KCSA Overview OF Cloud Native Security — 25 Questions

Question 1

According to the shared responsibility model, when deploying a managed database service on cloud infrastructure, who is responsible for patching the database software and managing database user access control?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The customer is responsible for data classification, user access management, and application-level security. For managed database services, the cloud provider typically patches the database engine software, while the customer manages user access, schemas, and data security. Wait, let's look at the options to align with standard cloud shared responsibility. Actually, database software patching is often managed by the provider in fully managed databases, but let's check customer responsibilities. Let's make sure the option is unambiguous.

Answer

The physical data center technician

Answer

The container registry administrator

Answer

The cloud provider handles all database user access and encryption keys

Question 2

An organization is reviewing its shared responsibility model for a Kubernetes deployment hosted on a public cloud. An auditor asks who is responsible for patching a zero-day Linux kernel vulnerability affecting the worker node operating system. Who holds primary responsibility in a managed Kubernetes environment?

Accepted Answer

The cloud provider is responsible for patching the underlying host operating system kernel.. In managed Kubernetes services, the cloud provider manages the underlying node OS and is responsible for patching host-level vulnerabilities and kernel updates, whereas in unmanaged clusters, the user is responsible.

Answer

The application development team is responsible for patching the kernel via application code.

Answer

The CNCF security working group releases a kernel patch applied via kubectl.

Answer

Kubernetes automatically patches the kernel using rolling update daemonsets.

Question 3

Under the cloud native shared responsibility model, who is responsible for ensuring that the underlying physical servers and hardware security modules (HSMs) are secure and compliant?

Accepted Answer

The cloud service provider. The cloud provider owns the physical infrastructure, data centers, and underlying hardware.

Answer

The container registry administrator

Answer

The application developer

Answer

The Kubernetes administrator

Question 4

An enterprise is deploying a zero-trust architecture across their Kubernetes environments. They mandate that all container images must be signed using Cosign and verified at admission time using Kyverno. This technical control directly hardens which of the 4Cs layers?

Accepted Answer

Container layer. Container image signing and admission verification ensure the integrity of container images before they run, addressing the Container layer.

Answer

Code layer

Answer

Cloud layer

Answer

Cluster layer

Question 5

An administrator is designing a security posture for a microservices application deployed in a Kubernetes cluster. According to the 4Cs of Cloud Native Security, which component falls under the 'Code' layer?

Accepted Answer

Application dependency libraries in package.json. The Code layer encompasses application source code, third-party libraries, and software dependencies.

Answer

Container base images like Alpine Linux

Answer

Kubernetes API server authorization policies

Answer

Cloud provider IAM roles

Question 6

A security incident response team discovers that a vulnerability in a third-party Python library allowed remote code execution inside a pod. In the context of defense-in-depth and the 4Cs, which layer primarily failed or was unmitigated, requiring remediation at the source?

Accepted Answer

Code layer. Vulnerabilities in third-party libraries reside directly within application code and dependencies, placing this remediation squarely in the Code layer.

Answer

Cloud layer

Answer

Cluster layer

Answer

Container layer

Question 7

A security auditor is evaluating a cloud-native deployment. The team states they practice 'shift-left' security. Which of the 4Cs does this practice primarily target?

Accepted Answer

Code. Shift-left security focuses on integrating security checks into the earliest stages of development, which is the Code layer.

Answer

Container

Answer

Cluster

Answer

Cloud

Question 8

An organization uses AWS IAM to restrict access to their EKS cluster control plane endpoints. According to the shared responsibility model, configuring and maintaining these access entries and cluster RBAC roles is the responsibility of whom?

Accepted Answer

The customer. Access control configuration (IAM and Kubernetes RBAC) is the responsibility of the customer.

Answer

The Linux kernel maintainers

Answer

The cloud provider only

Answer

The CNCF security committee

Question 9

When managing Kubernetes clusters on Google Cloud Platform (GKE), Google manages the control plane infrastructure. Under the shared responsibility model, what is the customer primarily responsible for securing?

Accepted Answer

The Kubernetes worker node operating systems and cluster configuration. In managed Kubernetes (like GKE or EKS), the cloud provider manages the control plane, while the customer is responsible for configuring worker nodes, IAM, cluster networking, and workloads.

Answer

The physical security of the data center housing the servers

Answer

The underlying virtualization hypervisors of the physical data center

Answer

The internal etcd cluster database consensus protocol implementation

Question 10

A platform engineering team is reviewing security layers for a newly provisioned Kubernetes cluster on AWS using Amazon EKS. Which layer of the 4Cs of Cloud Native Security encompasses patching the underlying Linux kernel of the worker nodes?

