster Component Security — All Questions With Answers

Question 1mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

A security scan reveals that the kubelet read-only port (typically port 1055) is active and exposes unauthenticated pod and cluster metadata. How should this vulnerability be remediated?

Question 2easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An engineer needs to verify that the kubelet on worker nodes is not allowing unauthenticated requests. Which configuration parameter in the kubelet configuration file disables anonymous access?

Question 3mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator wants to prevent the kubelet from automatically approving certificate signing requests (CSRs) generated by nodes joining the cluster. Which mechanism manages kubelet TLS bootstrapping approval behavior?

Question 4mediummultiple choice

Study the full AAA explanation →

An administrator wants to limit the blast radius if an attacker compromises a worker node. Which setting ensures that the kubelet does not automatically create or modify ServiceAccount tokens for pods unless explicitly requested?

Question 5mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator wants to ensure that a malicious container executing on a worker node cannot query the kubelet API to extract sensitive pod information. Which kubelet configuration setting controls whether requests to the kubelet require authorization?

Question 6easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

When configuring Role-Based Access Control (RBAC), which Kubernetes object grants permissions across the entire cluster rather than within a single namespace?

Question 7mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator wants to ensure that API requests containing deprecated API versions trigger warnings in client output and audit logs. Which API server flag controls this behavior?

Question 8mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator wants to secure the communication channel between the Kubernetes API server and extension API servers (such as metrics-server). Which API server flag specifies the Certificate Authority used to verify extension API server certificates?

Question 9mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator wants to ensure that the Kubernetes API server rejects any incoming requests that do not match known API resource paths or have invalid syntax. Which admission controller helps validate request structures and schema compliance?

Question 10hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are tasked with securing a Kubernetes cluster where control plane nodes are hosted in a private network segment. To prevent unauthorized access to the API server from compromised internal workloads, which mechanism restricts which service accounts can access the API server?

Question 11easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

Which component acts as the local agent running on every Kubernetes worker node, responsible for maintaining pod lifecycles and container health?

Question 12hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are securing a Kubernetes cluster control plane and need to ensure that the API server limits request payload sizes to prevent Denial of Service (DoS) attacks via memory exhaustion. Which mechanism or flag controls request body size limits in the Kubernetes API server?

Question 13easymulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following are primary benefits of enabling encryption at rest for Kubernetes secrets? (Choose THREE - wait, choose TWO)

Question 14hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are hardening a production Kubernetes control plane. You need to ensure that etcd client-to-server and peer communications are strictly encrypted in transit and require mutual TLS (mTLS). Which etcd configuration flag combination enforces this requirement?

Question 15easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

When configuring the Kubernetes API server authorization modes, which mode evaluates requests against Kubernetes RBAC policies?

Question 16hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are auditing the Kubernetes control plane and notice that the API server is configured with an insecure port (--insecure-port=8080). What is the primary security implication of leaving this port enabled?

Question 17mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

A security auditor discovers that anonymous authentication is accidentally enabled on the Kubernetes API server, allowing unauthenticated read access to cluster health endpoints. Which API server flag must be modified to disable anonymous requests?

Question 18mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator needs to restrict kubelets so they can only modify resources associated with their own node (such as their own Node object and Pods bound to them). Which authorization mode must be enabled alongside RBAC?

Question 19easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator needs to secure access to the Kubernetes API server from an external CI/CD pipeline. Which mechanism should be used to authenticate the pipeline using an existing external identity provider without embedding long-lived static tokens?

Question 20easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

Which component in the Kubernetes control plane is directly responsible for interacting with etcd to persist and retrieve cluster state?

Question 21mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are hardening etcd and want to ensure that sensitive data stored in Kubernetes secrets is encrypted at rest within etcd. Which API server configuration file parameter specifies how secrets should be encrypted?

Question 22hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An incident response team suspects that an attacker has gained unauthorized access to the cluster via an unencrypted etcd backup file containing sensitive cluster state. Which etcd utility should be used to securely snapshot and backup etcd data?

Question 23easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

Where are static pods for a control plane node typically defined so that the kubelet can automatically create and manage them?

Question 24hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

A cluster administrator wants to implement admission control auditing to record all mutating and validating requests made to the API server. Which component configuration handles this requirement?

Question 25hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are reviewing security logs on a control plane node and discover that an unauthenticated user accessed the kubelet's HTTPS port (10250) to execute commands inside containers. How should you restrict kubelet authentication and authorization to prevent this?

Question 26easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

Which file on a Kubernetes control plane node contains the startup arguments and flags for the statically hosted API server?

