KCSA Kubernetes Cluster Component Security Practice Test 1 — 15 Questions

Question 1

A security scan reveals that the kubelet read-only port (typically port 1055) is active and exposes unauthenticated pod and cluster metadata. How should this vulnerability be remediated?

Accepted Answer

Set readOnlyPort: 0 in the kubelet configuration file.. The kubelet read-only port (default 10255, sometimes referenced as 1055 in older docs) serves unauthenticated, unencrypted pod and node metadata. The correct remediation is to disable it entirely by setting readOnlyPort: 0 in the kubelet configuration (or --read-only-port=0 flag), which removes the exposure at its source rather than attempting to filter it.

Answer

Configure an RBAC ClusterRoleBinding for system:anonymous.

Answer

Enable PodSecurityStandards in enforcing mode.

Answer

Apply a NetworkPolicy blocking ingress traffic to port 1055.

Question 2

An engineer needs to verify that the kubelet on worker nodes is not allowing unauthenticated requests. Which configuration parameter in the kubelet configuration file disables anonymous access?

Accepted Answer

authentication.anonymous.enabled: false. In the kubelet configuration file (KubeletConfiguration, v1beta1), anonymous authentication is controlled by the nested field authentication.anonymous.enabled. Setting it to false disables unauthenticated requests to the kubelet's HTTPS endpoint, forcing all callers to present a valid client certificate or bearer token. This is the canonical, schema-valid way to turn off anonymous access in modern Kubernetes.

Answer

anonymousAuth: "Disabled"

Answer

enableAnonymousAccess: false

Answer

readOnlyPort: 0

Question 3

An administrator wants to prevent the kubelet from automatically approving certificate signing requests (CSRs) generated by nodes joining the cluster. Which mechanism manages kubelet TLS bootstrapping approval behavior?

Accepted Answer

The CSR Approver controller in the kube-controller-manager.. The CSR Approver controller, part of the kube-controller-manager, is responsible for automatically approving or denying CertificateSigningRequests submitted by kubelets during TLS bootstrapping. It evaluates CSRs against configured policies (such as the `--cluster-signing-cert-file` and RBAC permissions on `certificates.k8s.io` resources) and issues approvals. Disabling or restricting this controller (or removing the `system:certificates.k8s.io:certificatesigningrequests:nodeclient` ClusterRole binding) prevents automatic approval of node CSRs.

Answer

The etcd consensus module.

Answer

The kube-scheduler placement policy engine.

Answer

The API server admission webhook chain.

Question 4

An administrator wants to limit the blast radius if an attacker compromises a worker node. Which setting ensures that the kubelet does not automatically create or modify ServiceAccount tokens for pods unless explicitly requested?

Accepted Answer

Set serviceAccountAutoMount: false or automountServiceAccountToken: false on service accounts or pod specs.. Setting automountServiceAccountToken: false on the ServiceAccount or in the pod spec prevents the kubelet from projecting a service account token into the pod's filesystem unless explicitly requested. This limits blast radius because a compromised pod cannot use an auto-mounted token to call the API server. The setting can be applied at the ServiceAccount level (affecting all pods using it) or per-pod (overriding the ServiceAccount default).

Answer

Configure the API server with --disable-service-accounts=true.

Answer

Set kubelet flag --encrypt-tokens=true.

Answer

Enable etcd encryption for service account tokens.

Question 5

An administrator wants to ensure that a malicious container executing on a worker node cannot query the kubelet API to extract sensitive pod information. Which kubelet configuration setting controls whether requests to the kubelet require authorization?

Accepted Answer

authorization.mode: Webhook. The kubelet's authorization.mode setting determines how it authorizes API requests. Setting it to Webhook makes the kubelet send SubjectAccessReview requests to the kube-apiserver, so only identities with proper RBAC (e.g., system:kubelet-api-admin) can access the kubelet API. This prevents a compromised container from querying the kubelet to extract pod secrets or execute commands.

Answer

protectKernelDefaults: false

Answer

tlsCertFile: /etc/certs/kubelet.crt

Answer

authentication.anonymous.enabled: true

Question 6

When configuring Role-Based Access Control (RBAC), which Kubernetes object grants permissions across the entire cluster rather than within a single namespace?

Accepted Answer

ClusterRole. A ClusterRole is a cluster-scoped RBAC object that defines permissions (rules) that can be applied across all namespaces or to cluster-scoped resources like nodes and persistent volumes. Unlike a Role, which is namespace-scoped, a ClusterRole is not bound to a single namespace and can be referenced by RoleBindings or ClusterRoleBindings to grant permissions cluster-wide. This makes it the correct answer for granting permissions across the entire cluster.

Answer

ServiceAccount

Answer

Role

Answer

PodSecurityPolicy

Question 7

An administrator wants to ensure that API requests containing deprecated API versions trigger warnings in client output and audit logs. Which API server flag controls this behavior?

Accepted Answer

--runtime-config. The --runtime-config flag or deprecation tracking flags help manage deprecated API groups and versions.

Answer

--disable-deprecated-apis

Answer

--warn-deprecated-apis=true

Answer

--log-deprecated=true

Question 8

An administrator wants to secure the communication channel between the Kubernetes API server and extension API servers (such as metrics-server). Which API server flag specifies the Certificate Authority used to verify extension API server certificates?

