KCSA Kubernetes Security Fundamentals Practice Test 4 — 15 Questions

Question 1

You are troubleshooting a pod that fails to start because it attempts to run a container with privileges. The cluster enforces the 'baseline' Pod Security Standard. Which container configuration will cause the Pod Security Admission controller to reject the pod?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Setting 'securityContext.privileged: true' on the container.. The baseline standard disallows privileged containers. Setting 'securityContext.privileged: true' violates the baseline standard and will be rejected.

Answer

Mounting an emptyDir volume into the container.

Answer

Omitting the 'runAsUser' field, allowing the container to run as UID 0 by default.

Answer

Adding the 'NET_BIND_SERVICE' capability to the container.

Question 2

You need to isolate a database pod so that only pods with the label 'tier=frontend' within the same namespace can connect to it on port 5432. Which NetworkPolicy resource configuration achieves this?

Accepted Answer

A NetworkPolicy with an ingress rule specifying podSelector for 'tier=frontend' and port 5432.. A NetworkPolicy targeting the database pods with 'podSelector' and defining an 'ingress' rule allowing traffic from pods matching 'tier=frontend' on port 5432.

Answer

A PodSecurityPolicy enforcing frontend network access.

Answer

A ServiceMesh AuthorizationPolicy restricting namespace-level routes.

Answer

A NetworkPolicy with an egress rule allowing frontend pods to reach the database.

Question 3

You need to ensure that a Secret containing database credentials cannot be read by anyone except the database application controller, even if they have broad RBAC read permissions in the namespace. Which feature should you consider?

Accepted Answer

Store the credentials in an external secrets manager and use an Operator to inject them directly into pod environment variables, avoiding the creation of Kubernetes Secret objects entirely.. Standard Kubernetes RBAC is resource-based and does not support cell-level or secret-value level restrictions natively within a namespace once read access to secrets is granted. However, migrating to an external secrets manager or using advanced admission control can restrict access. Within native Kubernetes, RBAC allows reading secrets if 'get' or 'list' is granted on 'secrets'. To strictly isolate secrets, external secret operators injecting secrets via environment variables or volume mounts without granting direct secret API access is standard practice.

Answer

Enable the ValidatingAdmissionPolicy to inspect the user's decryption key.

Answer

Set the secret data encoding to AES-256 within the manifest metadata.

Answer

Apply a Role restricting Secret viewing by adding a label selector to the RoleBinding.

Question 4

An enterprise cluster requires that all incoming NetworkPolicies must default to denying all traffic unless explicitly allowed. A developer creates a namespace but forgets to apply any policies. What is the default behavior of Kubernetes regarding inter-pod traffic within a namespace when no NetworkPolicies are present?

Accepted Answer

All traffic between pods is allowed by default.. By default, Kubernetes namespaces are non-isolated (allow-all). All pods can communicate with all other pods unless a NetworkPolicy explicitly restricts traffic.

Answer

Only traffic originating from the kube-system namespace is allowed.

Answer

Traffic is allowed only if the pods share the same node.

Answer

All traffic between pods is denied by default.

Question 5

An administrator wishes to inspect which admission controllers are currently enabled in a running Kubernetes cluster. Where is this typically configured in a stacked control plane?

Accepted Answer

In the kube-apiserver static pod manifest file under '/etc/kubernetes/manifests/kube-apiserver.yaml'.. Admission controllers are configured via the '--enable-admission-plugins' flag on the kube-apiserver static pod manifest.

Answer

In the CoreDNS deployment spec.

Answer

In the kubelet configuration file on each worker node.

Answer

In the cluster-wide ConfigMap named 'kube-system/cluster-admission'.

Question 6

A security engineer configures a ValidatingWebhookConfiguration to intercept pod creations. The webhook service goes down due to a network partition. What happens to incoming pod creation requests by default if the webhook 'failurePolicy' is set to 'Fail'?

Accepted Answer

The API server rejects the pod creation request with an error.. When failurePolicy is set to 'Fail', if the webhook encounters an error or is unreachable, the API server rejects the request.

Answer

The kubelet automatically bypasses the webhook and starts the container locally.

Answer

The API server allows the pod creation request and logs a warning.

Answer

The API server queues the request until the webhook service recovers.

Question 7

A CI/CD pipeline service account needs permission to create Deployments and Services across multiple namespaces, but should not have cluster-admin privileges. What is the most secure way to grant these permissions?

Accepted Answer

Define a ClusterRole with the required verbs and resources, then create a RoleBinding for that ClusterRole in each target namespace.. Create a ClusterRole with the necessary rules for Deployments and Services, and bind it to the service account in each target namespace using RoleBindings.

