KCSA Kubernetes Cluster Component Security Practice Test 4 — 15 Questions

Question 1

You are performing a security assessment on an existing Kubernetes cluster. You discover that the kubelet API permits users with valid service account tokens to read sensitive container environment variables and logs. How should you configure the kubelet authorization mode to prevent unauthorized token holders from reading arbitrary pod data?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set kubelet authorization mode to Webhook so the API server evaluates RBAC permissions for kubelet requests.. Setting the kubelet authorization mode to Webhook delegates authorization decisions to the API server, which evaluates RBAC policies for the requesting user or service account. This ensures that only identities with explicit RBAC permissions can access kubelet endpoints like /pods, /logs, or /exec. By default, kubelet may use AlwaysAllow, which grants full access to any authenticated user, including service account tokens, leading to the vulnerability described.

Answer

Set kubelet authorization mode to AlwaysAllow.

Answer

Enable anonymous access on port 10250.

Answer

Disable the kubelet authentication certificate.

Question 2

Which TWO of the following are core security hardening best practices for the Kubernetes API server? (Choose TWO)

Accepted Answer

Ensure the insecure port (--insecure-port) is disabled or set to 0.. Option A is correct because the API server's insecure port (--insecure-port) serves unauthenticated, unencrypted HTTP traffic, so setting it to 0 (or disabling it) is a fundamental CIS Kubernetes Benchmark hardening step that forces all communication through the authenticated, TLS-protected secure port (default 6443). Option E is correct because anonymous authentication allows unauthenticated requests to reach the API server and be evaluated as the system:anonymous user; setting --anonymous-auth=false ensures every request must present valid credentials, preventing unauthenticated access and information disclosure. Option B is wrong because HTTP would remove TLS encryption and client authentication, weakening rather than hardening the API server. Option C is wrong because kubeconfig files contain credentials and certificates, and storing them in public ConfigMaps would expose cluster access to anyone who can read the ConfigMap. Option D is wrong because granting cluster-admin to all authenticated users violates least privilege and would give every account full control of the cluster.

Answer

Configure the API server to use HTTP instead of HTTPS for performance.

Answer

Store all kubeconfig credentials in public ConfigMaps.

Answer

Grant cluster-admin permissions to all authenticated users by default.

Question 3

Which THREE of the following practices should be implemented to secure etcd in a production Kubernetes deployment? (Choose THREE)

Accepted Answer

Enable client certificate authentication using --client-cert-auth=true.. Option B is correct because enabling client certificate authentication with --client-cert-auth=true forces every etcd client (kube-apiserver, etcdctl, etc.) to present a valid TLS client certificate signed by the trusted CA, preventing unauthenticated access to the etcd API. Option D is correct because encrypting data at rest via an EncryptionConfiguration file (referenced with --encryption-provider-config) protects Secrets and other sensitive objects stored in etcd from being read in plaintext if the disk or backup is compromised. Option E is correct because etcd peer traffic carries cluster state and raft data, so enabling peer-to-peer encryption with mutual TLS using flags such as --peer-cert-file, --peer-key-file, --peer-trusted-ca-file, and --peer-client-cert-auth=true ensures only authenticated cluster members can exchange data. Option A is not acceptable because disabling TLS verification (e.g., --insecure-skip-tls-verify) removes server identity validation and exposes etcd to man-in-the-middle attacks, and option C is not acceptable because exposing etcd on a public IP without authentication allows anyone to read or modify the entire cluster's state.

Answer

Disable TLS verification to simplify certificate rotation.

Answer

Expose etcd on a public internet IP address without authentication for easy monitoring.

Question 4

Which TWO of the following kubelet security configurations are critical for preventing container escape and unauthorized node API access? (Choose TWO)

Accepted Answer

Configure kubelet authorization mode to Webhook.. Option C is correct because setting the kubelet authorization mode to Webhook delegates authorization decisions to the API server's SubjectAccessReview, ensuring that only authenticated and properly authorized subjects (such as nodes and system components) can perform actions against the kubelet's API, which prevents unauthorized node API access. Option E is correct because the kubelet's read-only port (default 10255) serves unauthenticated and unencrypted data; setting readOnlyPort to 0 disables it entirely, closing an anonymous access vector that could leak node and pod information or be abused. Option A is wrong because enabling anonymous authentication on the secure port would allow unauthenticated requests, directly undermining access control rather than preventing it. Option B is wrong because running kubelet containers in privileged mode grants broad host capabilities and increases container-escape risk instead of mitigating it. Option D is wrong because authorization.mode AlwaysAllow permits all requests without any authorization checks, which is the opposite of a secure configuration.

