KCSA Overview OF Cloud Native Security Practice Test 3 — 15 Questions

Question 1

In a cloud native environment, what is the primary security purpose of using static code analysis (SAST) and software composition analysis (SCA) tools in the CI/CD pipeline?

Accepted Answer

To identify vulnerabilities and insecure coding patterns in the Code layer before deployment. SAST and SCA tools detect security flaws and vulnerable dependencies in source code and libraries before building artifacts.

Answer

To provision cloud networking security groups automatically

Answer

To manage worker node operating system updates

Answer

To detect running process anomalies in production pods

Question 2

Under the cloud native shared responsibility model for a managed Kubernetes service, which TWO tasks are typically the responsibility of the cloud provider? (Choose TWO)

Accepted Answer

Provisioning and securing physical data center facilities and hardware. Cloud providers manage physical infrastructure and the control plane components in managed Kubernetes offerings.

Answer

Writing custom application microservice source code

Answer

Configuring Kubernetes Role-Based Access Control (RBAC) rules

Answer

Applying Kubernetes NetworkPolicies between customer pods

Question 3

Which TWO layers complete the remaining set of the 4Cs of Cloud Native Security model alongside Code and Container? (Choose TWO)

Accepted Answer

Cloud. The four layers of the 4Cs are Code, Container, Cluster, and Cloud.

Answer

Cache

Answer

Compiler

Answer

Containerd

Question 4

Which TWO of the following practices are core principles of cloud native security? (Choose TWO)

Accepted Answer

Defense-in-depth across multiple architectural layers. Key cloud native security principles include defense-in-depth and the principle of least privilege.

Answer

Complete reliance on a static network perimeter firewall

Answer

Static, long-lived infrastructure that is never replaced

Answer

Sharing administrative credentials among all team members

Question 5

An enterprise is conducting a security review of their container build and deployment pipeline. Which TWO security controls should they implement to secure the Container layer? (Choose TWO)

Accepted Answer

Scanning container images for known CVEs before deployment. Container layer security involves vulnerability scanning of images and enforcing container runtime isolation standards.

Answer

Writing application unit tests in Python or Go

Answer

Procuring dedicated physical server racks from the cloud provider

Answer

Writing Terraform scripts to provision AWS VPCs

Question 6

Which THREE of the following are characteristics of Zero Trust security models in cloud-native environments? (Choose THREE)

Accepted Answer

Explicitly verifying identity and context for every access request. Zero Trust relies on explicit verification, least privilege, and assuming breach rather than trusting internal networks implicitly.

Answer

Relying entirely on network firewalls at the cloud perimeter

Answer

Implicit trust for all traffic originating inside the internal corporate network

Question 7

Which THREE of the following activities fall under the customer's responsibility in the shared responsibility model when running Kubernetes on cloud infrastructure? (Choose THREE)

Accepted Answer

Patching and updating the worker node operating system kernel. Customers are responsible for worker node configuration, cluster security patching, workload management, and IAM policies.

Answer

Physical security and environmental controls of the cloud provider data center

Answer

Managing the underlying physical hypervisors hosting virtual machines

Question 8

An organization is hardening their Kubernetes cluster configuration to secure the Cluster layer. Which THREE configurations or practices should they implement? (Choose THREE)

Accepted Answer

Disabling anonymous requests to the Kubernetes API server. Cluster layer security involves API server authentication/authorization, restricting anonymous requests, and securing worker node configurations.

Answer

Using public distroless base images for Dockerfiles

Answer

Writing unit tests for JavaScript frontend applications

Question 9

Which THREE of the following represent security risks or anti-patterns in cloud native application design? (Choose THREE)

Accepted Answer

Exposing the Kubernetes dashboard or debug endpoints publicly without authentication. Running containers as root, storing unencrypted secrets, and exposing dashboard endpoints without auth are major security anti-patterns.

Answer

Implementing automated vulnerability scanning in CI/CD pipelines

Answer

Using immutable infrastructure principles for cluster worker nodes

Question 10

When designing a defense-in-depth strategy across the 4Cs, which THREE independent security controls can be applied at different layers? (Choose THREE)

Accepted Answer

Container image signing with Cosign and admission verification for Container. Defense-in-depth spans multiple layers: SAST/SCA for Code, image signing for Container, and NetworkPolicies for Cluster.

Answer

Relying solely on the cloud provider's default network security group for all protection

Answer

Granting all developers cluster-admin permissions for operational speed

Question 11

Which THREE of the following statements regarding cloud native security principles are correct? (Choose THREE)

Accepted Answer

Security policies should be codified, automated, and enforced throughout the software lifecycle. Cloud native security emphasizes automation, ephemeral workloads, and treating infrastructure as code.

Answer

Developers should have unrestricted administrative access to production clusters for debugging

Answer

Traditional perimeter firewalls are sufficient to secure modern multi-tenant cloud-native clusters

Question 12

An organization is adopting Kubernetes and wants to understand where their responsibility lies under the shared responsibility model. According to the 4Cs of Cloud Native Security, who is primarily responsible for configuring the RBAC rules and network policies within the Kubernetes control plane and worker nodes?

Accepted Answer

The user (cluster administrator). In the shared responsibility model for cloud-native, the cloud provider manages the underlying infrastructure (Cloud), but the user is responsible for the Cluster, Container, and Code layers. Configuring RBAC and network policies falls directly under Cluster security, which is the user's responsibility.

Answer

The cloud service provider

Answer

The application development team

Answer

The container runtime vendor

Question 13

An auditor is assessing an organization's cloud-native supply chain security posture. Which THREE controls should be in place to ensure artifact integrity and safety across the Code and Container layers? (Choose THREE)

Accepted Answer

Using automated dependency scanners (SCA) to identify vulnerable libraries in source code. Supply chain security involves software bill of materials (SBOMs), vulnerability scanning, and cryptographic image signing.

Answer

Granting root SSH access to all developers on production worker nodes

Answer

Manually configuring physical server rack layouts in the data center

Question 14

An administrator is auditing a managed Kubernetes service (such as Amazon EKS, Google GKE, or Azure AKS) to verify compliance with cloud native security principles. The administrator attempts to SSH directly into the underlying worker node to inspect system logs. The connection is refused. Why is this restriction expected under the cloud native security model?

Accepted Answer

The cloud provider abstracts and manages the underlying Cloud layer, prohibiting direct node access to maintain infrastructure integrity.. In managed Kubernetes offerings, the cloud provider manages the underlying virtual machines and restricts direct SSH access to ensure immutable infrastructure and proper separation of responsibilities in the Cloud layer.

Answer

The kubelet has been disabled by the cloud provider for security compliance.

Answer

Container runtime security policies have blocked the SSH daemon process.

Answer

NetworkPolicies applied to the kube-system namespace have dropped incoming port 22 traffic.

Question 15

A security engineer is designing a defense-in-depth strategy for a cloud native application deployment. Which of the following best exemplifies the 'defense-in-depth' principle across the 4Cs layers?

Accepted Answer

Implementing security controls at every layer from Code to Cloud so that a compromise at one layer does not result in total system failure.. Defense-in-depth relies on multiple layers of security so that if one layer fails, subsequent layers provide protection (e.g., secure code, hardened container images, RBAC-secured clusters, and encrypted cloud storage).

Answer

Granting cluster-admin permissions to all developers to ensure rapid troubleshooting.

Answer

Disabling authentication mechanisms to reduce operational overhead.

Answer

Applying strong firewall rules only at the perimeter of the corporate network.