KCSA Kubernetes Threat Model Practice Test 2 — 15 Questions

Question 1

An attacker with compromised Kubernetes credentials attempts to hide malicious activity by deleting Kubernetes audit logs on the worker node. Where should audit logs ideally be stored and managed in a securely hardened cluster to prevent tampering and ensure non-repudiation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Forwarded to an external centralized SIEM or secure remote storage backend. Audit logs should be sent synchronously or asynchronously out of the control plane nodes to an external, write-once-read-many (WORM) storage or centralized SIEM system where local node compromise does not affect log integrity.

Answer

Written to the container image layer cache of the local container runtime

Answer

Stored inside unencrypted ConfigMaps within the default namespace

Answer

Saved locally in an ephemeral emptyDir volume inside the kube-system namespace

Question 2

Which attack vector involves tricking a Kubernetes cluster user or service into executing unintended actions via authenticated sessions, frequently mitigated by robust CSRF defenses and proper API design?

Accepted Answer

Cross-Site Request Forgery (CSRF). Cross-Site Request Forgery (CSRF) tricks a victim into executing unwanted actions on a web application in which they are currently authenticated.

Answer

Denial of Service via memory leaks

Answer

Container escape via kernel flaw

Answer

Image tag mutation

Question 3

An attacker gains execution inside a container that has the `CAP_SYS_ADMIN` capability enabled and shares the host's IPC namespace. How does `CAP_SYS_ADMIN` facilitate container escape?

Accepted Answer

By permitting system administration operations like mounting host filesystems and manipulating cgroups. CAP_SYS_ADMIN is a powerful capability that grants privileges similar to root across many subsystem operations, including mounting filesystems, manipulating cgroups, and interacting with core kernel features that often lead to escape.

Answer

By encrypting all network traffic traversing the CNI plugin bridge

Answer

By enabling automated horizontal scaling of replica sets

Answer

By automatically granting cluster-admin Kubernetes RBAC permissions

Question 4

Which Kubernetes feature allows administrators to define mandatory security baselines, such as disallowing privileged containers, across an entire namespace or cluster?

Accepted Answer

Pod Security Admission. Pod Security Standards (enforced via Pod Security admission or admission controllers) define security levels like Privileged, Baseline, and Restricted.

Answer

Horizontal Pod Autoscaler

Answer

PersistentVolume security controller

Answer

kube-dns policy mapper

Question 5

A DevOps team uses mutable image tags like `:latest` in their deployment manifests. Under supply chain threat modeling, what vulnerability does this practice introduce?

Accepted Answer

Image Tag Hijacking / Malicious substitution without manifest updates. Mutable image tags allow an attacker who compromises the image registry to overwrite the tag with a malicious binary, causing pods restarting or pulling new instances to execute compromised code without changing the deployment manifest.

Answer

Automatic revocation of TLS certificates issued by cert-manager

Answer

Exposition of etcd database credentials on public DNS servers

Answer

Escalation of RBAC permissions from Role to ClusterRole

Question 6

An attacker with read access to Kubernetes Secrets inspects a secret containing TLS private keys. Under the STRIDE threat model, what specific threat category does this represent regarding confidentiality?

Accepted Answer

Information Disclosure. Unauthorized reading of sensitive data like TLS keys, API tokens, or passwords constitutes Information Disclosure.

Answer

Denial of Service

Answer

Elevation of Privilege

Answer

Repudiation

Question 7

An engineer is reviewing the threat model of a Kubernetes cluster exposed to the public internet via a LoadBalancer service. Which configuration flaw most commonly leads to unintended external exposure of administrative dashboards?

Accepted Answer

Exposing management dashboards via LoadBalancer or NodePort services without authentication or IP whitelisting. Deploying management tools (like Kubernetes dashboards, monitoring UIs, or debugging tools) with external LoadBalancer services or NodePorts without authentication or network restriction is a major threat vector.

Answer

Configuring liveness probes with HTTP GET requests instead of TCP socket checks

Answer

Setting imagePullPolicy to IfNotPresent on production deployments

Answer

Using ClusterIP service types for internal database connectivity

Question 8

What is the primary security benefit of using immutable container base distroless images?

Accepted Answer

They eliminate unnecessary shells and package managers, drastically reducing the attack surface.. Distroless images contain only the application and its runtime dependencies, stripping out shells, package managers, and utilities, which drastically reduces the attack surface and prevents attackers from executing shell commands if compromised.

Answer

They prevent the API server from restarting during control plane upgrades.

