KCSA Kubernetes Cluster Component Security Practice Test 3 — 15 Questions

Question 1

You are hardening etcd on a dedicated control plane host. You want to ensure that etcd database files on disk are protected against unauthorized physical or filesystem access. Which control mechanism is best suited for this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Filesystem or block-level disk encryption (e.g., LUKS) on the host storage volume.. Filesystem or block-level disk encryption (e.g., LUKS on Linux) is the correct control because it protects etcd data files at rest against physical theft or unauthorized filesystem access. If an attacker steals the disk or gains raw block-device access, LUKS-encrypted volumes are unreadable without the decryption key. This directly addresses the threat model of physical or offline filesystem compromise, which is what the question asks about.

Answer

Kubernetes NetworkPolicies applied to the etcd Pod.

Answer

API server RBAC ClusterRoleBinding.

Answer

Kubelet read-only port disabling.

Question 2

Which service account permission model is used by default when a pod is created without specifying a service account name?

Accepted Answer

The 'default' service account in the pod's namespace.. When a pod is created without specifying a serviceAccountName, Kubernetes automatically assigns the 'default' service account from the pod's namespace. This is a built-in behavior: every namespace has a 'default' ServiceAccount created automatically, and the admission controller injects it if none is specified. This default account typically has no extra permissions beyond basic API discovery, but it still exists and can be used for identity.

Answer

No service account is assigned.

Answer

The 'cluster-admin' service account.

Answer

The 'kube-system' privileged service account.

Question 3

Which Kubernetes component manages the assignment of pending pods to healthy worker nodes based on resource availability and constraints?

Accepted Answer

kube-scheduler. kube-scheduler watches for newly created Pods that have no node assigned and selects a node for them to run on. It filters nodes through predicates (resource requests, taints/tolerations, node affinity, topology spread) and then scores the remaining candidates to pick the best fit. The result is written back to the API server as a binding.

Answer

kube-proxy

Answer

kube-apiserver

Answer

etcd

Question 4

An auditor notices that the kubelet on worker nodes is configured with --protect-kernel-defaults=true. What is the security purpose of this flag?

Accepted Answer

It ensures that critical kernel parameters match expected secure baseline settings and prevents unauthorized modification.. The --protect-kernel-defaults flag in the kubelet enforces that certain kernel parameters (sysctls) and kernel module settings match the kubelet's expected secure defaults. When enabled, the kubelet will fail to start or will refuse to run pods if it detects that critical kernel tunables—such as those related to IP forwarding, memory overcommit, or panic settings—have been changed from the kubelet's built-in safe values. This prevents accidental or malicious modification of kernel settings that could weaken container isolation or destabilize the node.

Answer

It encrypts all kernel log (kmsg) outputs.

Answer

It prevents the Linux kernel from running container workloads as root.

Answer

It forces the kubelet to run inside an isolated kernel container.

Question 5

You are auditing a multi-tenant Kubernetes cluster and notice that users can read ServiceAccount tokens belonging to other namespaces through improper RBAC configuration. Which ClusterRole permission should be strictly avoided or audited to prevent token theft via secret inspection?

Accepted Answer

Verbs like 'get', 'list', or 'watch' on resource 'secrets' across all namespaces.. To prevent token theft via secret inspection, you must avoid or audit ClusterRole permissions that allow 'get', 'list', or 'watch' on 'secrets' across all namespaces. ServiceAccount tokens are stored as Secrets, so broad read access to secrets enables attackers to steal tokens and escalate privileges. Option D correctly identifies this critical permission set.

Answer

Verbs like 'get' on resource 'pods/status'.

Answer

Verbs like 'list' on resource 'namespaces'.

Answer

Verbs like 'create' on resource 'deployments'.

Question 6

Which component is responsible for executing probes (liveness, readiness, startup) against containers running on a worker node?

Accepted Answer

kubelet. The kubelet is the node agent that runs on every worker node and is responsible for managing Pod lifecycle on that node. It receives PodSpecs from the API server and executes the actual container runtime operations, including running liveness, readiness, and startup probes against containers via the container runtime interface (CRI). The kubelet interprets probe definitions (httpGet, tcpSocket, exec, grpc) and periodically executes them, taking action such as restarting containers on liveness failure or removing Pods from Service endpoints on readiness failure.

Answer

kube-scheduler

Answer

kube-controller-manager

Answer

kube-apiserver

Question 7

You are troubleshooting a control plane failure where the Kubernetes API server cannot communicate with etcd because of expired client certificates. Which command-line flag on the kube-apiserver specifies the client TLS certificate used for authentication against etcd?

Accepted Answer

--etcd-certfile. The kube-apiserver flag --etcd-certfile specifies the client TLS certificate that the API server presents to etcd for mutual TLS authentication. When the API server connects to etcd, it must authenticate itself using a client certificate; this flag points to the PEM-encoded certificate file. Without it, the API server cannot establish a secure connection to etcd, leading to control plane failures. The correct flag is explicitly named for the etcd client certificate, not a generic client certificate.

