KCSA Overview OF Cloud Native Security Practice Test 2 — 15 Questions

Question 1

Which of the following best describes the principle of 'Defense-in-Depth' in cloud native security architectures?

Accepted Answer

Implementing multiple overlapping security controls across the 4Cs so that a single failure does not lead to compromise. Defense-in-Depth means layering multiple independent, overlapping security controls across the 4Cs (Cloud, Cluster, Container, Code) so that the failure of any single control does not result in full compromise. In cloud native terms this includes network policies, RBAC, Pod Security Admission, image scanning, mTLS, runtime detection, and secrets encryption — each compensating for gaps in the others.

Answer

Outsourcing all security responsibilities to the cloud provider

Answer

Ensuring every developer has cluster admin access for rapid debugging

Answer

Relying entirely on a strong perimeter firewall to block all malicious actors

Question 2

An organization wants to enforce that no containers run with privileged security contexts across multiple clusters. They implement admission control validation. In the context of cloud native security principles, what type of control is this?

Accepted Answer

Preventative automated policy control. Admission control validation in Kubernetes intercepts API requests before an object is persisted, and if the validating webhook rejects the request, the privileged pod is never created. This is a preventative control because it stops the non-compliant configuration from ever reaching the cluster, rather than detecting it after the fact. In cloud native security terms, it is automated (policy-as-code, e.g., OPA Gatekeeper or Kyverno) and preventative by design.

Answer

Detective manual control

Answer

Corrective physical control

Answer

Compensating detective control

Question 3

A security team implements mutual TLS (mTLS) between all microservices using Istio Service Mesh. Which principle of cloud native security does this implementation primarily exemplify?

Accepted Answer

Zero-trust network segmentation and encryption in transit. Implementing mTLS between all microservices with Istio exemplifies zero-trust network segmentation and encryption in transit. Zero-trust assumes no implicit trust based on network location; every service must authenticate and encrypt its traffic. mTLS provides both mutual authentication (both sides present certificates) and encryption, which is the core of zero-trust service-to-service communication.

Answer

Perimeter-based network defense

Answer

Shared fate computing

Answer

Physical host isolation

Question 4

A security analyst reviews an incident where an attacker compromised a container running with the `CAP_SYS_ADMIN` capability and subsequently escaped to the host node. Which cloud native security principle was violated during the initial pod configuration?

Accepted Answer

Principle of least privilege. The principle of least privilege (B) was violated because the container was granted the `CAP_SYS_ADMIN` capability, which is a powerful capability that allows administrative operations. Containers should run with only the minimal capabilities required. Granting such a capability increases the risk of container escape and host compromise.

Answer

Zero-trust network architecture

Answer

Shared responsibility model

Answer

Ephemeral infrastructure design

Question 5

According to the shared responsibility model for a cloud-managed Kubernetes service, who is responsible for managing application data encryption keys (using KMS) and application-level secrets?

Accepted Answer

The customer. Under the shared responsibility model for managed Kubernetes (EKS, AKS, GKE), the cloud provider secures the control plane and physical infrastructure, but the customer always owns their data and the keys protecting it. Application data encryption keys managed via KMS and application-level secrets (API keys, DB credentials, tokens) remain the customer's responsibility regardless of service model.

Answer

The cloud provider

Answer

The Linux Foundation

Answer

The container runtime vendor

Question 6

An enterprise security policy states that all infrastructure must be defined as code (IaC) and scanned for security misconfigurations before deployment. Which part of the cloud native security lifecycle does this control target?

Accepted Answer

Pre-deployment configuration and policy-as-code validation. The policy requires infrastructure to be defined as code and scanned for misconfigurations before deployment, which directly targets the pre-deployment phase of the cloud native security lifecycle. This is where configuration and policy-as-code validation occur, ensuring that security issues are caught early in the CI/CD pipeline. Tools like Checkov, tfsec, or OPA/Gatekeeper enforce these checks. Thus, option C correctly identifies this control.

Answer

Kernel patch management

Answer

Physical data center security

Answer

Runtime security monitoring

Question 7

A DevOps team is building container images using Dockerfiles. They decide to use official minimal distroless base images instead of standard Ubuntu images containing package managers and shell utilities. Which security benefit does this provide?

Accepted Answer

It reduces the container attack surface by removing unused binaries and shells. Distroless images contain only the application and its runtime dependencies — no package manager, no shell, no standard Linux utilities. Removing these components eliminates entire classes of attack vectors such as shell injection, package-manager abuse, and exploitation of unpatched utilities like bash or curl. This directly reduces the container attack surface, which is exactly what option A states.

Answer

It encrypts the container image layers at rest in the registry

Answer

It automatically configures cloud IAM roles for the container

Answer

It guarantees zero vulnerabilities in application code dependencies

Question 8

An organization's security team mandates that all Kubernetes worker nodes must be scanned for Common Vulnerabilities and Exposures (CVEs) on a scheduled basis. Under the 4Cs, what layer does node vulnerability scanning address?

Accepted Answer

Cluster layer. Under the 4Cs (Cloud, Cluster, Container, Code), the cluster layer encompasses the control plane components, worker nodes, kubelet, container runtime, and node OS. Scanning worker nodes for CVEs addresses vulnerabilities in the node operating system, kernel, and installed packages — squarely a cluster-layer concern. This is distinct from scanning container images (container layer) or application source (code layer).

