KCSA Kubernetes Cluster Component Security Practice Test 3 — 15 Questions

Question 1

You are auditing a multi-tenant Kubernetes cluster and notice that users can read ServiceAccount tokens belonging to other namespaces through improper RBAC configuration. Which ClusterRole permission should be strictly avoided or audited to prevent token theft via secret inspection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verbs like 'get', 'list', or 'watch' on resource 'secrets' across all namespaces.. Granting read access to Secrets across namespaces allows malicious actors to harvest ServiceAccount tokens.

Answer

Verbs like 'get' on resource 'pods/status'.

Answer

Verbs like 'list' on resource 'namespaces'.

Answer

Verbs like 'create' on resource 'deployments'.

Question 2

Which component is responsible for executing probes (liveness, readiness, startup) against containers running on a worker node?

Accepted Answer

kubelet. The kubelet executes liveness, readiness, and startup probes directly for containers on its node.

Answer

kube-scheduler

Answer

kube-controller-manager

Answer

kube-apiserver

Question 3

You are troubleshooting a control plane failure where the Kubernetes API server cannot communicate with etcd because of expired client certificates. Which command-line flag on the kube-apiserver specifies the client TLS certificate used for authentication against etcd?

Accepted Answer

--etcd-certfile. The --etcd-certfile flag specifies the TLS client certificate used when the API server connects to etcd.

Answer

--etcd-private-key

Answer

--client-cert-file

Answer

--etcd-ca-file

Question 4

An administrator wants to secure the communication channel between the Kubernetes API server and extension API servers (such as metrics-server). Which API server flag specifies the Certificate Authority used to verify extension API server certificates?

Accepted Answer

--requestheader-client-ca-file. The --requestheader-client-ca-file flag specifies the CA certificate used to sign client certificates for aggregated API servers.

Answer

--extension-ca-file

Answer

--etcd-ca-file

Answer

--proxy-client-cert-file

Question 5

An administrator wants to ensure that the Kubernetes API server rejects any incoming requests that do not match known API resource paths or have invalid syntax. Which admission controller helps validate request structures and schema compliance?

Accepted Answer

The built-in OpenAPI schema validation and ValidatingAdmissionWebhook.. Schema validation and structural compliance are handled by the built-in validation mechanisms and admission controllers in the API server.

Answer

The etcd transaction validator.

Answer

The core scheduler admission plugin.

Answer

The kube-proxy filter admission module.

Question 6

You are performing a security review of etcd cluster membership. You need to list all active members of the etcd cluster and check their health status using the command line. Which etcdctl command is correct?

Accepted Answer

etcdctl member list and etcdctl endpoint health. etcdctl member list and etcdctl endpoint health are the standard diagnostic commands for checking etcd cluster state.

Answer

etcdctl check membership

Answer

etcdctl cluster status

Answer

kubectl get etcdmembers

Question 7

You are tasked with securing a Kubernetes cluster where control plane nodes are hosted in a private network segment. To prevent unauthorized access to the API server from compromised internal workloads, which mechanism restricts which service accounts can access the API server?

Accepted Answer

Strict RBAC Role and ClusterRole bindings adhering to the principle of least privilege.. Role-Based Access Control (RBAC) combined with least-privilege binding ensures service accounts only access permitted API resources.

Answer

Setting kubelet readOnlyPort to 8080.

Answer

Enabling anonymous access.

Answer

Disabling the Node authorizer.

Question 8

Which protocol and default secure port does the kubelet use to listen for incoming authenticated requests from the API server and metrics collectors?

Accepted Answer

HTTPS on port 10250. The kubelet listens on TCP port 10250 for secure HTTPS traffic.

Answer

HTTPS on port 6443

Answer

TCP on port 2379

Answer

HTTP on port 10255

Question 9

Which Kubernetes control plane component runs controllers that handle routine tasks such as replicating pods and managing service accounts?

Accepted Answer

kube-controller-manager. The kube-controller-manager houses core control loops including the replication controller, service account controller, and namespace controller.

Answer

CoreDNS

Answer

etcd

Answer

kube-proxy

Question 10

An administrator wants to audit who created or modified specific resources in the cluster. Where are API server audit records sent if configured with the log backend?

Accepted Answer

To the file path specified by --audit-log-path on the control plane host.. When using the log audit backend, audit records are written to a file path specified by --audit-log-path.

Answer

Directly to the etcd key-value store under /audit/logs.

Answer

To the container stdout of kube-proxy.

Answer

To the kubelet systemd journal on worker nodes.

Question 11

You are troubleshooting a secure etcd cluster where a new control plane node cannot join the cluster. The logs indicate a TLS handshake failure between etcd peers. Which etcd configuration flag specifies the trusted CA certificate used to verify peer certificates?

Accepted Answer

--peer-trusted-ca-file. The --peer-trusted-ca-file flag specifies the CA certificate used to verify peer-to-peer TLS connections in etcd.

Answer

--trusted-ca-file

Answer

--peer-client-cert-auth

Answer

--etcd-ca-file

Question 12

An administrator needs to ensure that the Kubernetes API server does not allow insecure cipher suites during TLS handshakes. Which API server flag allows specifying the exact cipher suites permitted?

Accepted Answer

--tls-cipher-suites. The --tls-cipher-suites flag allows administrators to define an explicit array of permitted cryptographic cipher suites.

Answer

--cipher-list

Answer

--secure-ciphers

Answer

--etcd-cipher-suites

Question 13

Which component provides network routing and iptables/IPVS rule management across worker nodes for Kubernetes Services?

Accepted Answer

kube-proxy. kube-proxy maintains network rules on nodes allowing network communication to pods.

Answer

kube-scheduler

Answer

kube-apiserver

Answer

etcd

Question 14

An administrator wants to verify that etcd database defragmentation is performed periodically to reclaim storage space after large amounts of data churn. Which etcdctl command defragments an etcd member?

Accepted Answer

etcdctl defrag. etcdctl defrag is the command used to defragment the etcd database file.

Answer

kubectl etcd-clean

Answer

etcdctl compact

Answer

etcdctl cleanup storage

Question 15

You are performing a security assessment on an existing Kubernetes cluster. You discover that the kubelet API permits users with valid service account tokens to read sensitive container environment variables and logs. How should you configure the kubelet authorization mode to prevent unauthorized token holders from reading arbitrary pod data?

Accepted Answer

Set kubelet authorization mode to Webhook so the API server evaluates RBAC permissions for kubelet requests.. Enabling Webhook authorization on the kubelet ensures that API server RBAC rules govern access to kubelet subresources like logs and exec.

Answer

Set kubelet authorization mode to AlwaysAllow.

Answer

Enable anonymous access on port 10250.

Answer

Disable the kubelet authentication certificate.