KCSA Kubernetes Threat Model Practice Test 2 — 15 Questions

Question 1

An administrator notices that a compromised Pod is attempting to access the cloud provider metadata service to retrieve IAM role credentials. Which native Kubernetes resource is best suited to block this specific attack vector at the network layer?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NetworkPolicy. A NetworkPolicy is a Kubernetes resource that controls traffic flow at the IP address and port level (Layer 3/4). By defining egress rules, you can block a compromised Pod from reaching the cloud provider's metadata service (e.g., 169.254.169.254), thus preventing credential theft. This is the native Kubernetes network-layer control for such attack vectors.

Answer

ResourceQuota

Answer

ValidatingWebhookConfiguration

Answer

SecurityContext

Question 2

Which of the following represents a common cloud-native supply chain attack vector where malicious actors publish packages with names similar to popular libraries?

Accepted Answer

Typosquatting. Typosquatting is a supply chain attack where adversaries publish malicious packages with names closely resembling legitimate, popular libraries (e.g., 'lodahs' instead of 'lodash'). Developers who mistype the package name during installation inadvertently pull in malicious code. This is a well-documented cloud-native supply chain threat affecting npm, PyPI, and container registries.

Answer

Kernel memory exploitation via unprivileged user namespaces

Answer

Denial of Service via packet flooding

Answer

Man-in-the-Middle etcd keystore sniffing

Question 3

A security auditor reviews a Kubernetes cluster threat model and identifies that the Kubelet API on port 10250 permits unauthenticated requests if not configured properly. What authentication and authorization mode should be enforced on the Kubelet to prevent unauthorized remote code execution?

Accepted Answer

Kubelet Authentication Mode set to Webhook and Authorization Mode set to Webhook. The Kubelet exposes an HTTPS endpoint on port 10250 that, if left with anonymous authentication enabled and authorization mode AlwaysAllow, allows any unauthenticated client to execute commands in pods (e.g., via /exec, /run, /logs). Setting authentication to Webhook makes the kubelet validate client certificates or bearer tokens against the API server via SubjectAccessReview, and setting authorization to Webhook makes the kubelet delegate authorization decisions to the API server using the same mechanism. Together these enforce that only authenticated, RBAC-authorized identities (nodes, system components, or admins) can call the kubelet API.

Answer

Enforcing Basic HTTP Authentication headers in kubelet configuration files

Answer

Disabling the Kubelet API entirely by turning off port 10250

Answer

Enabling anonymous requests with strict NetworkPolicy egress rules

Question 4

An organization wants to analyze potential threats to their Kubernetes cluster using the STRIDE model. Which STRIDE category maps to an attacker eavesdropping on unencrypted internal cluster traffic between pods?

Accepted Answer

Information Disclosure. Information Disclosure in the STRIDE model covers threats where data is exposed to unauthorized parties, such as eavesdropping on unencrypted traffic. An attacker sniffing internal cluster traffic between pods to read sensitive data is a classic Information Disclosure threat. The other STRIDE categories address different threat types, such as tampering with data or denying service.

Answer

Repudiation

Answer

Tampering

Answer

Denial of Service

Question 5

A security engineer discovers that an attacker has gained access to a container and is attempting to modify container files in a way that persists across pod restarts if the container image is faulty. However, the root filesystem is marked as readOnlyRootFilesystem: true. What is the impact of this setting on the attack?

Accepted Answer

It mitigates threats by preventing attackers from writing malicious binaries or modifying system files in the root filesystem.. Setting readOnlyRootFilesystem: true mounts the container's root filesystem as read-only, which prevents an attacker from writing malicious binaries or modifying system files in the root filesystem. This directly mitigates the threat of persistent modifications to the container image or filesystem. The setting does not affect network encryption, environment variables, or PVC attachment.

Answer

It enforces TLS encryption for all outbound pod network connections.

Answer

It automatically encrypts all environment variables stored in the Pod spec.

Answer

It completely prevents any container from starting up if PersistentVolumeClaims are attached.