Question 27hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You need to audit the cryptographic algorithms and TLS versions permitted by the Kubernetes API server for incoming client connections. Which API server flag enforces a minimum TLS version of 1.3?

Question 28easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

Which Kubernetes control plane component is responsible for noticing and responding when nodes go down or fail health checks?

Question 29mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator suspects that someone is attempting brute-force attacks against the Kubernetes API server. Where should the administrator look to inspect authentication failures generated by the API server?

Question 30hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are securing a highly regulated Kubernetes cluster and need to ensure that etcd data is encrypted at rest using a custom encryption key. After creating the EncryptionConfiguration file, which API server flag must be updated to point to this file?

Question 31hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are hardening etcd on a dedicated control plane host. You want to ensure that etcd database files on disk are protected against unauthorized physical or filesystem access. Which control mechanism is best suited for this?

Question 32easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

Which service account permission model is used by default when a pod is created without specifying a service account name?

Question 33easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

Which Kubernetes component manages the assignment of pending pods to healthy worker nodes based on resource availability and constraints?

Question 34mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An auditor notices that the kubelet on worker nodes is configured with --protect-kernel-defaults=true. What is the security purpose of this flag?

Question 35hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are auditing a multi-tenant Kubernetes cluster and notice that users can read ServiceAccount tokens belonging to other namespaces through improper RBAC configuration. Which ClusterRole permission should be strictly avoided or audited to prevent token theft via secret inspection?

Question 36easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

Which component is responsible for executing probes (liveness, readiness, startup) against containers running on a worker node?

Question 37hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are troubleshooting a control plane failure where the Kubernetes API server cannot communicate with etcd because of expired client certificates. Which command-line flag on the kube-apiserver specifies the client TLS certificate used for authentication against etcd?

Question 38hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are performing a security review of etcd cluster membership. You need to list all active members of the etcd cluster and check their health status using the command line. Which etcdctl command is correct?

Question 39easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

Which protocol and default secure port does the kubelet use to listen for incoming authenticated requests from the API server and metrics collectors?

Question 40easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

Which Kubernetes control plane component runs controllers that handle routine tasks such as replicating pods and managing service accounts?

Question 41mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator wants to audit who created or modified specific resources in the cluster. Where are API server audit records sent if configured with the log backend?

Question 42hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are troubleshooting a secure etcd cluster where a new control plane node cannot join the cluster. The logs indicate a TLS handshake failure between etcd peers. Which etcd configuration flag specifies the trusted CA certificate used to verify peer certificates?

Question 43mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator needs to ensure that the Kubernetes API server does not allow insecure cipher suites during TLS handshakes. Which API server flag allows specifying the exact cipher suites permitted?

Question 44easymultiple choice

Review the full routing breakdown →

Which component provides network routing and iptables/IPVS rule management across worker nodes for Kubernetes Services?

Question 45mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator wants to verify that etcd database defragmentation is performed periodically to reclaim storage space after large amounts of data churn. Which etcdctl command defragments an etcd member?

Question 46hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are performing a security assessment on an existing Kubernetes cluster. You discover that the kubelet API permits users with valid service account tokens to read sensitive container environment variables and logs. How should you configure the kubelet authorization mode to prevent unauthorized token holders from reading arbitrary pod data?

Question 47easymulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following are core security hardening best practices for the Kubernetes API server? (Choose TWO)

Question 48mediummulti select

Read the full Kubernetes Cluster Component Security explanation →

Which THREE of the following practices should be implemented to secure etcd in a production Kubernetes deployment? (Choose THREE)

Question 49hardmulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following kubelet security configurations are critical for preventing container escape and unauthorized node API access? (Choose TWO)

Question 50easymulti select

Read the full Kubernetes Cluster Component Security explanation →

Which THREE of the following are key components of the Kubernetes control plane? (Choose THREE)

Question 51mediummulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following methods can be used to authenticate users or systems against the Kubernetes API server? (Choose TWO)

Question 52hardmulti select

Read the full Kubernetes Cluster Component Security explanation →

Which THREE of the following auditing or logging mechanisms should be configured on a secure Kubernetes control plane? (Choose THREE)

Question 53mediummulti select

Read the full Kubernetes Cluster Component Security explanation →

Which THREE of the following tasks are performed by the Kubernetes control plane's kube-controller-manager? (Choose THREE)

Question 54easymulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following actions are risks associated with leaving the Kubernetes API server's insecure port enabled? (Choose TWO)

Question 55easymulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following files or directories on a control plane node contain critical static pod manifests for core components? (Choose TWO)

Question 56hardmulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following are valid ways to harden etcd against unauthorized access and data corruption? (Choose TWO)

