KCSA Kubernetes Threat Model — 30 Questions

Question 1

An attacker with read access to a Kubernetes cluster's etcd database wants to compromise node-level runtimes. What high-value secret stored within etcd presents the most immediate risk of allowing cluster-wide node takeover if extracted?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ServiceAccount tokens with high-privilege clusterrole bindings. Bootstrap tokens or service account tokens with cluster-admin bindings allow creating daemonsets or executing remote commands via the API server, but extracted kubelet client certificates or service account secrets can directly grant API privileges.

Answer

Internal DNS records for CoreDNS

Answer

HorizontalPodAutoscaler metric configurations

Answer

PersistentVolume claim capacity metadata

Question 2

An administrator wishes to adhere to the principle of least privilege regarding pod service accounts. How should a Pod that does not need to interact with the Kubernetes API server be configured?

Accepted Answer

Configure the Pod security context with privileged: true. Setting automountServiceAccountToken: false on the ServiceAccount or directly within the Pod spec prevents the token from being mounted into the container filesystem.

Answer

Deploy the Pod in the kube-system namespace

Answer

Attach a ClusterRoleBinding granting anonymous system:unauthenticated rights

Question 3

When analyzing the container supply chain threat surface, which TWO practices help mitigate the introduction of vulnerable or malicious artifacts?

Accepted Answer

Enforcing cryptographic image signing and verification via admission controllers. Scanning container images for CVEs in the CI/CD pipeline and signing images cryptographically with tools like Cosign are core supply chain mitigations.

Answer

Granting all service accounts cluster-admin permissions to simplify deployments

Answer

Disabling audit logging to reduce etcd disk I/O latency

Question 4

An auditor is evaluating the Kubernetes control plane attack surface. Which component exposes the primary interface for cluster management and must be protected with strong authentication and authorization?

Accepted Answer

kube-apiserver. The kube-apiserver is the core front-end of the Kubernetes control plane that exposes the REST API.

Answer

CoreDNS

Answer

kube-proxy

Answer

kube-scheduler

Question 5

A cluster administrator wants to mitigate supply chain risks stemming from vulnerable base images used by developers. Where in the software lifecycle should vulnerability scanning ideally be integrated first to shift-left security?

Accepted Answer

CI/CD pipeline build and image registry push stages. Integrating vulnerability scanning into the CI/CD pipeline registry push phase or source code repository ensures vulnerable base images are flagged before they reach cluster deployment stages.

Answer

Manual inspection of etcd database backups

Answer

Configuring kube-dns forwarding rules to external resolvers

Answer

Setting up PersistentVolume backup retention policies

Question 6

In a zero-trust Kubernetes architecture, an attacker attempts to exploit the Kubernetes API server via a Server-Side Request Forgery (SSRF) flaw in a poorly written custom controller. Which defense-in-depth mechanism specifically protects against unauthorized API requests originating from inside the cluster network?

Accepted Answer

Mandatory client certificate authentication and rigorous RBAC authorization on API endpoints. Mutual TLS (mTLS) authentication combined with RBAC ensures that callers must present a valid, cryptographically signed client certificate and have explicit authorization rules to talk to the API server.

Answer

Configuring Horizontal Pod Autoscalers to limit request rates

Answer

Enabling Pod Security Standards in baseline mode across all namespaces

Answer

Disabling the Kubelet read-only port on all worker nodes

Question 7

A security engineer is analyzing supply chain risks for container images. An unsigned image from an untrusted public registry is pulled into a secure cluster. Which Admission Controller plugin can be leveraged to prevent the deployment of unsigned container images?

Accepted Answer

ValidatingAdmissionWebhook executing a policy engine integrated with Cosign image signature verification. ValidatingAdmissionPolicy or admission webhook controllers like OPA Gatekeeper or Kyverno integrated with cryptographic signature verification (such as Cosign) are used to enforce image signing.

Answer

NamespaceLifecycle admission plugin

Answer

DefaultStorageClass admission controller

Answer

LimitRanger

Question 8

A developer configures a Kubernetes Pod with `hostNetwork: true`. Under the STRIDE threat model, which threat category is most directly introduced or elevated by this configuration?

Accepted Answer

Elevation of Privilege and Information Disclosure. Setting hostNetwork to true exposes the host's network namespace to the container, elevating the threat of Elevation of Privilege or Information Disclosure through unauthorized packet sniffing on host interfaces.

Answer

Denial of Service via CPU exhaustion

Answer

Tampering of container image layers at rest

Answer

Repudiation of database audit logs

Question 9

A security team discovers that an application container running as root has successfully mounted the host's Docker socket (`/var/run/docker.sock`). What is the primary attack vector enabled by this misconfiguration?

Accepted Answer

Container escape and full node takeover by orchestrating new sibling containers with host mounts. Access to the Docker socket allows a container to create sibling containers on the host, often mounting the host root filesystem (`/`) and achieving full node compromise.

Answer

Bypassing Kubernetes NetworkPolicies across different worker nodes

Answer

Direct modification of the etcd database state via local unix socket tunneling

Answer

Automatic escalation of RBAC roles assigned to the API server

Question 10

An administrator notices that a compromised Pod is attempting to access the cloud provider metadata service to retrieve IAM role credentials. Which native Kubernetes resource is best suited to block this specific attack vector at the network layer?

Accepted Answer

NetworkPolicy. NetworkPolicies can be configured to block egress traffic from specific pods to the link-local IP address of cloud provider metadata services (169.254.169.254).

Answer

ResourceQuota

Answer

ValidatingWebhookConfiguration

Answer

SecurityContext

Question 11

Which of the following represents a common cloud-native supply chain attack vector where malicious actors publish packages with names similar to popular libraries?