Question 6

An attacker with compromised Kubernetes credentials attempts to hide malicious activity by deleting Kubernetes audit logs on the worker node. Where should audit logs ideally be stored and managed in a securely hardened cluster to prevent tampering and ensure non-repudiation?

Accepted Answer

Forwarded to an external centralized SIEM or secure remote storage backend. Audit logs must be shipped off-node to an external, append-only or WORM-capable backend (SIEM, syslog server, object storage with immutability) so that a compromised node or cluster credential cannot delete or alter them. Kubernetes audit policy is configured on the API server via --audit-policy-file and --audit-log-path/--audit-webhook-config-file, and forwarding to a remote endpoint preserves non-repudiation because the attacker's blast radius no longer includes the log store. Centralized storage also enables correlation across nodes and clusters, which is essential for forensic reconstruction after an incident.

Answer

Written to the container image layer cache of the local container runtime

Answer

Stored inside unencrypted ConfigMaps within the default namespace

Answer

Saved locally in an ephemeral emptyDir volume inside the kube-system namespace

Question 7

Which attack vector involves tricking a Kubernetes cluster user or service into executing unintended actions via authenticated sessions, frequently mitigated by robust CSRF defenses and proper API design?

Accepted Answer

Cross-Site Request Forgery (CSRF). Cross-Site Request Forgery (CSRF) tricks an authenticated user's browser or session into sending unintended requests to a trusted application — for example, a malicious page causing a logged-in Kubernetes dashboard user to issue API calls. Mitigations include CSRF tokens, SameSite cookies, and requiring re-authentication for sensitive operations, which is exactly what the question describes.

Answer

Denial of Service via memory leaks

Answer

Container escape via kernel flaw

Answer

Image tag mutation

Question 8

An attacker gains execution inside a container that has the `CAP_SYS_ADMIN` capability enabled and shares the host's IPC namespace. How does `CAP_SYS_ADMIN` facilitate container escape?

Accepted Answer

By permitting system administration operations like mounting host filesystems and manipulating cgroups. CAP_SYS_ADMIN is a powerful Linux capability that grants a broad range of system administration operations, including mounting filesystems, manipulating cgroups, and performing namespace operations. In a container, if this capability is enabled and the container shares the host's IPC namespace, an attacker can mount the host's filesystem (e.g., /dev/sda1) or use cgroup release_agent to execute commands on the host, achieving container escape.

Answer

By encrypting all network traffic traversing the CNI plugin bridge

Answer

By enabling automated horizontal scaling of replica sets

Answer

By automatically granting cluster-admin Kubernetes RBAC permissions

Question 9

Which Kubernetes feature allows administrators to define mandatory security baselines, such as disallowing privileged containers, across an entire namespace or cluster?

Accepted Answer

Pod Security Admission. Pod Security Admission (PSA) is a built-in Kubernetes admission controller that enforces Pod Security Standards (PSS) at the namespace level. It allows administrators to define mandatory security baselines—such as disallowing privileged containers, hostPath volumes, or host networking—by labeling namespaces with pod-security.kubernetes.io/enforce, audit, or warn modes. PSA replaced the deprecated PodSecurityPolicy and is enabled by default in Kubernetes v1.23+, making it the correct feature for cluster-wide or namespace-scoped security baselines.

Answer

Horizontal Pod Autoscaler

Answer

PersistentVolume security controller

Answer

kube-dns policy mapper

Question 10

A DevOps team uses mutable image tags like `:latest` in their deployment manifests. Under supply chain threat modeling, what vulnerability does this practice introduce?

Accepted Answer

Image Tag Hijacking / Malicious substitution without manifest updates. Using mutable tags like :latest introduces the risk of image tag hijacking, where an attacker replaces the image referenced by that tag with a malicious one. Because the deployment manifest still references the same tag, Kubernetes will pull the new malicious image on the next pod restart or reschedule without any manifest change, leading to supply chain compromise. This is a classic supply chain threat in containerized environments.

