KCSA Kubernetes Security Fundamentals — 25 Questions

Question 1

Which admission controller plugin is responsible for intercepting requests to modify objects and checking whether the user has sufficient RBAC permissions?

Accepted Answer

RBAC. The RBAC admission controller enforces authorization decisions based on Role and ClusterRole bindings.

Answer

NamespaceLifecycle

Answer

DefaultStorageClass

Answer

LimitRanger

Question 2

An engineer has written a NetworkPolicy that selects pods with the label app=backend. The policy specifies an ingress rule allowing traffic from pods labeled app=frontend in the same namespace, but does not specify any egress rules. What is the network behavior for outgoing traffic from the backend pods?

Accepted Answer

All outgoing traffic from backend pods is blocked because egress is restricted by default when any NetworkPolicy selects the pod.. Kubernetes NetworkPolicies are additive and stateful. If a NetworkPolicy selects a pod and includes an ingress section, ingress traffic is restricted. However, because no egress section is defined, egress traffic from the selected pods is completely blocked.

Answer

All outgoing traffic from backend pods is allowed because egress rules were not defined.

Answer

Outgoing traffic is allowed only to frontend pods.

Answer

Only DNS egress traffic on port 53 is permitted automatically.

Question 3

Under the Pod Security Standards, a developer attempts to deploy a pod with 'privileged: true' in a namespace labeled with 'pod-security.kubernetes.io/enforce=baseline'. What will happen?

Accepted Answer

The admission controller will reject the pod creation request with an error.. The 'baseline' profile prohibits privileged containers. The admission controller will reject the pod creation request.

Answer

The pod will run in a restricted sandbox environment automatically.

Answer

The pod will be created successfully, but a warning will be logged in the audit log.

Answer

The kubelet will automatically strip the 'privileged: true' setting and run the pod safely.

Question 4

You need to restrict network traffic so that only pods with the label 'tier=frontend' can communicate with pods labeled 'tier=backend' in the same namespace. Which Kubernetes resource should you create?

Accepted Answer

NetworkPolicy. A NetworkPolicy is used to restrict pod-to-pod and network traffic at the IP/port/label level.

Answer

Ingress

Answer

FirewallRule

Answer

Service

Question 5

You are auditing a Kubernetes cluster and notice that a specific ServiceAccount has been granted the 'impersonate' verb on users. What security risk does this permission introduce?

Accepted Answer

It allows the ServiceAccount to act as any user or service account, leading to privilege escalation.. The 'impersonate' verb allows the holder to act as other users or service accounts, effectively escalating their privileges to match any identity they can impersonate.

Answer

It automatically generates valid X.509 client certificates for cluster nodes.

Answer

It allows the pod to intercept network traffic of other pods on the same node.

Answer

It permits the ServiceAccount to bypass the Kubernetes API server and write directly to etcd.

Question 6

An application pod requires read access to secrets in the 'production' namespace. You need to bind a pre-existing ClusterRole named 'secret-reader' to a service account named 'app-sa' in that namespace. Which RBAC resource accomplishes this?

Accepted Answer

RoleBinding referencing the ClusterRole 'secret-reader'. A RoleBinding can reference a ClusterRole to grant permissions defined in that ClusterRole to subjects within the specific namespace of the RoleBinding.

Answer

ClusterRoleBinding referencing the Role 'secret-reader'

Answer

NamespaceRoleBinding referencing the ClusterRole

Answer

ServiceAccountBinding referencing the ClusterRole

Question 7

You have deployed a NetworkPolicy in a namespace that selects backend pods, defining an 'ingress' rule with a 'from' block. No other NetworkPolicies exist in the namespace. What is the default behavior for traffic from pods not matched by the 'from' selector?

Accepted Answer

All ingress traffic from unmatched pods is denied.. When a NetworkPolicy selects a pod and defines an ingress section, all ingress traffic not explicitly allowed by the policy is denied by default.

Answer

All ingress traffic remains allowed by default.

Answer

The policy fails to apply because an egress rule must also be defined.

Answer

Only traffic from other namespaces is denied; same-namespace traffic is still allowed.

Question 8

A security engineer wants to apply Pod Security Standards globally across an entire namespace using the modern built-in admission mechanism. Which approach should be used?

Accepted Answer

Apply labels such as 'pod-security.kubernetes.io/enforce=restricted' to the namespace metadata.. The Pod Security admission controller uses namespace labels (such as 'pod-security.kubernetes.io/enforce') to apply enforcement levels like privileged, baseline, or restricted.

Answer

Create a MutatingWebhookConfiguration that injects security contexts into every pod spec.

Answer

Modify the kubelet configuration file on every worker node to enable restricted mode.

Answer

Deploy a custom PodSecurityPolicy object targeting the namespace selector.

Question 9

Your cluster uses the Pod Security admission controller with the 'restricted' profile enforced. A legacy application pod fails to start because it requires running as root (runAsNonRoot: false). How should you handle this securely without disabling the standard?

Accepted Answer

Configure the Pod Security admission configuration file on the control plane to exempt the specific ServiceAccount or namespace from the restricted check.. To accommodate specific pods that need exceptions while maintaining an overall enforce profile, you can use the 'audit' or 'warn' modes for specific versions or adjust the namespace labels, or use an exception mechanism if supported, but best practice is fixing the application or using a targeted bypass/exception if allowed, or applying an explicit exception configuration in the Pod Security admission configuration file.

Answer

Disable the Pod Security admission controller entirely across the cluster.

Answer

Set the namespace enforce level to 'privileged' permanently.

Answer

Mount the host socket inside the pod to bypass user namespace restrictions.