Accepted Answer

Typosquatting. Typosquatting involves registering package names in public repositories (like npm, PyPI, or container registries) that closely resemble popular libraries to trick developers.

Answer

Kernel memory exploitation via unprivileged user namespaces

Answer

Denial of Service via packet flooding

Answer

Man-in-the-Middle etcd keystore sniffing

Question 12

A security auditor reviews a Kubernetes cluster threat model and identifies that the Kubelet API on port 10250 permits unauthenticated requests if not configured properly. What authentication and authorization mode should be enforced on the Kubelet to prevent unauthorized remote code execution?

Accepted Answer

Kubelet Authentication Mode set to Webhook and Authorization Mode set to Webhook. Kubelet authentication should be set to Webhook mode, and authorization should also be set to Webhook mode so that Kubelet delegates access decisions back to the Kubernetes API server.

Answer

Enforcing Basic HTTP Authentication headers in kubelet configuration files

Answer

Disabling the Kubelet API entirely by turning off port 10250

Answer

Enabling anonymous requests with strict NetworkPolicy egress rules

Question 13

An organization wants to analyze potential threats to their Kubernetes cluster using the STRIDE model. Which STRIDE category maps to an attacker eavesdropping on unencrypted internal cluster traffic between pods?

Accepted Answer

Information Disclosure. Information Disclosure covers the reading or gaining access to data by an unauthorized entity, such as sniffing unencrypted pod-to-pod network traffic.

Answer

Repudiation

Answer

Tampering

Answer

Denial of Service

Question 14

A security engineer discovers that an attacker has gained access to a container and is attempting to modify container files in a way that persists across pod restarts if the container image is faulty. However, the root filesystem is marked as readOnlyRootFilesystem: true. What is the impact of this setting on the attack?

Accepted Answer

It mitigates threats by preventing attackers from writing malicious binaries or modifying system files in the root filesystem.. Setting readOnlyRootFilesystem to true prevents writes to the container's root filesystem, forcing attackers to use emptyDir or mounted volumes if they wish to write malicious binaries or tools.

Answer

It enforces TLS encryption for all outbound pod network connections.

Answer

It automatically encrypts all environment variables stored in the Pod spec.

Answer

It completely prevents any container from starting up if PersistentVolumeClaims are attached.

Question 15

An adversary successfully compromises a workload and extracts the default service account token. By default, what permission level does this unconfigured service account token possess in modern Kubernetes clusters?

Accepted Answer

Zero explicit RBAC permissions (cannot query or modify cluster resources). In Kubernetes 1.22+, automountServiceAccountToken defaults to true unless disabled, but default service accounts have virtually no RBAC permissions unless explicitly bound via ClusterRoleBinding or RoleBinding.

Answer

Read-only access to all Secrets and ConfigMaps cluster-wide

Answer

Full administrative rights restricted strictly to its own namespace

Answer

Cluster-admin permissions across all cluster namespaces

Question 16

An attacker with compromised Kubernetes credentials attempts to hide malicious activity by deleting Kubernetes audit logs on the worker node. Where should audit logs ideally be stored and managed in a securely hardened cluster to prevent tampering and ensure non-repudiation?

Accepted Answer

Forwarded to an external centralized SIEM or secure remote storage backend. Audit logs should be sent synchronously or asynchronously out of the control plane nodes to an external, write-once-read-many (WORM) storage or centralized SIEM system where local node compromise does not affect log integrity.

Answer

Written to the container image layer cache of the local container runtime

Answer

Stored inside unencrypted ConfigMaps within the default namespace

Answer

Saved locally in an ephemeral emptyDir volume inside the kube-system namespace

Question 17

Which attack vector involves tricking a Kubernetes cluster user or service into executing unintended actions via authenticated sessions, frequently mitigated by robust CSRF defenses and proper API design?

Accepted Answer

Cross-Site Request Forgery (CSRF). Cross-Site Request Forgery (CSRF) tricks a victim into executing unwanted actions on a web application in which they are currently authenticated.

Answer

Denial of Service via memory leaks

Answer

Container escape via kernel flaw

Answer

Image tag mutation

Question 18

An attacker gains execution inside a container that has the `CAP_SYS_ADMIN` capability enabled and shares the host's IPC namespace. How does `CAP_SYS_ADMIN` facilitate container escape?

Accepted Answer

By permitting system administration operations like mounting host filesystems and manipulating cgroups. CAP_SYS_ADMIN is a powerful capability that grants privileges similar to root across many subsystem operations, including mounting filesystems, manipulating cgroups, and interacting with core kernel features that often lead to escape.

Answer

By encrypting all network traffic traversing the CNI plugin bridge

Answer

By enabling automated horizontal scaling of replica sets

Answer

By automatically granting cluster-admin Kubernetes RBAC permissions

Question 19

Which Kubernetes feature allows administrators to define mandatory security baselines, such as disallowing privileged containers, across an entire namespace or cluster?

Accepted Answer

Pod Security Admission. Pod Security Standards (enforced via Pod Security admission or admission controllers) define security levels like Privileged, Baseline, and Restricted.

Answer

Horizontal Pod Autoscaler

Answer

PersistentVolume security controller

Answer

kube-dns policy mapper

Question 20

A DevOps team uses mutable image tags like `:latest` in their deployment manifests. Under supply chain threat modeling, what vulnerability does this practice introduce?

Accepted Answer

Image Tag Hijacking / Malicious substitution without manifest updates. Mutable image tags allow an attacker who compromises the image registry to overwrite the tag with a malicious binary, causing pods restarting or pulling new instances to execute compromised code without changing the deployment manifest.

Answer

Automatic revocation of TLS certificates issued by cert-manager

Answer

Exposition of etcd database credentials on public DNS servers

Answer

Escalation of RBAC permissions from Role to ClusterRole