Question 57mediummulti select

Read the full Kubernetes Cluster Component Security explanation →

Which THREE of the following criteria should be evaluated when reviewing Kubernetes RBAC policies to ensure least privilege? (Choose THREE)

Question 58hardmulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following mechanisms help secure the kubelet API from unauthorized access and container inspection? (Choose TWO)

Question 59mediummulti select

Read the full Kubernetes Cluster Component Security explanation →

Which THREE of the following steps are part of proper Kubernetes control plane certificate management? (Choose THREE)

Question 60hardmulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following API server configuration flags help enforce cryptographic and transport security? (Choose TWO)

Question 61easymulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following tasks are handled by the kube-scheduler? (Choose TWO)

Question 62easymulti select

Read the full Kubernetes Cluster Component Security explanation →

Which THREE of the following actions can compromise the security of the Kubernetes control plane if left unmitigated? (Choose THREE)

Question 63mediummulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following metrics or health endpoints should be protected against unauthenticated access on control plane nodes? (Choose TWO)

Question 64hardmulti select

Read the full Kubernetes Cluster Component Security explanation →

Which THREE of the following mechanisms are used by the Kubernetes API server to authorize requests after authentication succeeds? (Choose THREE)

Question 65mediummulti select

Read the full Kubernetes Cluster Component Security explanation →

Which THREE of the following practices should be followed when configuring Kubernetes audit logging? (Choose THREE)

Question 66hardmulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following scenarios represent severe security misconfigurations in a Kubernetes cluster control plane? (Choose TWO)

Question 67mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

A security engineer is reviewing a Kubernetes cluster and finds that the API server is using the default admission control chain without any webhook-based admission plugins enabled. The engineer wants to ensure that all pod creation requests are validated against a custom policy that prevents privileged containers. Which admission plugin should be enabled and configured to achieve this?

Question 68hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

A Kubernetes administrator is hardening a cluster and wants to ensure that the kubelet only accepts certificates from clients that have been signed by the cluster's certificate authority. The administrator has already configured the kubelet with --client-ca-file pointing to the correct CA bundle. Which additional kubelet configuration parameter must be set to enforce certificate-based authentication and reject anonymous requests?

Question 1mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

A security scan reveals that the kubelet read-only port (typically port 1055) is active and exposes unauthenticated pod and cluster metadata. How should this vulnerability be remediated?

Question 2easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An engineer needs to verify that the kubelet on worker nodes is not allowing unauthenticated requests. Which configuration parameter in the kubelet configuration file disables anonymous access?

Question 3mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator wants to prevent the kubelet from automatically approving certificate signing requests (CSRs) generated by nodes joining the cluster. Which mechanism manages kubelet TLS bootstrapping approval behavior?

Question 4mediummultiple choice

Study the full AAA explanation →

An administrator wants to limit the blast radius if an attacker compromises a worker node. Which setting ensures that the kubelet does not automatically create or modify ServiceAccount tokens for pods unless explicitly requested?

Question 5mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator wants to ensure that a malicious container executing on a worker node cannot query the kubelet API to extract sensitive pod information. Which kubelet configuration setting controls whether requests to the kubelet require authorization?

Question 6easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

When configuring Role-Based Access Control (RBAC), which Kubernetes object grants permissions across the entire cluster rather than within a single namespace?

Question 7mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator wants to ensure that API requests containing deprecated API versions trigger warnings in client output and audit logs. Which API server flag controls this behavior?

Question 8mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator wants to secure the communication channel between the Kubernetes API server and extension API servers (such as metrics-server). Which API server flag specifies the Certificate Authority used to verify extension API server certificates?

Question 9mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator wants to ensure that the Kubernetes API server rejects any incoming requests that do not match known API resource paths or have invalid syntax. Which admission controller helps validate request structures and schema compliance?

Question 10hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are tasked with securing a Kubernetes cluster where control plane nodes are hosted in a private network segment. To prevent unauthorized access to the API server from compromised internal workloads, which mechanism restricts which service accounts can access the API server?

Question 11easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

Which component acts as the local agent running on every Kubernetes worker node, responsible for maintaining pod lifecycles and container health?

Question 12hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are securing a Kubernetes cluster control plane and need to ensure that the API server limits request payload sizes to prevent Denial of Service (DoS) attacks via memory exhaustion. Which mechanism or flag controls request body size limits in the Kubernetes API server?

Question 13easymulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following are primary benefits of enabling encryption at rest for Kubernetes secrets? (Choose THREE - wait, choose TWO)

Question 14hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are hardening a production Kubernetes control plane. You need to ensure that etcd client-to-server and peer communications are strictly encrypted in transit and require mutual TLS (mTLS). Which etcd configuration flag combination enforces this requirement?