Answer

Enable anonymous authentication on the kubelet secure port.

Answer

Run kubelet containers in privileged mode.

Answer

Set authorization.mode to AlwaysAllow.

Question 5

Which THREE of the following are key components of the Kubernetes control plane? (Choose THREE)

Accepted Answer

kube-scheduler. The Kubernetes control plane is composed of the components that make global cluster decisions and expose the cluster API. Option E, kube-apiserver, is correct because it is the front end of the control plane, serving the REST API on port 6443 and acting as the central communication hub that all other components talk to. Option A, kube-scheduler, is correct because it watches for newly created Pods with no assigned node and selects a suitable node based on resource requirements, affinity, and taints/tolerations. Option C, kube-controller-manager, is correct because it runs the core control loops (such as the node, replication, endpoints, and service account controllers) that reconcile desired state with observed state. Option B, the container runtime (e.g., containerd), is not a control plane component; it runs on every node (including workers) as part of the kubelet's container execution layer via the CRI. Option D, kube-proxy, is also not a control plane component; it runs on each node to implement Service networking rules via iptables or IPVS, making it a node-level networking component rather than part of the control plane.

Answer

container runtime (e.g., containerd)

Answer

kube-proxy

Question 6

Which TWO of the following methods can be used to authenticate users or systems against the Kubernetes API server? (Choose TWO)

Accepted Answer

X.509 client certificates validated by the API server CA.. Option A is correct because the Kubernetes API server natively supports X.509 client certificate authentication: when a client presents a certificate signed by the cluster CA (configured via --client-ca-file), the API server validates it and maps the certificate's CN to a user and O to groups. Option D is correct because the API server can be configured with OIDC flags (--oidc-issuer-url, --oidc-client-id, --oidc-username-claim) to accept ID tokens issued by an external identity provider, authenticating users via the id_token JWT. Option B is wrong because basic auth with static password files is deprecated, disabled by default, and insecure, not a recommended authentication method. Option C is wrong because kube-proxy handles service traffic routing, not authentication, and packet sniffing is not an authentication mechanism. Option E is wrong because SSH access to etcd nodes is infrastructure access, not an authentication method against the Kubernetes API server.

Answer

Unencrypted HTTP basic auth files with default passwords.

Answer

Anonymous packet sniffing via kube-proxy.

Answer

Direct root SSH access to etcd nodes.

Question 7

Which THREE of the following auditing or logging mechanisms should be configured on a secure Kubernetes control plane? (Choose THREE)

Accepted Answer

Kubernetes API server audit logging configured with an audit policy file.. Option A is correct because the Kubernetes API server audit logging, driven by an audit policy file (--audit-policy-file), records who did what, when, and where against the API server, which is essential for detecting unauthorized or anomalous control-plane actions. Option C is correct because kubelet system and container execution logs on worker nodes capture pod lifecycle events, container runtime activity, and node-level failures, providing the workload-side visibility needed to correlate with control-plane audit events. Option E is correct because etcd audit and operational logging records database transactions and peer health, which is critical since etcd stores all cluster state and secrets, and its integrity and quorum health directly determine control-plane security and availability. Option B is not appropriate because routing all cluster traffic through an unencrypted proxy log exposes sensitive data and violates the requirement for encrypted, integrity-protected control-plane communications. Option D is not appropriate because disabling all log outputs destroys the audit trail and violates compliance and forensic requirements; disk exhaustion should instead be managed with log rotation, retention policies, and monitoring.

Answer

Routing all cluster traffic through an unencrypted proxy log.

Answer

Disabling all log outputs to prevent disk space exhaustion.

Question 8

Which THREE of the following tasks are performed by the Kubernetes control plane's kube-controller-manager? (Choose THREE)

Accepted Answer

Managing node lifecycle status and detecting node failures.. The kube-controller-manager runs a set of control loops, and among them the node lifecycle controller (A) monitors node health, applies taints like node.kubernetes.io/not-ready, and detects node failures, which is exactly the node lifecycle status management described. The ReplicaSet controller (B) is a core controller inside kube-controller-manager that continuously reconciles the actual number of pod replicas with the desired count specified in a ReplicaSet, so it maintains desired pod replica counts. The ServiceAccount and token controllers (D) are also part of kube-controller-manager; they create default ServiceAccounts and generate/manage ServiceAccount tokens (and the default namespace token) for pods to authenticate to the API server. Option C is wrong because running container workloads on worker nodes is the job of the kubelet and container runtime (e.g., containerd/CRI-O), not the control plane. Option E is wrong because iptables/IPVS rules for Services are programmed by kube-proxy on each node, not by kube-controller-manager.