Answer

Place the service account in the kube-system namespace.

Answer

Grant the service account permissions at the node level using kubeconfig overrides.

Answer

Create a ClusterRoleBinding linking the default cluster-admin ClusterRole to the service account.

Question 8

An application pod needs to mount a Secret as environment variables. Which section of the Pod manifest should be configured to achieve this securely?

Accepted Answer

Using 'env' with 'valueFrom.secretKeyRef' or 'envFrom' with 'secretRef' in the container specification.. Environment variables can be populated from Secrets using 'envFrom' or 'env' with 'valueFrom.secretKeyRef'.

Answer

Using 'volumeMounts' pointing to a PersistentVolumeClaim bound to the Secret.

Answer

Adding the Secret name directly to the container imagePullSecrets field.

Answer

Declaring the Secret in the container securityContext block.

Question 9

An administrator wishes to create a NetworkPolicy that allows incoming traffic from any pod in any namespace, provided those pods have the label 'environment=production'. How should the NetworkPolicy 'ingress' rule be structured?

Accepted Answer

Specify an ingress 'from' entry containing a 'namespaceSelector' matching the desired namespaces and a 'podSelector' matching 'environment=production'.. To select pods across namespaces, the 'from' array must use 'namespaceSelector' combined with 'podSelector'.

Answer

Add the production label to the target pod's metadata and reference it in the egress block.

Answer

Specify only a 'podSelector' with 'environment=production' without any namespace selector.

Answer

Use a cluster-wide ClusterNetworkPolicy resource with global label matching.

Question 10

You need to grant a monitoring tool permission to perform HTTP GET requests against health endpoints across all pods in the cluster, but no other API access. How should you define the RBAC rules?

Accepted Answer

Create a ClusterRole with verbs ['get'] and nonResourceURLs ['/healthz', '/readyz'].. Non-resource URLs like '/healthz' or pod subresources like '/pods/{name}/proxy' are specified using 'nonResourceURLs' or subresource permissions in rules.

Answer

Assign the tool to the system:masters group.

Answer

Grant cluster-admin access and restrict requests using a kube-proxy firewall rule.

Answer

Create a ClusterRole with API groups [''] and resources ['pods/status'].

Question 11

You are auditing a cluster and find a pod that mounts the host's root filesystem directly into the container. Which Pod Security Standard rule does this violate?

Accepted Answer

It violates both baseline and restricted standards by using a hostPath volume.. Mounting host paths (hostPath volumes) is prohibited by both the baseline and restricted Pod Security Standards because it allows container escape.

Answer

It is permitted under all standards provided the container runs as a non-root user.

Answer

It is fully compliant with the restricted standard as long as 'readOnly: true' is set.

Answer

It only violates the restricted standard; baseline permits hostPath mounts.

Question 12

A developer accidentally committed plain-text database passwords into a public Git repository. The password was stored in a Kubernetes Secret manifest. What immediate remediation step should be taken regarding the Secret?

Accepted Answer

Rotate the credential in the underlying database, then update the Kubernetes Secret with the new value.. Rotate the compromised password in the database immediately, then update the Kubernetes Secret with the new password.

Answer

Apply a DenyAll NetworkPolicy to the namespace.

Answer

Delete the Secret object and restart all cluster nodes.

Answer

Change the Secret manifest encoding from base64 to hex format.

Question 13

Which TWO of the following actions are considered best practices for securing Kubernetes Secrets? (Choose TWO)

Accepted Answer

Enable encryption at rest for Secret resources in etcd.. Enabling encryption at rest in etcd and restricting RBAC access to Secrets are core practices. Base64 encoding is not security, and putting secrets in ConfigMaps is insecure.

Answer

Store database passwords in plaintext ConfigMaps for easier application ingestion.

Answer

Rely on base64 encoding as the primary encryption mechanism for sensitive data.

Answer

Mount Secrets as writable volumes so applications can update their own credentials.

Question 14

Which TWO components are core parts of the Kubernetes authorization architecture? (Choose TWO)

Accepted Answer

Webhook Authorization. RBAC and Webhook are authorization modes evaluated by the API server after authentication.

Answer

CoreDNS service discovery

Answer

Kubelet node daemon

Answer

etcd key-value datastore

Question 15

Which TWO entities can be assigned RBAC permissions in a Kubernetes cluster? (Choose TWO)

Accepted Answer

ServiceAccount. RBAC bindings can be assigned to Users, Groups, and ServiceAccounts.

Answer

ConfigMap

Answer

Namespace

Answer

PersistentVolume