Accepted Answer

Cluster. The Cluster layer covers Kubernetes configuration, components, and the underlying worker node operating system and kernel.

Answer

Container

Answer

Cloud

Answer

Code

Question 11

When evaluating cloud native security principles, why is reliance on a traditional network firewall (perimeter security) considered insufficient for modern Kubernetes environments?

Accepted Answer

Because container workloads have dynamic IP addresses and high east-west traffic that perimeter firewalls cannot inspect effectively. Kubernetes environments feature dynamic IP addresses, east-west traffic between microservices, and ephemeral workloads, making static perimeter firewalls inadequate.

Answer

Because Kubernetes natively disables all network traffic by default

Answer

Because cloud providers prohibit the use of firewalls

Answer

Because firewalls cannot run on Linux operating systems

Question 12

An organization adopts immutable infrastructure principles for their Kubernetes worker nodes. When a patch is required, they replace the entire node instance rather than updating packages in place. This practice primarily enhances security at which of the 4Cs layers?

Accepted Answer

Cluster layer. Replacing worker nodes with clean, pre-configured images enhances the integrity and security of the Cluster layer.

Answer

Code layer

Answer

Cloud layer

Answer

Container layer

Question 13

A security engineer is hardening a Kubernetes cluster against container breakout attacks. They configure AppArmor profiles and ensure pods run with a non-root user. Which of the 4Cs layers are these security measures primarily designed to protect?

Accepted Answer

Container layer. AppArmor profiles, seccomp, and non-root UID enforcement isolate containers from the host kernel, securing the Container layer.

Answer

Cluster layer

Answer

Cloud layer

Answer

Code layer

Question 14

Which of the following best describes the principle of 'Defense-in-Depth' in cloud native security architectures?

Accepted Answer

Implementing multiple overlapping security controls across the 4Cs so that a single failure does not lead to compromise. Defense-in-depth relies on multiple layers of security controls so that if one layer fails, subsequent layers prevent a breach.

Answer

Outsourcing all security responsibilities to the cloud provider

Answer

Ensuring every developer has cluster admin access for rapid debugging

Answer

Relying entirely on a strong perimeter firewall to block all malicious actors

Question 15

An organization wants to enforce that no containers run with privileged security contexts across multiple clusters. They implement admission control validation. In the context of cloud native security principles, what type of control is this?

Accepted Answer

Preventative automated policy control. Enforcing policies programmatically at admission time is an example of preventative automated policy enforcement.

Answer

Detective manual control

Answer

Corrective physical control

Answer

Compensating detective control

Question 16

A security team implements mutual TLS (mTLS) between all microservices using Istio Service Mesh. Which principle of cloud native security does this implementation primarily exemplify?

Accepted Answer

Zero-trust network segmentation and encryption in transit. Encrypting data in transit between microservices implements zero-trust networking and defense-in-depth principles within the cluster.

Answer

Perimeter-based network defense

Answer

Shared fate computing

Answer

Physical host isolation

Question 17

A security analyst reviews an incident where an attacker compromised a container running with the `CAP_SYS_ADMIN` capability and subsequently escaped to the host node. Which cloud native security principle was violated during the initial pod configuration?

Accepted Answer

Principle of least privilege. Granting unnecessary capabilities like `CAP_SYS_ADMIN` violates the principle of least privilege.

Answer

Zero-trust network architecture

Answer

Shared responsibility model

Answer

Ephemeral infrastructure design

Question 18

According to the shared responsibility model for a cloud-managed Kubernetes service, who is responsible for managing application data encryption keys (using KMS) and application-level secrets?

Accepted Answer

The customer. Application secrets and encryption keys managed via KMS for application payloads are the customer's responsibility.

Answer

The cloud provider

Answer

The Linux Foundation

Answer

The container runtime vendor

Question 19

An enterprise security policy states that all infrastructure must be defined as code (IaC) and scanned for security misconfigurations before deployment. Which part of the cloud native security lifecycle does this control target?

Accepted Answer

Pre-deployment configuration and policy-as-code validation. Scanning IaC templates (Terraform, CloudFormation, Kubernetes manifests) before deployment is part of the Build/Code phase of security.

Answer

Kernel patch management

Answer

Physical data center security

Answer

Runtime security monitoring

Question 20

A DevOps team is building container images using Dockerfiles. They decide to use official minimal distroless base images instead of standard Ubuntu images containing package managers and shell utilities. Which security benefit does this provide?

Accepted Answer

It reduces the container attack surface by removing unused binaries and shells. Distroless images reduce the attack surface by excluding unnecessary binaries, package managers, and shells.

Answer

It encrypts the container image layers at rest in the registry

Answer

It automatically configures cloud IAM roles for the container

Answer

It guarantees zero vulnerabilities in application code dependencies