KCSA Overview OF Cloud Native Security Practice Test 2 — 15 Questions

Question 1

A security team implements mutual TLS (mTLS) between all microservices using Istio Service Mesh. Which principle of cloud native security does this implementation primarily exemplify?

Accepted Answer

Zero-trust network segmentation and encryption in transit. Encrypting data in transit between microservices implements zero-trust networking and defense-in-depth principles within the cluster.

Answer

Perimeter-based network defense

Answer

Shared fate computing

Answer

Physical host isolation

Question 2

A security analyst reviews an incident where an attacker compromised a container running with the `CAP_SYS_ADMIN` capability and subsequently escaped to the host node. Which cloud native security principle was violated during the initial pod configuration?

Accepted Answer

Principle of least privilege. Granting unnecessary capabilities like `CAP_SYS_ADMIN` violates the principle of least privilege.

Answer

Zero-trust network architecture

Answer

Shared responsibility model

Answer

Ephemeral infrastructure design

Question 3

According to the shared responsibility model for a cloud-managed Kubernetes service, who is responsible for managing application data encryption keys (using KMS) and application-level secrets?

Accepted Answer

The customer. Application secrets and encryption keys managed via KMS for application payloads are the customer's responsibility.

Answer

The cloud provider

Answer

The Linux Foundation

Answer

The container runtime vendor

Question 4

An enterprise security policy states that all infrastructure must be defined as code (IaC) and scanned for security misconfigurations before deployment. Which part of the cloud native security lifecycle does this control target?

Accepted Answer

Pre-deployment configuration and policy-as-code validation. Scanning IaC templates (Terraform, CloudFormation, Kubernetes manifests) before deployment is part of the Build/Code phase of security.

Answer

Kernel patch management

Answer

Physical data center security

Answer

Runtime security monitoring

Question 5

A DevOps team is building container images using Dockerfiles. They decide to use official minimal distroless base images instead of standard Ubuntu images containing package managers and shell utilities. Which security benefit does this provide?

Accepted Answer

It reduces the container attack surface by removing unused binaries and shells. Distroless images reduce the attack surface by excluding unnecessary binaries, package managers, and shells.

Answer

It encrypts the container image layers at rest in the registry

Answer

It automatically configures cloud IAM roles for the container

Answer

It guarantees zero vulnerabilities in application code dependencies

Question 6

An organization's security team mandates that all Kubernetes worker nodes must be scanned for Common Vulnerabilities and Exposures (CVEs) on a scheduled basis. Under the 4Cs, what layer does node vulnerability scanning address?

Accepted Answer

Cluster layer. Scanning worker node operating systems for CVEs targets the Cluster layer.

Answer

Container layer

Answer

Cloud layer

Answer

Code layer

Question 7

When discussing cloud native security, what does 'ephemeral infrastructure' refer to, and why is it beneficial for security?

Accepted Answer

Short-lived workloads and nodes that are frequently destroyed and recreated, reducing an attacker's persistence window. Ephemeral infrastructure means workloads and nodes are short-lived and frequently replaced, limiting the persistence window for attackers.

Answer

Network connections that automatically drop after one second

Answer

Virtual machines stored in volatile RAM without disk storage

Answer

Infrastructure that is permanent and never updated to prevent downtime

Question 8

A security architect is designing a multi-tenant Kubernetes platform. They need to ensure that a compromise in one tenant's namespace cannot allow packet sniffing or unauthorized traffic interception from another tenant's pods. Which Kubernetes feature should they implement to satisfy cloud native network isolation principles?

Accepted Answer

Kubernetes NetworkPolicies. Kubernetes NetworkPolicies enforce Layer 3/4 network segmentation between pods and namespaces.

Answer

Kubernetes RBAC RoleBindings

Answer

ResourceQuotas

Answer

PodSecurityStandards

Question 9

Which of the following is a core tenet of Zero Trust architecture in cloud native environments?

Accepted Answer

Verify explicitly, use least privilege access, and assume breach. Zero Trust mandates continuous verification of identity and device health for every access request, never trusting implicitly based on network location.

Answer

Grant cluster-admin privileges to all operations engineers

Answer

Disable all encryption for internal microservice communication to improve speed

Answer

Trust all traffic originating from inside the corporate virtual private cloud (VPC)

Question 10

An administrator notices that unauthorized users can view sensitive ConfigMaps across different namespaces because default RoleBindings were overly permissive. Which security principle was violated?

Accepted Answer

Least privilege access. Granting broad read access across namespaces violates the principle of least privilege.

Answer

Shared responsibility model

Answer

Immutable infrastructure

Answer

Supply chain security

Question 11

An organization is performing a threat modeling exercise for a Kubernetes cluster. They identify that an attacker could exploit a vulnerability in the container runtime (e.g., containerd) to access the underlying host. Which of the 4Cs does the container runtime belong to?

Accepted Answer

Container layer. The container runtime executes containers and interfaces with the kernel, placing it in the Container layer.

Answer

Cloud layer

Answer

Cluster layer

Answer

Code layer

Question 12

Which TWO of the following are primary components of the 4Cs of Cloud Native Security model? (Choose TWO)

Accepted Answer

Container. The 4Cs of Cloud Native Security are Code, Container, Cluster, and Cloud.

Answer

Client

Answer

Crypto

Answer

Compliance

Question 13

A security engineer is reviewing the security posture of an enterprise Kubernetes deployment. They note that developers push container images directly to a private registry without vulnerability scanning. Which of the 4Cs is directly impacted by this gap?

Accepted Answer

Container layer. Unscanned container images introduce vulnerabilities into the Container layer.

Answer

Code layer

Answer

Cluster layer

Answer

Cloud layer

Question 14

An organization wants to prevent supply chain attacks where compromised base images are pulled from public registries. Which control directly addresses this risk in a cloud native environment?

Accepted Answer

Restricting container image pulls to approved, scanned internal registries using admission controllers. Enforcing trusted registry sources and using verified base images mitigates container supply chain risks.

Answer

Implementing Kubernetes Horizontal Pod Autoscalers

Answer

Disabling all outbound internet access from cluster worker nodes

Answer

Enabling audit logging on the Kubernetes API server

Question 15

An attacker gains execution inside a container and attempts to modify the container's root filesystem. The platform team has configured the deployment with `securityContext.readOnlyRootFilesystem: true`. What security mechanism does this enforce?

Accepted Answer

Filesystem immutability and prevention of unauthorized file modifications. Setting `readOnlyRootFilesystem: true` prevents write operations to the container root filesystem, mitigating unauthorized file creation or tampering.

Answer

Automatic container image re-signing

Answer

Kernel capability escalation blocking

Answer

Network isolation via NetworkPolicies