Accepted Answer

--requestheader-client-ca-file. The --requestheader-client-ca-file flag on the kube-apiserver specifies the CA bundle used to verify client certificates presented by extension API servers (like metrics-server) when they authenticate to the main API server via the aggregation layer. This is part of the API aggregation configuration, along with --requestheader-allowed-names and --requestheader-extra-headers-prefix.

Answer

--extension-ca-file

Answer

--etcd-ca-file

Answer

--proxy-client-cert-file

Question 9

An administrator wants to ensure that the Kubernetes API server rejects any incoming requests that do not match known API resource paths or have invalid syntax. Which admission controller helps validate request structures and schema compliance?

Accepted Answer

The built-in OpenAPI schema validation and ValidatingAdmissionWebhook.. The API server validates incoming requests against the OpenAPI schema for known resource types, rejecting malformed or unknown paths before they reach admission. ValidatingAdmissionWebhook extends this by calling external webhooks that can enforce custom schema and policy validation. Together they cover structural and schema compliance for API requests.

Answer

The etcd transaction validator.

Answer

The core scheduler admission plugin.

Answer

The kube-proxy filter admission module.

Question 10

You are tasked with securing a Kubernetes cluster where control plane nodes are hosted in a private network segment. To prevent unauthorized access to the API server from compromised internal workloads, which mechanism restricts which service accounts can access the API server?

Accepted Answer

Strict RBAC Role and ClusterRole bindings adhering to the principle of least privilege.. Strict RBAC Role and ClusterRole bindings that follow the principle of least privilege are the primary mechanism to restrict which service accounts can access the API server. By binding only the necessary verbs and resources to specific service accounts, you ensure that a compromised workload cannot escalate privileges or access sensitive API endpoints. This directly addresses the requirement to prevent unauthorized access from compromised internal workloads.

Answer

Setting kubelet readOnlyPort to 8080.

Answer

Enabling anonymous access.

Answer

Disabling the Node authorizer.

Question 11

Which component acts as the local agent running on every Kubernetes worker node, responsible for maintaining pod lifecycles and container health?

Accepted Answer

kube-apiserver. The kubelet is the primary agent running on each node.

Answer

kube-proxy

Answer

kube-scheduler

Question 12

You are securing a Kubernetes cluster control plane and need to ensure that the API server limits request payload sizes to prevent Denial of Service (DoS) attacks via memory exhaustion. Which mechanism or flag controls request body size limits in the Kubernetes API server?

Accepted Answer

The API server enforces built-in request body size limits (e.g., 3MB max for standard requests) to prevent large payload attacks.. The Kubernetes API server enforces built-in request body size limits — approximately 3MB for standard requests — to prevent memory exhaustion from oversized payloads. This is a hardcoded safeguard in the apiserver's request handling path, not a configurable flag on kubelet or kube-proxy. It protects the control plane from DoS attacks that would otherwise consume memory parsing huge JSON bodies.

Answer

Set kubelet flag --max-pod-payload.

Answer

Configure kube-proxy with --max-buffer-size.

Answer

Configure etcd with --max-request-bytes flag.

Question 13

Which TWO of the following are primary benefits of enabling encryption at rest for Kubernetes secrets? (Choose THREE - wait, choose TWO)

Accepted Answer

Protects sensitive secret data from being read in plaintext if etcd storage files are accessed.. Encryption at rest protects secrets stored in etcd from being read if the etcd data store is compromised.

Answer

Automatically disables kubelet anonymous authentication.

Answer

Accelerates network packet routing across Kubernetes Services.

Answer

Replaces the need for RBAC authorization policies.

Question 14

You are hardening a production Kubernetes control plane. You need to ensure that etcd client-to-server and peer communications are strictly encrypted in transit and require mutual TLS (mTLS). Which etcd configuration flag combination enforces this requirement?

Accepted Answer

--client-cert-auth=true and --peer-client-cert-auth=true along with valid CA and key pair paths.. The flags --client-cert-auth=true and --peer-client-cert-auth=true force etcd to require and verify client certificates on both the client-facing listener (port 2379) and the peer listener (port 2380), which is exactly what mTLS demands. Combined with --cert-file, --key-file, --trusted-ca-file, --peer-cert-file, --peer-key-file, and --peer-trusted-ca-file, etcd will reject any connection that does not present a certificate signed by the trusted CA. This is the canonical CIS Kubernetes Benchmark configuration for a hardened etcd.

Answer

--auto-tls=true for all endpoints.

Answer

--insecure-transport=false combined with HTTP proxy routing.

Answer

--cipher-suites=TLS_RSA_WITH_AES_128_CBC_SHA

Question 15

When configuring the Kubernetes API server authorization modes, which mode evaluates requests against Kubernetes RBAC policies?

Accepted Answer

RBAC. The RBAC authorization mode in the Kubernetes API server evaluates requests against Role-Based Access Control policies defined via Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings. When enabled, the API server checks whether the requesting user or service account has a binding that grants the required verb on the target resource. RBAC is the standard, fine-grained authorization mechanism in modern Kubernetes clusters.

Answer

Webhook

Answer

Node

Answer

AlwaysAllow