KCSA Kubernetes Security Fundamentals Practice Test 2 — 15 Questions

Question 1

You want to write a NetworkPolicy that allows backend pods to communicate with an external database located outside the cluster at IP address '203.0.113.50'. Which NetworkPolicy section must you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

egress with an ipBlock matching '203.0.113.50/32'. To control traffic leaving the pod to external IPs or destinations outside the pod network, you must configure 'egress' rules with a 'ipBlock'.

Answer

ingress with a namespaceSelector matching the external network

Answer

ExternalName service mapped to an egress policy

Answer

policyTypes set to ["Ingress"] with externalIPs

Question 2

When configuring a MutatingWebhookConfiguration, you notice that mutating webhooks are executed before validating webhooks. Why is this execution order critical for security and consistency?

Accepted Answer

It ensures that validating webhooks evaluate the final, mutated state of the object rather than the original input.. Mutating webhooks can alter the object (e.g., injecting sidecars or default security contexts). Validating webhooks must run after mutation so they validate the final, resulting object state.

Answer

It prevents mutating webhooks from timing out while waiting for validation checks.

Answer

Mutating webhooks require encryption keys generated during the validation phase.

Answer

It allows validating webhooks to override any changes made by mutating webhooks if security violations occur.

Question 3

An administrator wants to prevent users from creating pods that mount the host network ('hostNetwork: true'). Which tool or feature is best suited to enforce this restriction natively across the cluster?

Accepted Answer

Pod Security admission controller with baseline or restricted profile. The Pod Security admission controller's 'restricted' or 'baseline' profile automatically blocks pods that set 'hostNetwork: true'.

Answer

ResourceQuota limiting network interfaces

Answer

RBAC ClusterRole restricting pod creation

Answer

NetworkPolicy with a deny-all rule

Question 4

You are troubleshooting a custom controller that fails to read ConfigMaps in the 'kube-system' namespace despite having a ClusterRole bound via a ClusterRoleBinding. What is the most likely reason for this failure?

Accepted Answer

The ClusterRole lacks the required verbs ('get', 'list', 'watch') or resources ('configmaps') for that API group.. While ClusterRoleBindings grant cluster-wide access, certain system namespaces or sensitive resources may be protected or restricted, or the ClusterRole might not include the correct API groups/resources. However, a common security hardening practice or misconfiguration involves incorrect rule definitions, or the verbs/resources mismatch. Specifically, let's look at the options: missing verbs, or standard RBAC behavior where ClusterRoleBindings apply everywhere unless restricted. Wait, let's examine option A.

Answer

ClusterRoleBindings cannot be used with ConfigMaps.

Answer

ClusterRoleBindings are automatically disabled in 'kube-system'.

Answer

ConfigMaps in 'kube-system' can only be accessed using ServiceAccounts named 'default'.

Question 5

An auditor notices that a secret is mounted as a volume in a pod. Where is this secret stored on the worker node filesystem by default?

Accepted Answer

In tmpfs (memory), ensuring it is not written to non-volatile disk storage.. Kubernetes secrets mounted as volumes are stored in tmpfs (RAM-backed memory) on the worker node, preventing them from being written to persistent disk storage.

Answer

In an encrypted SQLite database on the node's root partition.

Answer

In plaintext files inside /etc/kubernetes/secrets on the node's hard drive.

Answer

Inside the container image layer cache.

Question 6

Which of the following describes a recommended security practice when managing Kubernetes Secrets?

Accepted Answer

Limit RBAC access so that only necessary users and service accounts can read secrets.. Restricting RBAC permissions to secrets ensures that only authorized users and workloads can read sensitive data.

Answer

Use ConfigMaps for passwords and Secrets for plain text configuration.

Answer

Store secret values in plain text inside public Git repositories for easy collaboration.

Answer

Disable authentication on the Kubernetes API server to simplify secret retrieval.

Question 7

You have configured a NetworkPolicy with an egress rule targeting a specific CIDR block. However, DNS resolution for external domain names fails from within the pods selected by this policy. What is the most likely cause?