Question 15easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

When configuring the Kubernetes API server authorization modes, which mode evaluates requests against Kubernetes RBAC policies?

Question 16hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are auditing the Kubernetes control plane and notice that the API server is configured with an insecure port (--insecure-port=8080). What is the primary security implication of leaving this port enabled?

Question 17mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

A security auditor discovers that anonymous authentication is accidentally enabled on the Kubernetes API server, allowing unauthenticated read access to cluster health endpoints. Which API server flag must be modified to disable anonymous requests?

Question 18mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator needs to restrict kubelets so they can only modify resources associated with their own node (such as their own Node object and Pods bound to them). Which authorization mode must be enabled alongside RBAC?

Question 19easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator needs to secure access to the Kubernetes API server from an external CI/CD pipeline. Which mechanism should be used to authenticate the pipeline using an existing external identity provider without embedding long-lived static tokens?

Question 20easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

Which component in the Kubernetes control plane is directly responsible for interacting with etcd to persist and retrieve cluster state?

Question 21mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are hardening etcd and want to ensure that sensitive data stored in Kubernetes secrets is encrypted at rest within etcd. Which API server configuration file parameter specifies how secrets should be encrypted?

Question 22hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An incident response team suspects that an attacker has gained unauthorized access to the cluster via an unencrypted etcd backup file containing sensitive cluster state. Which etcd utility should be used to securely snapshot and backup etcd data?

Question 23easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

Where are static pods for a control plane node typically defined so that the kubelet can automatically create and manage them?

Question 24hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

A cluster administrator wants to implement admission control auditing to record all mutating and validating requests made to the API server. Which component configuration handles this requirement?

Question 25hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are reviewing security logs on a control plane node and discover that an unauthenticated user accessed the kubelet's HTTPS port (10250) to execute commands inside containers. How should you restrict kubelet authentication and authorization to prevent this?

Question 26easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

Which file on a Kubernetes control plane node contains the startup arguments and flags for the statically hosted API server?

Question 27hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You need to audit the cryptographic algorithms and TLS versions permitted by the Kubernetes API server for incoming client connections. Which API server flag enforces a minimum TLS version of 1.3?

Question 28easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

Which Kubernetes control plane component is responsible for noticing and responding when nodes go down or fail health checks?

Question 29mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator suspects that someone is attempting brute-force attacks against the Kubernetes API server. Where should the administrator look to inspect authentication failures generated by the API server?

Question 30hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are securing a highly regulated Kubernetes cluster and need to ensure that etcd data is encrypted at rest using a custom encryption key. After creating the EncryptionConfiguration file, which API server flag must be updated to point to this file?

Question 31hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are hardening etcd on a dedicated control plane host. You want to ensure that etcd database files on disk are protected against unauthorized physical or filesystem access. Which control mechanism is best suited for this?

Question 32easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

Which service account permission model is used by default when a pod is created without specifying a service account name?

Question 33easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

Which Kubernetes component manages the assignment of pending pods to healthy worker nodes based on resource availability and constraints?

Question 34mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An auditor notices that the kubelet on worker nodes is configured with --protect-kernel-defaults=true. What is the security purpose of this flag?

Question 35hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are auditing a multi-tenant Kubernetes cluster and notice that users can read ServiceAccount tokens belonging to other namespaces through improper RBAC configuration. Which ClusterRole permission should be strictly avoided or audited to prevent token theft via secret inspection?

Question 36easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

Which component is responsible for executing probes (liveness, readiness, startup) against containers running on a worker node?

Question 37hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are troubleshooting a control plane failure where the Kubernetes API server cannot communicate with etcd because of expired client certificates. Which command-line flag on the kube-apiserver specifies the client TLS certificate used for authentication against etcd?

Question 38hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are performing a security review of etcd cluster membership. You need to list all active members of the etcd cluster and check their health status using the command line. Which etcdctl command is correct?

Question 39easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

Which protocol and default secure port does the kubelet use to listen for incoming authenticated requests from the API server and metrics collectors?

Question 40easymultiple choice

Read the full Kubernetes Cluster Component Security explanation →

Which Kubernetes control plane component runs controllers that handle routine tasks such as replicating pods and managing service accounts?

Question 41mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator wants to audit who created or modified specific resources in the cluster. Where are API server audit records sent if configured with the log backend?

Question 42hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are troubleshooting a secure etcd cluster where a new control plane node cannot join the cluster. The logs indicate a TLS handshake failure between etcd peers. Which etcd configuration flag specifies the trusted CA certificate used to verify peer certificates?