Answer

Running container workloads directly on worker node operating systems.

Answer

Configuring iptables and IPVS rules for Kubernetes Services on nodes.

Question 9

Which TWO of the following actions are risks associated with leaving the Kubernetes API server's insecure port enabled? (Choose TWO)

Accepted Answer

Complete bypass of all authentication mechanisms.. The insecure port (historically --insecure-port, default 8080) on the Kubernetes API server serves requests over plain HTTP with no TLS, and by design it does not perform any authentication, so option B is correct: any client that can reach that port is treated as an anonymous, unauthenticated user. Because requests arriving on the insecure port are also not subjected to authorization checks, option E is correct: the usual RBAC evaluation is skipped, effectively granting the caller full access to the API as if they were an administrator. Options A and C are wrong because TLS 1.3 enforcement and mutual TLS client certificate verification are properties of the secure port (6443), not the insecure one, which uses no encryption or client certs at all. Option D is wrong because etcd encryption at rest is configured separately via EncryptionConfiguration on the kube-apiserver and is never automatically activated by the insecure port.

Answer

Enforcement of strict TLS 1.3 encryption on all connections.

Answer

Mandatory mutual TLS client certificate verification.

Answer

Automatic activation of etcd encryption at rest.

Question 10

Which TWO of the following files or directories on a control plane node contain critical static pod manifests for core components? (Choose TWO)

Accepted Answer

/etc/kubernetes/manifests/etcd.yaml. Option A is correct because /etc/kubernetes/manifests/etcd.yaml is the static pod manifest that the kubelet on a control plane node watches and instantiates to run the etcd datastore as a static pod. Option E is correct because /etc/kubernetes/manifests/kube-apiserver.yaml is likewise a static pod manifest in the kubelet's configured staticPodPath, used to launch the kube-apiserver as a static pod. Option B is incorrect because /var/lib/kubelet/config.yaml is the kubelet's own configuration file (KubeletConfiguration), not a pod manifest. Option C is incorrect because /etc/default/kube-proxy is a service environment/defaults file for kube-proxy, not a static pod manifest. Option D is incorrect because ~/.kube/config is the client kubeconfig file used by kubectl to authenticate to the cluster, not a static pod manifest.

Answer

/var/lib/kubelet/config.yaml

Answer

/etc/default/kube-proxy

Answer

~/.kube/config

Question 11

Which TWO of the following are valid ways to harden etcd against unauthorized access and data corruption? (Choose TWO)

Accepted Answer

Require mutual TLS (mTLS) for all client and peer connections.. Option C is correct because requiring mutual TLS (mTLS) for all client and peer connections ensures that both ends of every etcd connection present valid certificates, so only authenticated clients and peers can read or write keys and participate in raft consensus, preventing unauthorized access. Option D is correct because taking regular encrypted snapshots with etcdctl snapshot save (typically combined with encryption at rest or encrypting the snapshot file) preserves a recoverable copy of the datastore, allowing restoration after data corruption or compromise. Option A is wrong because exposing etcd over unencrypted HTTP on port 2379 sends credentials and data in cleartext and is exactly the insecure default that hardening must avoid. Option B is wrong because disabling client certificate verification removes authentication entirely, allowing unrestricted access. Option E is wrong because granting public anonymous write access to the raft log lets anyone corrupt cluster state and violates the principle of least privilege.

Answer

Expose etcd directly over unencrypted HTTP on port 2379.

Answer

Disable client certificate verification to allow unrestricted access.

Answer

Grant public anonymous write access to the etcd raft log.

