KCSA Kubernetes Security Fundamentals Practice Test 3 — 15 Questions

Question 1

Which TWO components are involved in configuring and processing admission webhooks in a Kubernetes cluster?

Accepted Answer

kube-apiserver. Admission webhooks are configured via MutatingWebhookConfiguration or ValidatingWebhookConfiguration objects, and processed by the kube-apiserver.

Answer

kube-proxy

Answer

kubelet

Answer

etcd daemon

Question 2

Which TWO types of selectors can be used within a Kubernetes NetworkPolicy ingress rule to specify allowed traffic sources?

Accepted Answer

namespaceSelector. Ingress 'from' blocks support podSelector and namespaceSelector to match traffic sources.

Answer

serviceSelector

Answer

ingressSelector

Answer

nodeSelector

Question 3

Which THREE methods can be used to inject Kubernetes Secrets into a running pod?

Accepted Answer

Injected as environment variables. Secrets can be injected into pods via environment variables, environment variables from secret keys, or mounted as files in volumes.

Answer

Compiled directly into the container image binary

Answer

Injected through kernel sysctl parameters

Question 4

Which TWO actions can be performed using Kubernetes RBAC rules?

Accepted Answer

Granting permission to create deployments cluster-wide. RBAC rules define API groups, resources, and verbs to control permissions.

Answer

Encrypting secret values stored in etcd

Answer

Allocating storage capacity for PersistentVolumes

Answer

Enforcing Pod Security Standards on namespaces

Question 5

Which THREE fields are required when defining an egress rule in a Kubernetes NetworkPolicy?

Accepted Answer

egress list block. Egress rules contain ports, to/ipBlock/etc., but the policy itself must include 'policyTypes' containing 'Egress', and the rules themselves specify destinations ('to') and optional ports.

Answer

storageClassName for volume attachment

Answer

nodeSelector for worker placement

Question 6

Which TWO tools or built-in Kubernetes features are used to secure container privileges and behaviors?

Accepted Answer

Pod Security Standards. Pod Security Standards and security contexts are core mechanisms for securing container privileges.

Answer

PersistentVolumeClaim

Answer

HorizontalPodAutoscaler

Answer

IngressController

Question 7

Which TWO mechanisms help secure Kubernetes Secrets against unauthorized access or exposure?

Accepted Answer

Enabling encryption at rest using KMS or AES-CBC providers. Encryption at rest in etcd and strict RBAC least privilege are key mechanisms for protecting secrets.

Answer

Granting cluster-admin to all application service accounts

Answer

Storing secrets in plaintext ConfigMaps for easier auditing

Answer

Disabling the Kubernetes audit log

Question 8

Which THREE conditions must be met for a RoleBinding to successfully grant permissions to a ServiceAccount?

Accepted Answer

The RoleBinding and Role must reside in the same namespace (if using a Role).. A RoleBinding requires a valid Role/ClusterRole reference, valid subjects (ServiceAccount), and must exist in the correct namespace (for RoleBindings).

Answer

The kubelet must restart to load the binding.

Answer

The ServiceAccount must have cluster-admin privileges.

Question 9

Which THREE features are enforced or verified by the Kubernetes 'restricted' Pod Security Standard profile?

Accepted Answer

Requires dropping all capabilities except NET_BIND_SERVICE. The restricted profile enforces running as non-root, dropping all capabilities (or keeping only NET_BIND_SERVICE), and prohibiting privilege escalation.

Answer

Allows containers to run in privileged mode if requested

Answer

Permits mounting the host network namespace without restriction

Question 10

Which TWO statements are true regarding Kubernetes NetworkPolicy default behaviors?

Accepted Answer

By default, all pods in a cluster are non-isolated and accept traffic from any source.. By default, pods are non-isolated (all traffic allowed). When a NetworkPolicy selects pods and specifies ingress/egress, those specific directions become deny-by-default.

Answer

NetworkPolicies automatically block all traffic across all namespaces upon cluster installation.

Answer

Egress traffic is blocked by default even if no NetworkPolicy is created.

Answer

NetworkPolicies apply to cluster nodes rather than individual pods.

Question 11

An administrator needs to grant read-only access to Pods specifically within the 'development' namespace to a new user. Which RBAC configuration correctly scopes this permission?

Accepted Answer

Create a Role for Pod read access in the 'development' namespace and bind it to the user using a RoleBinding in the same namespace.. A Role must be used instead of a ClusterRole when scoping permissions to a single namespace. The Role must be bound via a RoleBinding within that same namespace.

Answer

Create a ClusterRole for Pod read access and bind it to the user using a RoleBinding in the 'development' namespace.

Answer

Annotate the user's ServiceAccount with namespace read permissions.

Answer

Create a Role for Pod read access and bind it globally using a ClusterRoleBinding.

Question 12

A security auditor notices that a deployment running in the 'production' namespace is violating the Restricted Pod Security Standard because containers are running as root. How can you enforce compliance using Pod Security Admission?

Accepted Answer

Label the 'production' namespace with 'pod-security.kubernetes.io/enforce=restricted'.. Applying the 'pod-security.kubernetes.io/enforce: restricted' label to the namespace enforces the restricted Pod Security Standard for all newly created pods.

Answer

Create a NetworkPolicy that blocks root user communication.

Answer

Enable the SecurityContextDeny legacy admission controller.

Answer

Update the kube-apiserver flags to globally block non-restricted pods without namespace labels.

Question 13

An application pod requires access to the Kubernetes API to list other pods. To follow secure practices, you create a dedicated ServiceAccount and bind a custom Role to it. How should you configure the Pod specification to prevent the default service account token from being automatically mounted?

Accepted Answer

Set 'automountServiceAccountToken: false' in the Pod specification.. Setting 'automountServiceAccountToken: false' on either the ServiceAccount or the Pod specification prevents the automatic mounting of the token, reducing the blast radius if compromised.

Answer

Delete the 'default' ServiceAccount in the namespace.

Answer

Configure the Pod securityContext with 'readOnlyRootFilesystem: true'.

Answer

Add a deny NetworkPolicy blocking egress to the Kubernetes API service IP.

Question 14

An external identity provider (OIDC) is integrated with your Kubernetes cluster. You want to restrict a group named 'contractors' so they can only view pods in the 'staging' namespace. Which configuration correctly maps this requirement?

Accepted Answer

A ClusterRole granting pod read access bound via a RoleBinding in the 'staging' namespace to the subject kind 'Group' with name 'contractors'.. A ClusterRole providing read access to pods, combined with a RoleBinding in the 'staging' namespace referencing the OIDC group 'contractors'.

Answer

A Namespace-scoped ServiceAccount configured with an OIDC JWT issuer URL.

Answer

A Role in the 'staging' namespace bound via a ClusterRoleBinding to the 'contractors' group.

Answer

An OIDC webhook configuration in the kube-apiserver specifying namespace boundaries.

Question 15

Your team is storing sensitive database credentials in Kubernetes Secrets. A security review reveals that base64 encoding does not provide encryption at rest. What mechanism should you enable to ensure Secrets are encrypted when stored in etcd?

Accepted Answer

Configure an EncryptionConfiguration file and reference it via the '--encryption-provider-config' flag on the kube-apiserver.. Enabling EncryptionConfiguration with providers like aescbc or kms ensures that API server encrypts secret data before writing it to etcd.

Answer

Apply a MutatingWebhookConfiguration to automatically hash passwords using bcrypt.

Answer

Enable TLS encryption for all intra-cluster communication using kubeadm configuration.

Answer

Set the secret type to 'kubernetes.io/encrypted-secret'.