KCSA Kubernetes Cluster Component Security Practice Test 4 — 15 Questions

Question 1

You are securing a Kubernetes cluster control plane and need to ensure that the API server limits request payload sizes to prevent Denial of Service (DoS) attacks via memory exhaustion. Which mechanism or flag controls request body size limits in the Kubernetes API server?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The API server enforces built-in request body size limits (e.g., 3MB max for standard requests) to prevent large payload attacks.. The API server enforces request body size limits natively for incoming HTTP requests (such as 3MB for standard requests and larger for specific subresources).

Answer

Set kubelet flag --max-pod-payload.

Answer

Configure kube-proxy with --max-buffer-size.

Answer

Configure etcd with --max-request-bytes flag.

Question 2

Which TWO of the following are core security hardening best practices for the Kubernetes API server? (Choose TWO)

Accepted Answer

Ensure the insecure port (--insecure-port) is disabled or set to 0.. Disabling anonymous requests and enforcing strong TLS versions are essential API server hardening steps.

Answer

Configure the API server to use HTTP instead of HTTPS for performance.

Answer

Store all kubeconfig credentials in public ConfigMaps.

Answer

Grant cluster-admin permissions to all authenticated users by default.

Question 3

Which THREE of the following practices should be implemented to secure etcd in a production Kubernetes deployment? (Choose THREE)

Accepted Answer

Enable client certificate authentication using --client-cert-auth=true.. Etcd security relies on mTLS for client and peer connections, and encryption at rest.

Answer

Disable TLS verification to simplify certificate rotation.

Answer

Expose etcd on a public internet IP address without authentication for easy monitoring.

Question 4

Which TWO of the following kubelet security configurations are critical for preventing container escape and unauthorized node API access? (Choose TWO)

Accepted Answer

Configure kubelet authorization mode to Webhook.. Disabling the read-only port and enforcing webhook authorization on the kubelet secure port are essential node security measures.

Answer

Enable anonymous authentication on the kubelet secure port.

Answer

Run kubelet containers in privileged mode.

Answer

Set authorization.mode to AlwaysAllow.

Question 5

Which THREE of the following are key components of the Kubernetes control plane? (Choose THREE)

Accepted Answer

kube-scheduler. The API server, scheduler, and controller manager are core control plane components.

Answer

container runtime (e.g., containerd)

Answer

kube-proxy

Question 6

Which TWO of the following methods can be used to authenticate users or systems against the Kubernetes API server? (Choose TWO)

Accepted Answer

X.509 client certificates validated by the API server CA.. OpenID Connect (OIDC) tokens and X.509 client certificates are standard native authentication methods for the API server.

Answer

Unencrypted HTTP basic auth files with default passwords.

Answer

Anonymous packet sniffing via kube-proxy.

Answer

Direct root SSH access to etcd nodes.

Question 7

Which THREE of the following auditing or logging mechanisms should be configured on a secure Kubernetes control plane? (Choose THREE)

Accepted Answer

Kubernetes API server audit logging configured with an audit policy file.. API server audit logging, etcd transaction logging, and node system logs are crucial auditing layers.

Answer

Routing all cluster traffic through an unencrypted proxy log.

Answer

Disabling all log outputs to prevent disk space exhaustion.

Question 8

Which THREE of the following tasks are performed by the Kubernetes control plane's kube-controller-manager? (Choose THREE)

Accepted Answer

Managing node lifecycle status and detecting node failures.. The controller manager runs node, service account, and replication controllers.

Answer

Running container workloads directly on worker node operating systems.

Answer

Configuring iptables and IPVS rules for Kubernetes Services on nodes.

Question 9

Which TWO of the following actions are risks associated with leaving the Kubernetes API server's insecure port enabled? (Choose TWO)

Accepted Answer

Complete bypass of all authentication mechanisms.. The insecure port allows unauthenticated and unencrypted access.

Answer

Enforcement of strict TLS 1.3 encryption on all connections.

Answer

Mandatory mutual TLS client certificate verification.

Answer

Automatic activation of etcd encryption at rest.

Question 10

Which TWO of the following files or directories on a control plane node contain critical static pod manifests for core components? (Choose TWO)

Accepted Answer

/etc/kubernetes/manifests/etcd.yaml. The /etc/kubernetes/manifests directory holds static pod yaml files for kube-apiserver, etcd, etc.

Answer

/var/lib/kubelet/config.yaml

Answer

/etc/default/kube-proxy

Answer

~/.kube/config

Question 11

Which TWO of the following are valid ways to harden etcd against unauthorized access and data corruption? (Choose TWO)

Accepted Answer

Require mutual TLS (mTLS) for all client and peer connections.. Enforcing client certificate authentication and taking regular encrypted snapshots secure etcd.

Answer

Expose etcd directly over unencrypted HTTP on port 2379.

Answer

Disable client certificate verification to allow unrestricted access.

Answer

Grant public anonymous write access to the etcd raft log.

Question 12

Which THREE of the following criteria should be evaluated when reviewing Kubernetes RBAC policies to ensure least privilege? (Choose THREE)

Accepted Answer

Carefully audit permissions that allow impersonation or binding of roles.. RBAC reviews should check for overly broad resource permissions, dangerous verbs like 'impersonate' or 'bind', and cluster-wide bindings.

Answer

Ensure anonymous users have write access to all namespaces.

Answer

Grant cluster-admin permissions to every service account by default.

Question 13

Which TWO of the following mechanisms help secure the kubelet API from unauthorized access and container inspection? (Choose TWO)

Accepted Answer

Enabling Webhook authorization mode so kubelet requests are validated against API server RBAC.. Setting authorization mode to Webhook and disabling anonymous access protect the kubelet API.

Answer

Removing all TLS certificates from the kubelet configuration.

Answer

Setting kubelet authorization mode to AlwaysAllow.

Answer

Enabling the kubelet read-only port 10255.

Question 14

Which THREE of the following steps are part of proper Kubernetes control plane certificate management? (Choose THREE)

Accepted Answer

Using a trusted Certificate Authority (CA) rather than self-signed certificates where possible.. Proper certificate management includes regular rotation, using a trusted internal or enterprise CA, and setting appropriate validity durations.

Answer

Disabling TLS verification for all internal cluster components.

Answer

Storing all private keys in unencrypted public ConfigMaps.

Question 15

Which TWO of the following API server configuration flags help enforce cryptographic and transport security? (Choose TWO)

Accepted Answer

--tls-cipher-suites to specify permitted strong cryptographic cipher suites.. --tls-min-version and --tls-cipher-suites enforce transport security standards.

Answer

--anonymous-auth to enable unauthenticated cluster access.

Answer

--insecure-port to allow unencrypted HTTP traffic.

Answer

--enable-http2=false to disable secure multiplexing.