Answer

They automatically encrypt persistent storage volumes attached to the pod.

Answer

They configure automatic mTLS between all pods in the cluster via CNI.

Question 9

An auditor notices that a cluster allows users to create Pods that mount host paths (`hostPath`). Which threat does this pose to the underlying node integrity?

Accepted Answer

Arbitrary read/write access to the host filesystem, enabling node compromise. hostPath mounts allow containers to read and write directly to the host node's filesystem, enabling attackers to tamper with system files, cron jobs, or SSH authorized keys for node takeover.

Answer

Automatic failure of Kubernetes liveness and readiness health probes

Answer

Inability of the CNI plugin to assign IP addresses to pods

Answer

Immediate corruption of the etcd distributed consensus state

Question 10

An organization wants to prevent supply chain attacks where malicious code is injected into third-party Helm charts before deployment. What mitigation technique provides cryptographic verification of Helm chart integrity and authenticity?

Accepted Answer

Verifying Helm chart provenance files using cryptographic signatures and public key rings. Helm supports cryptographically signing charts using Provenance files and verifying them with public key rings prior to installation.

Answer

Restricting etcd database access using client certificate authentication

Answer

Disabling anonymous requests in the kube-apiserver configuration

Answer

Enabling Pod Security Standards in the target namespace

Question 11

What is the primary risk associated with running containers as the `root` user (`runAsUser: 0` or omitting the user directive)?

Accepted Answer

If a container escape vulnerability occurs, the attacker immediately obtains root privileges on the underlying host.. Running as root inside the container means the process has root privileges inside the container namespace, and if a container escape vulnerability exists, the attacker immediately gains root access on the host.

Answer

It prevents the kubelet from restarting the container upon failure.

Answer

It disables the container runtime engine's ability to pull images from private registries.

Answer

It forces the CNI plugin to drop network packets destined for external IPs.

Question 12

A Kubernetes cluster experiences an attack where an untrusted pod attempts to access the Kubernetes API server and discover cluster secrets. The cluster uses RBAC. What is the mechanism that prevents this pod from reading secrets in other namespaces?

Accepted Answer

Namespaced RoleBindings limiting permissions strictly to the pod's own namespace. Kubernetes RBAC RoleBindings are namespaced, meaning a Role or RoleBinding grants permissions only within the specific namespace where it is created, preventing cross-namespace access unless a ClusterRoleBinding is used.

Answer

Enabling the AlwaysAdmit authorization webhook mode

Answer

Default ClusterRole bindings assigned automatically to all service accounts

Answer

NetworkPolicies blocking traffic directed at the Kubernetes API server port

Question 13

A security engineer identifies that an enterprise Kubernetes cluster has several cluster-admin bindings granted to user accounts that have left the company. Which Kubernetes security principle has been violated?

Accepted Answer

Principle of Least Privilege and proper identity/access lifecycle management. Granting excessive permissions or failing to revoke access upon role changes violates the principle of least privilege and robust identity lifecycle management.

Answer

NetworkPolicy ingress traffic isolation

Answer

Pod Security Standards baseline enforcement

Answer

Container image vulnerability scanning policies

Question 14

An attacker gains execution in a container and attempts to perform a denial of service attack on other workloads sharing the same Kubernetes node by consuming all available CPU and memory resources. What Kubernetes feature prevents this cross-workload resource exhaustion?

Accepted Answer

Container Resource Requests and Limits (CPU and memory). ResourceQuotas and LimitRanges/Container Resource Limits (requests and limits) ensure that containers cannot exceed allocated compute resources, preventing noisy neighbor and starvation attacks.

Answer

ValidatingWebhookConfiguration rejecting pod creations

Answer

NetworkPolicy egress blocking rules

Answer

ClusterRoleBindings restricting RBAC permissions

Question 15

An auditor is evaluating the security posture of an on-premises Kubernetes cluster. The team notices that the etcd data directory is stored without encryption at rest. What is the primary threat this exposes the cluster to?

Accepted Answer

Direct exposure of all Kubernetes Secrets in plain text to anyone with read access to etcd storage. etcd stores all Kubernetes objects in plain text by default, including Secrets. Anyone with access to the etcd data files or snapshots can read all cluster secrets in plain text.

Answer

Inability of worker nodes to perform TLS handshakes with the API server

Answer

Immediate failure of HorizontalPodAutoscaler metric polling loops

Answer

Automatic elevation of all ServiceAccounts to cluster-admin privileges