Question 12

Which THREE of the following criteria should be evaluated when reviewing Kubernetes RBAC policies to ensure least privilege? (Choose THREE)

Accepted Answer

Carefully audit permissions that allow impersonation or binding of roles.. Option A is correct because permissions such as impersonate and bind/escalate on users, groups, serviceaccounts, or roles let a subject assume other identities or grant themselves broader rights, directly undermining least privilege and requiring careful audit. Option B is correct because ClusterRoleBindings grant permissions across all namespaces and cluster-scoped resources, so they should be reserved for cases where a namespaced RoleBinding cannot provide the needed access. Option D is correct because wildcard (*) verbs or resources on sensitive objects like secrets, roles, and clusterroles can silently grant far more access than intended, violating least privilege. Option C is incorrect because anonymous write access to all namespaces is a severe over-permission and the opposite of least privilege. Option E is incorrect because granting cluster-admin to every service account by default is excessive privilege and a well-known anti-pattern.

Answer

Ensure anonymous users have write access to all namespaces.

Answer

Grant cluster-admin permissions to every service account by default.

Question 13

Which TWO of the following mechanisms help secure the kubelet API from unauthorized access and container inspection? (Choose TWO)

Accepted Answer

Enabling Webhook authorization mode so kubelet requests are validated against API server RBAC.. Option A is correct because setting the kubelet's authorization mode to Webhook makes the kubelet send SubjectAccessReview requests to the API server, so access decisions are evaluated against API server RBAC policies rather than being granted blindly. Option D is correct because disabling anonymous authentication (--anonymous-auth=false) forces unauthenticated requests to the kubelet's HTTPS endpoint to be rejected with 401, preventing anonymous users from querying endpoints like /pods that could expose container details. Option B is wrong because removing TLS certificates would break kubelet authentication and encryption, making the API less secure, not more. Option C is wrong because AlwaysAllow authorizes every request without any check, which is the opposite of securing the kubelet. Option E is wrong because the read-only port 10255 serves unauthenticated, unencrypted data and should be disabled, not enabled.

Answer

Removing all TLS certificates from the kubelet configuration.

Answer

Setting kubelet authorization mode to AlwaysAllow.

Answer

Enabling the kubelet read-only port 10255.

Question 14

Which THREE of the following steps are part of proper Kubernetes control plane certificate management? (Choose THREE)

Accepted Answer

Using a trusted Certificate Authority (CA) rather than self-signed certificates where possible.. Option A is correct because using a trusted Certificate Authority (CA) instead of self-signed certificates provides a verifiable chain of trust for control plane components such as kube-apiserver, kube-controller-manager, and kube-scheduler, reducing the risk of man-in-the-middle attacks. Option B is correct because Kubernetes control plane certificates have finite validity periods (commonly one year for kubeadm-managed clusters), and regular rotation before expiration—via commands like kubeadm certs renew or automated rotation—prevents cluster outages and API server unavailability. Option D is correct because private keys for control plane components must be protected with strict file permissions such as 600 (read/write only by owner) to prevent unauthorized access, which is a standard hardening practice for files like /etc/kubernetes/pki/apiserver.key. Option C is not correct because disabling TLS verification for internal cluster components removes authentication and encryption guarantees, exposing the control plane to interception and spoofing rather than being a proper certificate management step. Option E is not correct because storing private keys in unencrypted public ConfigMaps exposes them to any user or process with read access to the API, violating key confidentiality and Kubernetes security best practices.

Answer

Disabling TLS verification for all internal cluster components.

Answer

Storing all private keys in unencrypted public ConfigMaps.

Question 15

Which TWO of the following API server configuration flags help enforce cryptographic and transport security? (Choose TWO)

Accepted Answer

--tls-cipher-suites to specify permitted strong cryptographic cipher suites.. Option A, --tls-cipher-suites, is correct because it lets you restrict the API server to a defined list of strong, permitted TLS cipher suites, preventing negotiation of weak or deprecated ciphers and thereby hardening cryptographic security. Option B, --tls-min-version, is correct because it sets the minimum acceptable TLS protocol version (for example VersionTLS12), ensuring clients cannot downgrade to older, vulnerable TLS versions. Together these flags directly enforce cryptographic strength and transport-layer security on the kube-apiserver. Option C, --anonymous-auth, is wrong because enabling unauthenticated access weakens security rather than enforcing it. Option D, --insecure-port, is wrong because it permits unencrypted HTTP traffic, the opposite of transport security. Option E, --enable-http2=false, is wrong because disabling HTTP/2 does not enforce cryptographic or transport security and is not a security-hardening flag for this purpose.

Answer

--anonymous-auth to enable unauthenticated cluster access.

Answer

--insecure-port to allow unencrypted HTTP traffic.

Answer

--enable-http2=false to disable secure multiplexing.