Question 43mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator needs to ensure that the Kubernetes API server does not allow insecure cipher suites during TLS handshakes. Which API server flag allows specifying the exact cipher suites permitted?

Question 44easymultiple choice

Review the full routing breakdown →

Which component provides network routing and iptables/IPVS rule management across worker nodes for Kubernetes Services?

Question 45mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

An administrator wants to verify that etcd database defragmentation is performed periodically to reclaim storage space after large amounts of data churn. Which etcdctl command defragments an etcd member?

Question 46hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

You are performing a security assessment on an existing Kubernetes cluster. You discover that the kubelet API permits users with valid service account tokens to read sensitive container environment variables and logs. How should you configure the kubelet authorization mode to prevent unauthorized token holders from reading arbitrary pod data?

Question 47easymulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following are core security hardening best practices for the Kubernetes API server? (Choose TWO)

Question 48mediummulti select

Read the full Kubernetes Cluster Component Security explanation →

Which THREE of the following practices should be implemented to secure etcd in a production Kubernetes deployment? (Choose THREE)

Question 49hardmulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following kubelet security configurations are critical for preventing container escape and unauthorized node API access? (Choose TWO)

Question 50easymulti select

Read the full Kubernetes Cluster Component Security explanation →

Which THREE of the following are key components of the Kubernetes control plane? (Choose THREE)

Question 51mediummulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following methods can be used to authenticate users or systems against the Kubernetes API server? (Choose TWO)

Question 52hardmulti select

Read the full Kubernetes Cluster Component Security explanation →

Which THREE of the following auditing or logging mechanisms should be configured on a secure Kubernetes control plane? (Choose THREE)

Question 53mediummulti select

Read the full Kubernetes Cluster Component Security explanation →

Which THREE of the following tasks are performed by the Kubernetes control plane's kube-controller-manager? (Choose THREE)

Question 54easymulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following actions are risks associated with leaving the Kubernetes API server's insecure port enabled? (Choose TWO)

Question 55easymulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following files or directories on a control plane node contain critical static pod manifests for core components? (Choose TWO)

Question 56hardmulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following are valid ways to harden etcd against unauthorized access and data corruption? (Choose TWO)

Question 57mediummulti select

Read the full Kubernetes Cluster Component Security explanation →

Which THREE of the following criteria should be evaluated when reviewing Kubernetes RBAC policies to ensure least privilege? (Choose THREE)

Question 58hardmulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following mechanisms help secure the kubelet API from unauthorized access and container inspection? (Choose TWO)

Question 59mediummulti select

Read the full Kubernetes Cluster Component Security explanation →

Which THREE of the following steps are part of proper Kubernetes control plane certificate management? (Choose THREE)

Question 60hardmulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following API server configuration flags help enforce cryptographic and transport security? (Choose TWO)

Question 61easymulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following tasks are handled by the kube-scheduler? (Choose TWO)

Question 62easymulti select

Read the full Kubernetes Cluster Component Security explanation →

Which THREE of the following actions can compromise the security of the Kubernetes control plane if left unmitigated? (Choose THREE)

Question 63mediummulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following metrics or health endpoints should be protected against unauthenticated access on control plane nodes? (Choose TWO)

Question 64hardmulti select

Read the full Kubernetes Cluster Component Security explanation →

Which THREE of the following mechanisms are used by the Kubernetes API server to authorize requests after authentication succeeds? (Choose THREE)

Question 65mediummulti select

Read the full Kubernetes Cluster Component Security explanation →

Which THREE of the following practices should be followed when configuring Kubernetes audit logging? (Choose THREE)

Question 66hardmulti select

Read the full Kubernetes Cluster Component Security explanation →

Which TWO of the following scenarios represent severe security misconfigurations in a Kubernetes cluster control plane? (Choose TWO)

Question 67mediummultiple choice

Read the full Kubernetes Cluster Component Security explanation →

A security engineer is reviewing a Kubernetes cluster and finds that the API server is using the default admission control chain without any webhook-based admission plugins enabled. The engineer wants to ensure that all pod creation requests are validated against a custom policy that prevents privileged containers. Which admission plugin should be enabled and configured to achieve this?

Question 68hardmultiple choice

Read the full Kubernetes Cluster Component Security explanation →

A Kubernetes administrator is hardening a cluster and wants to ensure that the kubelet only accepts certificates from clients that have been signed by the cluster's certificate authority. The administrator has already configured the kubelet with --client-ca-file pointing to the correct CA bundle. Which additional kubelet configuration parameter must be set to enforce certificate-based authentication and reject anonymous requests?