KCSA Overview OF Cloud Native Security — 20 Questions

Question 1

When managing Kubernetes clusters on Google Cloud Platform (GKE), Google manages the control plane infrastructure. Under the shared responsibility model, what is the customer primarily responsible for securing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Kubernetes worker node operating systems and cluster configuration. In GKE's shared responsibility model, Google manages the control plane (including the API server, scheduler, controller manager, and etcd) as well as the physical infrastructure, hypervisors, and data center security. The customer is responsible for securing the worker nodes (which run the actual workloads) and the cluster configuration, such as network policies, RBAC, pod security, and node OS patching when using standard GKE nodes. This division is explicitly defined in Google Cloud's documentation: Google secures the infrastructure, while the customer secures what they deploy and how they configure it.

Answer

The physical security of the data center housing the servers

Answer

The underlying virtualization hypervisors of the physical data center

Answer

The internal etcd cluster database consensus protocol implementation

Question 2

A platform engineering team is reviewing security layers for a newly provisioned Kubernetes cluster on AWS using Amazon EKS. Which layer of the 4Cs of Cloud Native Security encompasses patching the underlying Linux kernel of the worker nodes?

Accepted Answer

Cluster. In the 4Cs of Cloud Native Security (Cloud, Cluster, Container, Code), the Cluster layer encompasses the security of the Kubernetes cluster itself, including the control plane and worker nodes. Patching the underlying Linux kernel of the worker nodes is a cluster-level responsibility because it involves the host operating system that runs the container runtime and kubelet. Therefore, the Cluster layer is correct.

Answer

Container

Answer

Cloud

Answer

Code

Question 3

An organization adopts immutable infrastructure principles for their Kubernetes worker nodes. When a patch is required, they replace the entire node instance rather than updating packages in place. This practice primarily enhances security at which of the 4Cs layers?

Accepted Answer

Cluster layer. Immutable infrastructure for worker nodes maps to the Cluster layer of the 4Cs, because node lifecycle management—provisioning, patching by replacement, and decommissioning—is part of how the cluster infrastructure is built and maintained. Replacing rather than mutating nodes eliminates configuration drift and ensures every node conforms to a known-good, hardened image.

Answer

Code layer

Answer

Cloud layer

Answer

Container layer

Question 4

An organization is performing a threat modeling exercise for a Kubernetes cluster. They identify that an attacker could exploit a vulnerability in the container runtime (e.g., containerd) to access the underlying host. Which of the 4Cs does the container runtime belong to?

Accepted Answer

Container layer. The container runtime (e.g., containerd, CRI-O) is part of the Container layer in the 4Cs model. The 4Cs — Cloud, Cluster, Container, and Code — define layers of defense-in-depth, and the container runtime sits squarely in the Container layer because it directly manages container lifecycle, images, and isolation primitives (namespaces, cgroups, seccomp). A runtime escape vulnerability therefore represents a Container-layer failure that can compromise the host.

Answer

Cloud layer

Answer

Cluster layer

Answer

Code layer

Question 5

According to the shared responsibility model, when deploying a managed database service on cloud infrastructure, who is responsible for patching the database software and managing database user access control?

Accepted Answer

The customer is responsible for data classification, user access management, and application-level security. For managed database services, the cloud provider typically patches the database engine software, while the customer manages user access, schemas, and data security. Wait, let's look at the options to align with standard cloud shared responsibility. Actually, database software patching is often managed by the provider in fully managed databases, but let's check customer responsibilities. Let's make sure the option is unambiguous.

Answer

The physical data center technician

Answer

The container registry administrator

Answer

The cloud provider handles all database user access and encryption keys

Question 6

Which THREE of the following activities fall under the customer's responsibility in the shared responsibility model when running Kubernetes on cloud infrastructure? (Choose THREE)

Accepted Answer

Patching and updating the worker node operating system kernel. In the shared responsibility model for managed Kubernetes, the customer is responsible for the workloads and the configuration they control. Option B is correct because patching and updating the worker node operating system kernel is a customer task when the customer manages the node OS, such as with self-managed node pools or unmanaged node images, since the provider only handles the physical and virtualization layers. Option D is correct because configuring Kubernetes RBAC and network policies is a cluster-level security configuration that the customer owns to control access and pod-to-pod traffic. Option E is correct because developing, scanning, and deploying container workloads and manifests is squarely the customer's responsibility, including image vulnerability scanning and secure deployment practices. Option A is incorrect because physical security and environmental controls of the data center belong to the cloud provider, not the customer. Option C is incorrect because managing the underlying physical hypervisors hosting virtual machines is also a provider responsibility in cloud infrastructure.