Answer

--etcd-private-key

Answer

--client-cert-file

Answer

--etcd-ca-file

Question 8

You are performing a security review of etcd cluster membership. You need to list all active members of the etcd cluster and check their health status using the command line. Which etcdctl command is correct?

Accepted Answer

etcdctl member list and etcdctl endpoint health. etcdctl provides two distinct subcommands for this task: 'etcdctl member list' enumerates all cluster members with their IDs, peer URLs, and client URLs, while 'etcdctl endpoint health' queries each endpoint to verify it can serve requests and is not lagging. Together they satisfy the requirement to list active members and check their health.

Answer

etcdctl check membership

Answer

etcdctl cluster status

Answer

kubectl get etcdmembers

Question 9

Which protocol and default secure port does the kubelet use to listen for incoming authenticated requests from the API server and metrics collectors?

Accepted Answer

HTTPS on port 10250. The kubelet listens on HTTPS port 10250 by default for authenticated requests from the API server (e.g., kubectl logs, exec) and from metrics collectors like the metrics-server. This port requires authentication and authorization (via the kubelet's --authorization-mode and client CA), and it is the standard secure endpoint for kubelet API access. Port 10255 is the read-only, unauthenticated HTTP port that is disabled by default in modern Kubernetes due to security concerns.

Answer

HTTPS on port 6443

Answer

TCP on port 2379

Answer

HTTP on port 10255

Question 10

Which Kubernetes control plane component runs controllers that handle routine tasks such as replicating pods and managing service accounts?

Accepted Answer

kube-controller-manager. The kube-controller-manager is the control plane component that runs the built-in controllers — including the ReplicaSet controller (which maintains desired pod replica counts), the ServiceAccount controller (which creates default service accounts and tokens), and the Node, Endpoint, and Namespace controllers. It continuously reconciles observed cluster state with the desired state declared in the API server.

Answer

CoreDNS

Answer

etcd

Answer

kube-proxy

Question 11

An administrator wants to audit who created or modified specific resources in the cluster. Where are API server audit records sent if configured with the log backend?

Accepted Answer

To the file path specified by --audit-log-path on the control plane host.. When the Kubernetes API server is configured with the log audit backend, audit records are written to the file path specified by the --audit-log-path flag on the control plane host. This is the default and most straightforward backend for audit logging, allowing administrators to review who did what and when. The log backend writes JSON-formatted audit events to that file, which can then be rotated and analyzed.

Answer

Directly to the etcd key-value store under /audit/logs.

Answer

To the container stdout of kube-proxy.

Answer

To the kubelet systemd journal on worker nodes.

Question 12

You are troubleshooting a secure etcd cluster where a new control plane node cannot join the cluster. The logs indicate a TLS handshake failure between etcd peers. Which etcd configuration flag specifies the trusted CA certificate used to verify peer certificates?

Accepted Answer

--peer-trusted-ca-file. etcd uses separate TLS configurations for client-facing and peer-to-peer traffic. The --peer-trusted-ca-file flag specifies the CA bundle that etcd uses to verify the certificates presented by its peer etcd members during mutual TLS handshakes. Since the failure is a peer TLS handshake, the peer-specific CA flag is the correct one to check and configure.

Answer

--trusted-ca-file

Answer

--peer-client-cert-auth

Answer

--etcd-ca-file

Question 13

An administrator needs to ensure that the Kubernetes API server does not allow insecure cipher suites during TLS handshakes. Which API server flag allows specifying the exact cipher suites permitted?

Accepted Answer

--tls-cipher-suites. The --tls-cipher-suites flag on the kube-apiserver allows administrators to specify a comma-separated list of allowed cipher suites for TLS handshakes. This directly controls which cipher suites the API server will accept, enabling compliance with security policies that require strong ciphers and disallow insecure ones.

Answer

--cipher-list

Answer

--secure-ciphers

Answer

--etcd-cipher-suites

Question 14

Which component provides network routing and iptables/IPVS rule management across worker nodes for Kubernetes Services?

Accepted Answer

kube-proxy. kube-proxy runs on every node and is responsible for programming iptables (or IPVS, or nftables in newer versions) rules that implement Kubernetes Service virtual IPs and load balancing to backend pods. It watches the API server for Service and EndpointSlice objects and translates them into node-local dataplane rules. Without kube-proxy (or a replacement like Cilium's kube-proxy replacement), ClusterIP and NodePort services would not function.

Answer

kube-scheduler

Answer

kube-apiserver

Answer

etcd

Question 15

An administrator wants to verify that etcd database defragmentation is performed periodically to reclaim storage space after large amounts of data churn. Which etcdctl command defragments an etcd member?

Accepted Answer

etcdctl defrag. The etcdctl defrag command defragments an etcd member's database, reclaiming storage space after data churn (e.g., many writes and deletes). Defragmentation compacts the underlying BoltDB file, reducing its size and improving performance. It is typically run periodically on each etcd member, often after compaction.

Answer

kubectl etcd-clean

Answer

etcdctl compact

Answer

etcdctl cleanup storage