Question 10

A cluster administrator needs to grant read-only access to pods within the 'development' namespace using Kubernetes RBAC. Which resource kind should be used to define the permissions?

Accepted Answer

Role. A Role defines permissions within a specific namespace, whereas a ClusterRole defines cluster-scoped permissions. Since the requirement is restricted to the 'development' namespace, a Role is the correct resource.

Answer

SecurityContextConstraints

Answer

PodSecurityPolicy

Answer

ClusterRole

Question 11

Which RBAC verb allows a user to delete an existing resource in a Kubernetes namespace?

Accepted Answer

delete. The 'delete' verb specifically authorizes removing resources.

Answer

remove

Answer

purge

Answer

destroy

Question 12

An administrator needs to store sensitive database credentials securely so that they can be mounted as environment variables inside a specific pod. Which Kubernetes object is designed for this purpose?

Accepted Answer

Secret. Secret objects store sensitive data such as passwords, tokens, and keys.

Answer

ResourceQuota

Answer

PersistentVolume

Answer

ConfigMap

Question 13

By default, how are Kubernetes Secrets stored in etcd when created without additional encryption-at-rest configurations?

Accepted Answer

Encoded in Base64 plaintext. By default, Kubernetes Secrets are stored encoded in Base64 plaintext within etcd, meaning anyone with etcd access can decode them.

Answer

Hashed using SHA-256 with a random salt

Answer

Encrypted using the node's TPM chip

Answer

Encrypted using AES-256 automatically

Question 14

You are deploying a ValidatingWebhookConfiguration to inspect incoming pod creations. What happens if the webhook fails and the 'failurePolicy' in the webhook configuration is set to 'Fail'?

Accepted Answer

The API request is rejected.. When failurePolicy is set to 'Fail', any error or timeout reaching the external webhook causes the API server to reject the API request.

Answer

The API request is allowed to proceed without validation.

Answer

The pod is created in a suspended state until the webhook recovers.

Answer

The kube-apiserver restarts automatically.

Question 15

You want to enable encryption at rest for Kubernetes Secrets in your cluster using an external KMS (Key Management Service) provider. Which component on the control plane reads the EncryptionConfiguration file and handles this encryption?

Accepted Answer

kube-apiserver. The kube-apiserver is responsible for interacting with etcd and applies the EncryptionConfiguration to encrypt secrets before writing them to etcd and decrypting them when read.

Answer

kube-controller-manager

Answer

kubelet

Answer

etcd daemon directly

Question 16

You want to write a NetworkPolicy that allows backend pods to communicate with an external database located outside the cluster at IP address '203.0.113.50'. Which NetworkPolicy section must you configure?

Accepted Answer

egress with an ipBlock matching '203.0.113.50/32'. To control traffic leaving the pod to external IPs or destinations outside the pod network, you must configure 'egress' rules with a 'ipBlock'.

Answer

ingress with a namespaceSelector matching the external network

Answer

ExternalName service mapped to an egress policy

Answer

policyTypes set to ["Ingress"] with externalIPs

Question 17

When configuring a MutatingWebhookConfiguration, you notice that mutating webhooks are executed before validating webhooks. Why is this execution order critical for security and consistency?

Accepted Answer

It ensures that validating webhooks evaluate the final, mutated state of the object rather than the original input.. Mutating webhooks can alter the object (e.g., injecting sidecars or default security contexts). Validating webhooks must run after mutation so they validate the final, resulting object state.

Answer

It prevents mutating webhooks from timing out while waiting for validation checks.

Answer

Mutating webhooks require encryption keys generated during the validation phase.

Answer

It allows validating webhooks to override any changes made by mutating webhooks if security violations occur.

Question 18

An administrator wants to prevent users from creating pods that mount the host network ('hostNetwork: true'). Which tool or feature is best suited to enforce this restriction natively across the cluster?

Accepted Answer

Pod Security admission controller with baseline or restricted profile. The Pod Security admission controller's 'restricted' or 'baseline' profile automatically blocks pods that set 'hostNetwork: true'.

Answer

ResourceQuota limiting network interfaces

Answer

RBAC ClusterRole restricting pod creation

Answer

NetworkPolicy with a deny-all rule

Question 19

You are troubleshooting a custom controller that fails to read ConfigMaps in the 'kube-system' namespace despite having a ClusterRole bound via a ClusterRoleBinding. What is the most likely reason for this failure?

Accepted Answer

The ClusterRole lacks the required verbs ('get', 'list', 'watch') or resources ('configmaps') for that API group.. While ClusterRoleBindings grant cluster-wide access, certain system namespaces or sensitive resources may be protected or restricted, or the ClusterRole might not include the correct API groups/resources. However, a common security hardening practice or misconfiguration involves incorrect rule definitions, or the verbs/resources mismatch. Specifically, let's look at the options: missing verbs, or standard RBAC behavior where ClusterRoleBindings apply everywhere unless restricted. Wait, let's examine option A.

Answer

ClusterRoleBindings cannot be used with ConfigMaps.

Answer

ClusterRoleBindings are automatically disabled in 'kube-system'.

Answer

ConfigMaps in 'kube-system' can only be accessed using ServiceAccounts named 'default'.

Question 20

An auditor notices that a secret is mounted as a volume in a pod. Where is this secret stored on the worker node filesystem by default?

Accepted Answer

In tmpfs (memory), ensuring it is not written to non-volatile disk storage.. Kubernetes secrets mounted as volumes are stored in tmpfs (RAM-backed memory) on the worker node, preventing them from being written to persistent disk storage.

Answer

In an encrypted SQLite database on the node's root partition.

Answer

In plaintext files inside /etc/kubernetes/secrets on the node's hard drive.

Answer

Inside the container image layer cache.