Answer

Physical security and environmental controls of the cloud provider data center

Answer

Managing the underlying physical hypervisors hosting virtual machines

Question 7

An organization is reviewing its shared responsibility model for a Kubernetes deployment hosted on a public cloud. An auditor asks who is responsible for patching a zero-day Linux kernel vulnerability affecting the worker node operating system. Who holds primary responsibility in a managed Kubernetes environment?

Accepted Answer

The cloud provider is responsible for patching the underlying host operating system kernel.. In managed Kubernetes services, the cloud provider manages the underlying node OS and is responsible for patching host-level vulnerabilities and kernel updates, whereas in unmanaged clusters, the user is responsible.

Answer

The application development team is responsible for patching the kernel via application code.

Answer

The CNCF security working group releases a kernel patch applied via kubectl.

Answer

Kubernetes automatically patches the kernel using rolling update daemonsets.

Question 8

Under the cloud native shared responsibility model, who is responsible for ensuring that the underlying physical servers and hardware security modules (HSMs) are secure and compliant?

Accepted Answer

The cloud service provider. Under the cloud native shared responsibility model, the cloud service provider (CSP) owns and operates the physical infrastructure layer — data centers, physical servers, networking hardware, and hardware security modules (HSMs). Customers consume these as abstracted services and cannot patch, inspect, or physically secure them, so the CSP is contractually and technically responsible for their security and compliance (e.g., FIPS 140-2 validated HSMs, SOC 2, ISO 27001 attestations).

Answer

The container registry administrator

Answer

The application developer

Answer

The Kubernetes administrator

Question 9

An enterprise is deploying a zero-trust architecture across their Kubernetes environments. They mandate that all container images must be signed using Cosign and verified at admission time using Kyverno. This technical control directly hardens which of the 4Cs layers?

Accepted Answer

Container layer. Cosign image signing combined with Kyverno admission-time verification is a container-layer control because it governs the integrity and provenance of the container image artifact itself before it is admitted to run. The Container layer of the 4Cs (Cloud, Cluster, Container, Code) covers image contents, image provenance, and runtime configuration of the container. Signing and verifying images ensures only trusted, unmodified images execute, which is a direct hardening of that layer.

Answer

Code layer

Answer

Cloud layer

Answer

Cluster layer

Question 10

An administrator is designing a security posture for a microservices application deployed in a Kubernetes cluster. According to the 4Cs of Cloud Native Security, which component falls under the 'Code' layer?

Accepted Answer

Application dependency libraries in package.json. In the 4Cs of Cloud Native Security (Cloud, Cluster, Container, Code), the 'Code' layer refers to the application code and its dependencies. Application dependency libraries in package.json (B) are part of the code layer because they are directly included in the application's build and runtime. This layer focuses on securing the software supply chain and application logic.

Answer

Container base images like Alpine Linux

Answer

Kubernetes API server authorization policies

Answer

Cloud provider IAM roles

Question 11

A security incident response team discovers that a vulnerability in a third-party Python library allowed remote code execution inside a pod. In the context of defense-in-depth and the 4Cs, which layer primarily failed or was unmitigated, requiring remediation at the source?

Accepted Answer

Code layer. A vulnerability in a third-party Python library that enables RCE inside a pod is a Code-layer failure. The Code layer encompasses application code, dependencies, libraries, and the software supply chain. Remediation must occur at the source — patching or replacing the vulnerable library, scanning dependencies, and rebuilding the image — because the flaw originates in the application's code/dependency stack, not in the cluster or container runtime.

Answer

Cloud layer

Answer

Cluster layer

Answer

Container layer

Question 12

A security auditor is evaluating a cloud-native deployment. The team states they practice 'shift-left' security. Which of the 4Cs does this practice primarily target?

Accepted Answer

Code. 'Shift-left' security means moving security practices earlier in the software development lifecycle — into design, coding, and CI/CD — which maps to the 'Code' layer of the 4Cs (Cloud, Cluster, Container, Code). This includes SAST, dependency scanning, secrets detection, and secure coding standards applied before deployment.

Answer

Container

Answer

Cluster

Answer

Cloud

Question 13

An organization uses AWS IAM to restrict access to their EKS cluster control plane endpoints. According to the shared responsibility model, configuring and maintaining these access entries and cluster RBAC roles is the responsibility of whom?

Accepted Answer

The customer. Under the AWS shared responsibility model, AWS is responsible for security 'of' the cloud (the infrastructure), while the customer is responsible for security 'in' the cloud. For EKS, the control plane infrastructure is managed by AWS, but configuring IAM access entries and Kubernetes RBAC roles that govern who can access the cluster is a customer responsibility.