Answer

Automatic revocation of TLS certificates issued by cert-manager

Answer

Exposition of etcd database credentials on public DNS servers

Answer

Escalation of RBAC permissions from Role to ClusterRole

Question 11

An attacker with read access to Kubernetes Secrets inspects a secret containing TLS private keys. Under the STRIDE threat model, what specific threat category does this represent regarding confidentiality?

Accepted Answer

Information Disclosure. Information Disclosure is the STRIDE category that covers unauthorized access to confidential data, such as an attacker reading TLS private keys from a Kubernetes Secret. Since the attacker has read access to the secret, the confidentiality of the private keys is compromised, which is precisely Information Disclosure. This threat directly maps to the confidentiality pillar of security.

Answer

Denial of Service

Answer

Elevation of Privilege

Answer

Repudiation

Question 12

An engineer is reviewing the threat model of a Kubernetes cluster exposed to the public internet via a LoadBalancer service. Which configuration flaw most commonly leads to unintended external exposure of administrative dashboards?

Accepted Answer

Exposing management dashboards via LoadBalancer or NodePort services without authentication or IP whitelisting. The most common cause of unintended external exposure of administrative dashboards (Kubernetes Dashboard, kube-state-metrics, Prometheus, Argo CD, etc.) is exposing them via a LoadBalancer or NodePort Service without authentication or IP whitelisting. This publishes the dashboard to the public internet, and if it lacks strong auth or has default credentials, attackers can reach it directly — this is the pattern behind many real-world Kubernetes breaches. The fix is to use ClusterIP with an authenticating ingress, or restrict access via IP allowlists and strong auth.

Answer

Configuring liveness probes with HTTP GET requests instead of TCP socket checks

Answer

Setting imagePullPolicy to IfNotPresent on production deployments

Answer

Using ClusterIP service types for internal database connectivity

Question 13

What is the primary security benefit of using immutable container base distroless images?

Accepted Answer

They eliminate unnecessary shells and package managers, drastically reducing the attack surface.. Distroless images contain only the application and its runtime dependencies, omitting package managers, shells, and other utilities. This drastically reduces the attack surface because attackers cannot easily execute shell commands, install tools, or exploit vulnerabilities in unnecessary packages. The primary security benefit is the minimized attack surface.

Answer

They prevent the API server from restarting during control plane upgrades.

Answer

They automatically encrypt persistent storage volumes attached to the pod.

Answer

They configure automatic mTLS between all pods in the cluster via CNI.

Question 14

An auditor notices that a cluster allows users to create Pods that mount host paths (`hostPath`). Which threat does this pose to the underlying node integrity?

Accepted Answer

Arbitrary read/write access to the host filesystem, enabling node compromise. A hostPath volume mounts a directory or file from the node's filesystem directly into the pod, so a container with write access can modify critical node files such as /etc/cron.d, /var/lib/kubelet, or SSH keys, leading to full node compromise and potential cluster-wide lateral movement. This is why Pod Security Standards restricted mode and admission policies like OPA Gatekeeper or Kyverno commonly block hostPath usage.

Answer

Automatic failure of Kubernetes liveness and readiness health probes

Answer

Inability of the CNI plugin to assign IP addresses to pods

Answer

Immediate corruption of the etcd distributed consensus state

Question 15

An organization wants to prevent supply chain attacks where malicious code is injected into third-party Helm charts before deployment. What mitigation technique provides cryptographic verification of Helm chart integrity and authenticity?

Accepted Answer

Verifying Helm chart provenance files using cryptographic signatures and public key rings. Helm supports provenance files (.prov) generated with helm package --sign, which use PGP/GPG signatures and a public key ring to cryptographically verify that a chart was produced by a trusted party and has not been altered. Running helm verify or installing with --verify checks the chart's integrity and authenticity against the keyring, directly mitigating tampered or injected third-party charts.

Answer

Restricting etcd database access using client certificate authentication

Answer

Disabling anonymous requests in the kube-apiserver configuration

Answer

Enabling Pod Security Standards in the target namespace