KCSA Kubernetes Threat Model Practice Test 3 — 15 Questions

Question 1

Which of the following is a key component of the Kubernetes threat model concerning the compromise of node kubelets via insecure configuration?

Accepted Answer

Leaving the Kubelet read-only port (10255) enabled and accessible. Exposing the Kubelet read-only port (10255) allows unauthenticated retrieval of pod specifications, container logs, and environment variables without any credentials.

Answer

Enforcing Pod Security Admission in restricted mode

Answer

Using secure HTTPS client certificates for API server communication

Answer

Enabling RBAC authorization mode across the control plane

Question 2

An organization is building a secure software supply chain for Kubernetes. They want to ensure that containers running in the cluster were built from verified source code and passed automated security gates. Which tool combination supports this attestation and verification pipeline?

Accepted Answer

Cosign for cryptographic image signing, SBOM generation, and admission controllers for policy enforcement. Tools like Tekton or GitHub Actions for CI/CD, Cosign for signing images and generating SBOMs (Software Bill of Materials), and Kyverno or OPA Gatekeeper for admission control verification form a complete software supply chain security framework.

Answer

HorizontalPodAutoscaler and Metrics Server integration

Answer

kube-proxy for CNI routing and CoreDNS for internal name resolution

Answer

etcd snapshots and kubeadm control plane bootstrapping scripts

Question 3

An attacker compromises a cluster node and attempts to inspect container communication. By default, how is pod-to-pod network traffic handled across different nodes in a standard Kubernetes cluster without a service mesh or CNI encryption enabled?

Accepted Answer

Transmitted in plain text across the network fabric, making it vulnerable to sniffing. Standard Kubernetes CNI plugins transmit pod-to-pod traffic in plain text across the underlying network fabric unless an encrypted overlay network (like IPsec or WireGuard) or a service mesh providing mTLS is configured.

Answer

Encrypted automatically using mandatory 256-bit AES transport layer security

Answer

Blocked entirely by default unless a LoadBalancer service is declared

Answer

Routed exclusively through the etcd secure TLS database tunnel

Question 4

An organization is performing a STRIDE-based threat model on their Kubernetes deployment. Which TWO of the following threats map directly to the 'Tampering' category in a Kubernetes environment?

Accepted Answer

An attacker altering container image layers stored in an insecure registry. Tampering involves unauthorized modification of data or code. Modifying container images in a registry and tampering with Kubernetes manifests in etcd/Git repository are prime examples.

Answer

An attacker flooding the API server with requests to exhaust control plane memory

Answer

An attacker sniffing unencrypted pod-to-pod network traffic across the CNI bridge

Answer

An administrator denying that they executed a cluster deletion command due to missing logs

Question 5

What is the security risk of configuring `privileged: true` in a container's SecurityContext?

Accepted Answer

It disables container isolation, granting full access to host devices and kernel capabilities. A privileged container disables all kernel namespace isolation and security confinement, granting the container full access to all devices and kernel capabilities of the host.

Answer

It restricts the container from writing to any attached volume.

Answer

It forces the API server to reject all incoming TLS client requests.

Answer

It prevents the application from reading its own environment variables.

Question 6

An administrator wishes to defend against supply chain attacks involving malicious third-party Kubernetes operators installed from public catalogs. What security practice is most effective before installing such operators?

Accepted Answer

Reviewing requested RBAC permissions, operator manifests, and verifying image provenance. Inspecting CustomResourceDefinitions (CRDs), controller manifests, RBAC permissions requested by the operator, and pulling container images from verified registries ensures the operator does not request excessive privileges (e.g., cluster-admin).

Answer

Enabling Horizontal Pod Autoscaling for CoreDNS replicas

Answer

Disabling the Kubernetes Dashboard service deployment

Answer

Configuring liveness probes on all worker nodes to check kubelet responsiveness

Question 7

Which THREE of the following configurations or features represent critical attack vectors or misconfigurations in a Kubernetes cluster threat model?

Accepted Answer

Mounting the host Docker socket (`/var/run/docker.sock`) into application pods. Leaving the Kubelet unauthenticated/read-only, running containers in privileged mode, and mounting the Docker socket all introduce severe container escape and cluster takeover vectors.