Answer

The Linux kernel maintainers

Answer

The cloud provider only

Answer

The CNCF security committee

Question 14

When evaluating cloud native security principles, why is reliance on a traditional network firewall (perimeter security) considered insufficient for modern Kubernetes environments?

Accepted Answer

Because container workloads have dynamic IP addresses and high east-west traffic that perimeter firewalls cannot inspect effectively. Kubernetes pods receive ephemeral IPs from the CNI plugin and are constantly created, destroyed, and rescheduled, so static perimeter firewall rules cannot reliably identify or track workloads. Additionally, most traffic in a cluster is east-west (pod-to-pod, service-to-service), which never crosses the perimeter and therefore is invisible to a traditional firewall. This is why Kubernetes-native controls like NetworkPolicies, service meshes, and zero-trust identity are required.

Answer

Because Kubernetes natively disables all network traffic by default

Answer

Because cloud providers prohibit the use of firewalls

Answer

Because firewalls cannot run on Linux operating systems

Question 15

A security engineer is hardening a Kubernetes cluster against container breakout attacks. They configure AppArmor profiles and ensure pods run with a non-root user. Which of the 4Cs layers are these security measures primarily designed to protect?

Accepted Answer

Container layer. AppArmor profiles and running pods as a non-root user are security measures that apply to the container runtime and the containerized processes. These controls restrict what a container can do, such as limiting system calls or preventing privilege escalation, which are part of the Container layer in the 4Cs model. Therefore, the Container layer is the primary target.

Answer

Cluster layer

Answer

Cloud layer

Answer

Code layer

Question 16

Which of the following best describes the principle of 'Defense-in-Depth' in cloud native security architectures?

Accepted Answer

Implementing multiple overlapping security controls across the 4Cs so that a single failure does not lead to compromise. Defense-in-Depth means layering multiple independent, overlapping security controls across the 4Cs (Cloud, Cluster, Container, Code) so that the failure of any single control does not result in full compromise. In cloud native terms this includes network policies, RBAC, Pod Security Admission, image scanning, mTLS, runtime detection, and secrets encryption — each compensating for gaps in the others.

Answer

Outsourcing all security responsibilities to the cloud provider

Answer

Ensuring every developer has cluster admin access for rapid debugging

Answer

Relying entirely on a strong perimeter firewall to block all malicious actors

Question 17

An organization wants to enforce that no containers run with privileged security contexts across multiple clusters. They implement admission control validation. In the context of cloud native security principles, what type of control is this?

Accepted Answer

Preventative automated policy control. Admission control validation in Kubernetes intercepts API requests before an object is persisted, and if the validating webhook rejects the request, the privileged pod is never created. This is a preventative control because it stops the non-compliant configuration from ever reaching the cluster, rather than detecting it after the fact. In cloud native security terms, it is automated (policy-as-code, e.g., OPA Gatekeeper or Kyverno) and preventative by design.

Answer

Detective manual control

Answer

Corrective physical control

Answer

Compensating detective control

Question 18

A security team implements mutual TLS (mTLS) between all microservices using Istio Service Mesh. Which principle of cloud native security does this implementation primarily exemplify?

Accepted Answer

Zero-trust network segmentation and encryption in transit. Implementing mTLS between all microservices with Istio exemplifies zero-trust network segmentation and encryption in transit. Zero-trust assumes no implicit trust based on network location; every service must authenticate and encrypt its traffic. mTLS provides both mutual authentication (both sides present certificates) and encryption, which is the core of zero-trust service-to-service communication.

Answer

Perimeter-based network defense

Answer

Shared fate computing

Answer

Physical host isolation

Question 19

A security analyst reviews an incident where an attacker compromised a container running with the `CAP_SYS_ADMIN` capability and subsequently escaped to the host node. Which cloud native security principle was violated during the initial pod configuration?

Accepted Answer

Principle of least privilege. The principle of least privilege (B) was violated because the container was granted the `CAP_SYS_ADMIN` capability, which is a powerful capability that allows administrative operations. Containers should run with only the minimal capabilities required. Granting such a capability increases the risk of container escape and host compromise.

Answer

Zero-trust network architecture

Answer

Shared responsibility model

Answer

Ephemeral infrastructure design

Question 20

According to the shared responsibility model for a cloud-managed Kubernetes service, who is responsible for managing application data encryption keys (using KMS) and application-level secrets?

Accepted Answer

The customer. Under the shared responsibility model for managed Kubernetes (EKS, AKS, GKE), the cloud provider secures the control plane and physical infrastructure, but the customer always owns their data and the keys protecting it. Application data encryption keys managed via KMS and application-level secrets (API keys, DB credentials, tokens) remain the customer's responsibility regardless of service model.

Answer

The cloud provider

Answer

The Linux Foundation

Answer

The container runtime vendor