Accepted Answer

Outgoing DNS traffic on UDP/TCP port 53 to the cluster DNS server was blocked by the default-deny egress behavior.. When an egress policy is applied, all outgoing traffic (including UDP/TCP port 53 to cluster DNS servers) is blocked unless explicitly allowed by an egress rule.

Answer

NetworkPolicies automatically disable CoreDNS across the entire namespace.

Answer

DNS packets are rejected because they do not contain IP block headers.

Answer

The external domain name does not have a corresponding Service object.

Question 8

What is the primary function of the 'automountServiceAccountToken: false' setting in a Pod specification?

Accepted Answer

It prevents the ServiceAccount API token from being automatically mounted inside the pod.. Setting automountServiceAccountToken to false prevents the automatic mounting of the ServiceAccount API token into the pod's filesystem, reducing the attack surface if the pod is compromised.

Answer

It deletes the ServiceAccount object from the cluster when the pod terminates.

Answer

It prevents the pod from communicating with the Kubernetes API server entirely.

Answer

It disables RBAC authorization checks for the pod.

Question 9

An administrator wants to ensure that no container in a specific namespace runs with a root User ID (UID 0). Which security context setting should be enforced?

Accepted Answer

runAsNonRoot: true. Setting 'runAsNonRoot: true' in the security context forces the container runtime to reject containers that attempt to run as UID 0.

Answer

privileged: false

Answer

readOnlyRootFilesystem: true

Answer

allowPrivilegeEscalation: false

Question 10

You are reviewing admission webhook configurations and notice that timeoutSeconds is set to 3 seconds for a critical validation webhook. If the webhook server takes 4 seconds to respond, what does the API server do when failurePolicy is 'Ignore'?

Accepted Answer

It allows the API request to proceed as if the webhook succeeded.. When failurePolicy is 'Ignore', a timeout or error reaching the webhook results in the API server ignoring the failure and allowing the request to proceed.

Answer

It quarantines the pod in a Pending state.

Answer

It rejects the API request immediately.

Answer

It retries the webhook request indefinitely until it responds.

Question 11

What is the purpose of the Pod Security Standards 'baseline' profile?

Accepted Answer

To prevent known privilege escalations while maintaining broad compatibility for standard applications.. The baseline profile prevents known privilege escalations while allowing the default (minimally specified) pod configuration.

Answer

To disable all security controls and permit unrestricted container execution.

Answer

To automatically encrypt all container environment variables.

Answer

To enforce the highest level of security, restricting pods to hardened sandbox environments.

Question 12

Which TWO of the following are valid Kubernetes RBAC rule subjects that can be bound to roles or cluster roles?

Accepted Answer

User. Kubernetes RBAC supports three primary subjects: User, Group, and ServiceAccount.

Answer

Secret

Answer

Namespace

Answer

PersistentVolume

Question 13

Which THREE of the following are official Pod Security Standard enforcement levels recognized by Kubernetes?

Accepted Answer

baseline. The three official levels defined by Kubernetes Pod Security Standards are privileged, baseline, and restricted.

Answer

isolated

Answer

secure

Question 14

You want to ensure that a newly created Role in namespace 'finance' cannot be modified or deleted by regular developers who have edit permissions. Which RBAC feature or design prevents unauthorized privilege escalation through Role manipulation?

Accepted Answer

The API server's built-in privilege escalation prevention check, which blocks users from granting permissions they do not hold.. Kubernetes has built-in authorization checks (RBAC privilege escalation prevention) that prevent users from creating or editing roles/rolebindings with permissions they do not themselves possess.

Answer

Enabling Pod Security Standards on the finance namespace.

Answer

Setting the Role resource to immutable via 'immutable: true'.

Answer

A mandatory MutatingWebhookConfiguration that strips administrative verbs.

Question 15

An application pod needs to access the Kubernetes API server securely. How does Kubernetes authenticate the pod by default when it communicates with the API server?

Accepted Answer

Using a ServiceAccount bearer token mounted inside the pod's filesystem.. Kubernetes automatically mounts a ServiceAccount token into the pod's filesystem, which the pod sends as a Bearer token to authenticate with the API server.

Answer

Using static username and password credentials stored in environment variables.

Answer

Using mutual TLS (mTLS) client certificates generated by the kubelet on startup.

Answer

Using SSH keys stored in the pod's root directory.