KCSA Kubernetes Security Fundamentals — Timed 15 Questions

Question 1

Which admission controller plugin is responsible for intercepting requests to modify objects and checking whether the user has sufficient RBAC permissions?

Accepted Answer

RBAC. The RBAC admission controller enforces authorization decisions based on Role and ClusterRole bindings.

Answer

NamespaceLifecycle

Answer

DefaultStorageClass

Answer

LimitRanger

Question 2

An engineer has written a NetworkPolicy that selects pods with the label app=backend. The policy specifies an ingress rule allowing traffic from pods labeled app=frontend in the same namespace, but does not specify any egress rules. What is the network behavior for outgoing traffic from the backend pods?

Accepted Answer

All outgoing traffic from backend pods is blocked because egress is restricted by default when any NetworkPolicy selects the pod.. Kubernetes NetworkPolicies are additive and stateful. If a NetworkPolicy selects a pod and includes an ingress section, ingress traffic is restricted. However, because no egress section is defined, egress traffic from the selected pods is completely blocked.

Answer

All outgoing traffic from backend pods is allowed because egress rules were not defined.

Answer

Outgoing traffic is allowed only to frontend pods.

Answer

Only DNS egress traffic on port 53 is permitted automatically.

Question 3

Under the Pod Security Standards, a developer attempts to deploy a pod with 'privileged: true' in a namespace labeled with 'pod-security.kubernetes.io/enforce=baseline'. What will happen?

Accepted Answer

The admission controller will reject the pod creation request with an error.. The 'baseline' profile prohibits privileged containers. The admission controller will reject the pod creation request.

Answer

The pod will run in a restricted sandbox environment automatically.

Answer

The pod will be created successfully, but a warning will be logged in the audit log.

Answer

The kubelet will automatically strip the 'privileged: true' setting and run the pod safely.

Question 4

You need to restrict network traffic so that only pods with the label 'tier=frontend' can communicate with pods labeled 'tier=backend' in the same namespace. Which Kubernetes resource should you create?

Accepted Answer

NetworkPolicy. A NetworkPolicy is used to restrict pod-to-pod and network traffic at the IP/port/label level.

Answer

Ingress

Answer

FirewallRule

Answer

Service

Question 5

You are auditing a Kubernetes cluster and notice that a specific ServiceAccount has been granted the 'impersonate' verb on users. What security risk does this permission introduce?

Accepted Answer

It allows the ServiceAccount to act as any user or service account, leading to privilege escalation.. The 'impersonate' verb allows the holder to act as other users or service accounts, effectively escalating their privileges to match any identity they can impersonate.

Answer

It automatically generates valid X.509 client certificates for cluster nodes.

Answer

It allows the pod to intercept network traffic of other pods on the same node.

Answer

It permits the ServiceAccount to bypass the Kubernetes API server and write directly to etcd.

Question 6

An application pod requires read access to secrets in the 'production' namespace. You need to bind a pre-existing ClusterRole named 'secret-reader' to a service account named 'app-sa' in that namespace. Which RBAC resource accomplishes this?

Accepted Answer

RoleBinding referencing the ClusterRole 'secret-reader'. A RoleBinding can reference a ClusterRole to grant permissions defined in that ClusterRole to subjects within the specific namespace of the RoleBinding.

Answer

ClusterRoleBinding referencing the Role 'secret-reader'

Answer

NamespaceRoleBinding referencing the ClusterRole

Answer

ServiceAccountBinding referencing the ClusterRole

Question 7

You have deployed a NetworkPolicy in a namespace that selects backend pods, defining an 'ingress' rule with a 'from' block. No other NetworkPolicies exist in the namespace. What is the default behavior for traffic from pods not matched by the 'from' selector?

Accepted Answer

All ingress traffic from unmatched pods is denied.. When a NetworkPolicy selects a pod and defines an ingress section, all ingress traffic not explicitly allowed by the policy is denied by default.

Answer

All ingress traffic remains allowed by default.

Answer

The policy fails to apply because an egress rule must also be defined.