Answer

Enabling Pod Security Admission in restricted mode across all namespaces

Answer

Configuring etcd encryption at rest with a Secret encryption provider

Question 8

Which THREE of the following mechanisms are essential for securing the Kubernetes control plane against unauthorized access and privilege escalation?

Accepted Answer

Enforcing robust Role-Based Access Control (RBAC) with least privilege principles. Enabling mutual TLS for component communication, enforcing robust RBAC, and enabling etcd encryption at rest are fundamental control plane hardening steps.

Answer

Using mutable `:latest` image tags for all control plane system components

Answer

Setting `allowPrivilegeEscalation: true` across all default container security contexts

Question 9

An auditor evaluates network security controls in a Kubernetes cluster. Which TWO configurations help mitigate lateral movement and network-based attacks between pods?

Accepted Answer

Implementing a service mesh (such as Istio or Linkerd) with strict mTLS enforcement. Deploying CNI-level network policies and implementing a service mesh for mTLS traffic encryption and authentication mitigate lateral movement.

Answer

Disabling CNI network plugins to run pods in bridge mode

Answer

Exposing all internal microservices via NodePort services on worker nodes

Answer

Mounting the host network namespace (`hostNetwork: true`) on all application pods

Question 10

Which THREE of the following capabilities or runtime configurations pose extreme risks of container escape when granted to an untrusted workload?

Accepted Answer

`hostPID: true` sharing the host process namespace. CAP_SYS_ADMIN, privileged mode, and hostPID/hostIPC namespace sharing all provide powerful vectors for breaking container boundaries.

Answer

Setting `automountServiceAccountToken: false` on the service account

Answer

Setting `readOnlyRootFilesystem: true` in the container specification

Question 11

Which THREE of the following supply chain vulnerabilities or risks can impact Kubernetes application deployments during the build or deployment phase?

Accepted Answer

Using outdated container base images containing known remote code execution CVEs. Compromised base images, typosquatting dependencies, and untrusted Helm charts are all common supply chain vectors.

Answer

Enforcing Pod Security Standards in baseline mode in production namespaces

Answer

Enabling Kubernetes audit logging with webhook sinks

Question 12

In the context of Kubernetes API server security, which TWO mechanisms are used to authenticate incoming API requests?

Accepted Answer

X509 Client Certificates presented during TLS handshakes. X509 client certificates and Service Account bearer tokens are standard Kubernetes authentication mechanisms.

Answer

Kubernetes NetworkPolicy egress CIDR blocks

Answer

PersistentVolume claim capacity metadata

Answer

Container image pull secrets stored in private registries

Question 13

When modeling threats related to Kubernetes secrets management, which TWO actions help protect secrets from unauthorized access?

Accepted Answer

Integrating external secret management systems (e.g., HashiCorp Vault, AWS Secrets Manager). Using external secret stores (like Vault or cloud KMS) and enabling etcd encryption at rest protect secrets effectively.

Answer

Granting all namespace users cluster-admin read permissions on Secret objects

Answer

Disabling RBAC authentication across all API server endpoints

Answer

Storing database credentials in plain text ConfigMaps in the default namespace

Question 14

Which THREE of the following steps are recognized best practices for hardening worker nodes against attacks and container escapes?

Accepted Answer

Keeping node host operating system kernels and container runtimes regularly patched. Disabling the Kubelet read-only port, keeping host OS kernels updated, and restricting SSH access are key node hardening practices.

Answer

Configuring all pods to execute with `securityContext.runAsUser: 0`

Answer

Allowing anonymous authentication requests on the Kubelet API

Question 15

An administrator needs to analyze the STRIDE threat model category that encompasses an attacker gaining unauthorized elevation of privilege inside a Kubernetes cluster by exploiting a misconfigured RBAC ClusterRoleBinding. Which threat category does this represent?

Accepted Answer

Elevation of Privilege. Elevation of privilege corresponds to users gaining capabilities they are not authorized to have, such as using an overly permissive ClusterRoleBinding to impersonate the system:masters group.

Answer

Tampering

Answer

Repudiation

Answer

Information Disclosure