Answer

Container layer

Answer

Cloud layer

Answer

Code layer

Question 9

When discussing cloud native security, what does 'ephemeral infrastructure' refer to, and why is it beneficial for security?

Accepted Answer

Short-lived workloads and nodes that are frequently destroyed and recreated, reducing an attacker's persistence window. Ephemeral infrastructure refers to short-lived workloads and nodes that are frequently destroyed and recreated rather than persisting indefinitely. In cloud native environments, this reduces an attacker's persistence window because any compromise is contained to a brief lifespan, and immutable redeployments wipe out unauthorized changes. This design principle is central to Kubernetes and container security, where pods and nodes are treated as disposable.

Answer

Network connections that automatically drop after one second

Answer

Virtual machines stored in volatile RAM without disk storage

Answer

Infrastructure that is permanent and never updated to prevent downtime

Question 10

A security architect is designing a multi-tenant Kubernetes platform. They need to ensure that a compromise in one tenant's namespace cannot allow packet sniffing or unauthorized traffic interception from another tenant's pods. Which Kubernetes feature should they implement to satisfy cloud native network isolation principles?

Accepted Answer

Kubernetes NetworkPolicies. Kubernetes NetworkPolicies are the native mechanism for controlling pod-to-pod traffic at L3/L4, allowing the architect to define ingress and egress rules that restrict which pods can communicate. By default, Kubernetes allows all pod-to-pod traffic within a cluster, so a compromised pod in one tenant namespace could sniff or reach pods in another. NetworkPolicies enforce isolation by selecting pods via labels and permitting only explicitly allowed flows, satisfying the cloud-native network isolation principle for multi-tenancy.

Answer

Kubernetes RBAC RoleBindings

Answer

ResourceQuotas

Answer

PodSecurityStandards

Question 11

Which of the following is a core tenet of Zero Trust architecture in cloud native environments?

Accepted Answer

Verify explicitly, use least privilege access, and assume breach. The canonical Zero Trust tenet is 'never trust, always verify,' operationalized as verify explicitly, apply least privilege access, and assume breach. Option C captures all three pillars in one statement, matching NIST SP 800-207 and industry frameworks like Google BeyondCorp. These principles apply equally to users, devices, and workloads in cloud-native environments.

Answer

Grant cluster-admin privileges to all operations engineers

Answer

Disable all encryption for internal microservice communication to improve speed

Answer

Trust all traffic originating from inside the corporate virtual private cloud (VPC)

Question 12

An administrator notices that unauthorized users can view sensitive ConfigMaps across different namespaces because default RoleBindings were overly permissive. Which security principle was violated?

Accepted Answer

Least privilege access. Overly permissive default RoleBindings that allow unauthorized users to view ConfigMaps across namespaces violate the principle of least privilege. Least privilege requires granting only the minimum permissions necessary for a user or service to perform its function. Default RoleBindings that grant broad read access to ConfigMaps across namespaces exceed that minimum and expose sensitive configuration data.

Answer

Shared responsibility model

Answer

Immutable infrastructure

Answer

Supply chain security

Question 13

Which TWO of the following are primary components of the 4Cs of Cloud Native Security model? (Choose TWO)

Accepted Answer

Container. The 4Cs of Cloud Native Security model defines four layers of defense: Cloud, Cluster, Container, and Code, so option A (Container) is correct because the container layer covers securing the container image, its runtime, and its contents. Option D (Code) is also correct because the code layer is the innermost layer, focusing on securing application source code, dependencies, and CI/CD pipelines. The remaining options do not belong: Client (B) is not one of the 4Cs, Crypto (C) is a security mechanism rather than a layer in this model, and Compliance (E) is a governance concern, not a named component of the 4Cs.

Answer

Client

Answer

Crypto

Answer

Compliance

Question 14

A security engineer is reviewing the security posture of an enterprise Kubernetes deployment. They note that developers push container images directly to a private registry without vulnerability scanning. Which of the 4Cs is directly impacted by this gap?

Accepted Answer

Container layer. The Container layer is correct because the gap described — pushing images to a registry without vulnerability scanning — directly concerns the contents and integrity of container images. In the 4Cs model (Cloud, Cluster, Container, Code), the Container layer covers image provenance, image scanning, minimal base images, and runtime hardening. Unscanned images may contain known CVEs in OS packages or libraries, which is precisely a Container-layer concern.

Answer

Code layer

Answer

Cluster layer

Answer

Cloud layer

Question 15

An organization wants to prevent supply chain attacks where compromised base images are pulled from public registries. Which control directly addresses this risk in a cloud native environment?

Accepted Answer

Restricting container image pulls to approved, scanned internal registries using admission controllers. Restricting container image pulls to approved, scanned internal registries using admission controllers directly prevents compromised base images from public registries from being deployed. Admission controllers can enforce policies that reject pods referencing untrusted registries, ensuring only vetted images run in the cluster. This is a targeted supply chain control.

Answer

Implementing Kubernetes Horizontal Pod Autoscalers

Answer

Disabling all outbound internet access from cluster worker nodes

Answer

Enabling audit logging on the Kubernetes API server