Answer

Only traffic from other namespaces is denied; same-namespace traffic is still allowed.

Question 8

A security engineer wants to apply Pod Security Standards globally across an entire namespace using the modern built-in admission mechanism. Which approach should be used?

Accepted Answer

Apply labels such as 'pod-security.kubernetes.io/enforce=restricted' to the namespace metadata.. The Pod Security admission controller uses namespace labels (such as 'pod-security.kubernetes.io/enforce') to apply enforcement levels like privileged, baseline, or restricted.

Answer

Create a MutatingWebhookConfiguration that injects security contexts into every pod spec.

Answer

Modify the kubelet configuration file on every worker node to enable restricted mode.

Answer

Deploy a custom PodSecurityPolicy object targeting the namespace selector.

Question 9

Your cluster uses the Pod Security admission controller with the 'restricted' profile enforced. A legacy application pod fails to start because it requires running as root (runAsNonRoot: false). How should you handle this securely without disabling the standard?

Accepted Answer

Configure the Pod Security admission configuration file on the control plane to exempt the specific ServiceAccount or namespace from the restricted check.. To accommodate specific pods that need exceptions while maintaining an overall enforce profile, you can use the 'audit' or 'warn' modes for specific versions or adjust the namespace labels, or use an exception mechanism if supported, but best practice is fixing the application or using a targeted bypass/exception if allowed, or applying an explicit exception configuration in the Pod Security admission configuration file.

Answer

Disable the Pod Security admission controller entirely across the cluster.

Answer

Set the namespace enforce level to 'privileged' permanently.

Answer

Mount the host socket inside the pod to bypass user namespace restrictions.

Question 10

A cluster administrator needs to grant read-only access to pods within the 'development' namespace using Kubernetes RBAC. Which resource kind should be used to define the permissions?

Accepted Answer

Role. A Role defines permissions within a specific namespace, whereas a ClusterRole defines cluster-scoped permissions. Since the requirement is restricted to the 'development' namespace, a Role is the correct resource.

Answer

SecurityContextConstraints

Answer

PodSecurityPolicy

Answer

ClusterRole

Question 11

Which RBAC verb allows a user to delete an existing resource in a Kubernetes namespace?

Accepted Answer

delete. The 'delete' verb specifically authorizes removing resources.

Answer

remove

Answer

purge

Answer

destroy

Question 12

An administrator needs to store sensitive database credentials securely so that they can be mounted as environment variables inside a specific pod. Which Kubernetes object is designed for this purpose?

Accepted Answer

Secret. Secret objects store sensitive data such as passwords, tokens, and keys.

Answer

ResourceQuota

Answer

PersistentVolume

Answer

ConfigMap

Question 13

By default, how are Kubernetes Secrets stored in etcd when created without additional encryption-at-rest configurations?

Accepted Answer

Encoded in Base64 plaintext. By default, Kubernetes Secrets are stored encoded in Base64 plaintext within etcd, meaning anyone with etcd access can decode them.

Answer

Hashed using SHA-256 with a random salt

Answer

Encrypted using the node's TPM chip

Answer

Encrypted using AES-256 automatically

Question 14

You are deploying a ValidatingWebhookConfiguration to inspect incoming pod creations. What happens if the webhook fails and the 'failurePolicy' in the webhook configuration is set to 'Fail'?

Accepted Answer

The API request is rejected.. When failurePolicy is set to 'Fail', any error or timeout reaching the external webhook causes the API server to reject the API request.

Answer

The API request is allowed to proceed without validation.

Answer

The pod is created in a suspended state until the webhook recovers.

Answer

The kube-apiserver restarts automatically.

Question 15

You want to enable encryption at rest for Kubernetes Secrets in your cluster using an external KMS (Key Management Service) provider. Which component on the control plane reads the EncryptionConfiguration file and handles this encryption?

Accepted Answer

kube-apiserver. The kube-apiserver is responsible for interacting with etcd and applies the EncryptionConfiguration to encrypt secrets before writing them to etcd and decrypting them when read.

Answer

kube-controller-manager

Answer

kubelet

Answer

etcd daemon directly