KCSA Platform Security Practice Test 2 — 15 Questions

Question 1

An enterprise Kubernetes cluster uses a service mesh with strict authorization policies configured. A developer complains that their frontend service cannot communicate with the backend database service. Upon inspecting the mesh configuration, you notice a PeerAuthentication resource set to STRICT mode. What does this setting enforce?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

All incoming traffic to the targeted workloads must use mutual TLS encryption. In a service mesh like Istio, setting PeerAuthentication to STRICT mode requires all incoming traffic to workloads in that scope to use mutual TLS (mTLS).

Answer

Pod security standards must be enforced at the baseline level

Answer

Network policies must block all traffic from outside the namespace

Answer

All external ingress traffic must pass through a Web Application Firewall

Question 2

What is the primary security benefit of implementing Ingress TLS termination at the ingress controller rather than inside the application pods?

Accepted Answer

Centralized certificate management and reduced cryptographic overhead on application pods. Terminating TLS at the ingress controller centralizes certificate management and offloads cryptographic overhead from the backend application pods.

Answer

Automatically encrypting persistent volume storage

Answer

Preventing the container runtime from executing untrusted binaries

Answer

Ensuring that all pod-to-pod communication is blocked

Question 3

What role does image scanning play in a shift-left security strategy for platform security?

Accepted Answer

Detecting vulnerabilities and misconfigurations in container images during development and CI/CD. Shift-left security moves security checks earlier in the development lifecycle, allowing teams to identify and fix image vulnerabilities before deployment.

Answer

Automatically encrypting secrets stored in etcd

Answer

Generating TLS certificates for ingress controllers

Answer

Enforcing role-based access control policies

Question 4

A security engineer wants to inspect container runtime logs for potential security violations or runtime errors. Which log file or mechanism on a worker node managed by systemd and containerd provides container lifecycle events?

Accepted Answer

journalctl -u containerd. In Kubernetes nodes managed by systemd, containerd logs its activities and container lifecycle events to the systemd journal, which can be queried using journalctl.

Answer

kubectl get events --all-namespaces

Answer

/var/log/coredns.log

Answer

/var/log/kube-apiserver.log

Question 5

Why is running containers as the root user discouraged in Kubernetes platform security best practices?

Accepted Answer

It increases the impact of potential container breakout or compromise by granting root privileges inside the container. Running as root inside a container means that if an attacker achieves container escape or remote code execution, they may have elevated privileges on the host or inside the container namespace.

Answer

It prevents the kubelet from starting the pod

Answer

It disables network policy enforcement

Answer

It stops container image vulnerability scanning

Question 6

An administrator needs to configure an Ingress resource to route traffic securely to a backend service using HTTPS (TLS between the ingress controller and the backend pod). Which NGINX Ingress annotation enables this backend HTTPS communication?

Accepted Answer

nginx.ingress.kubernetes.io/backend-protocol: "HTTPS". The NGINX Ingress controller supports annotations like 'nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"' to instruct the proxy to communicate with backend pods over HTTPS.

Answer

nginx.ingress.kubernetes.io/ssl-redirect: "true"

Answer

nginx.ingress.kubernetes.io/proxy-connect-timeout

Answer

nginx.ingress.kubernetes.io/cors-allow-origin

Question 7

You are troubleshooting a service mesh traffic split policy where telemetry shows that unauthorized external clients are bypassing the service mesh ingress gateway and directly accessing backend services via NodePort services. Which Kubernetes feature should you configure to prevent direct NodePort access to these sensitive pods?

Accepted Answer

NetworkPolicies restricting pod ingress traffic exclusively to the service mesh gateway pod selector. Kubernetes NetworkPolicies can be configured to restrict incoming traffic to backend pods so that they only accept connections originating from the ingress gateway pod selectors, blocking direct NodePort access.

Answer

Enabling anonymous authentication in kube-apiserver

Answer

Changing the service type from NodePort to ClusterIP

Answer

Increasing the API server request rate limit

Question 8

A security engineer is hardening a Kubernetes cluster and wants to ensure that all container images are pulled only from an approved internal container registry (e.g., registry.internal.corp). Which Kubernetes mechanism can enforce this restriction across all namespaces?

Accepted Answer

Deploying a validating admission policy or webhook to check image registry URLs. Admission webhook policy engines like Kyverno or OPA Gatekeeper can intercept creation requests and validate that the image URL matches the approved registry domain prefix.

Answer

Configuring NodePort service selectors

Answer

Enabling horizontal pod autoscaling

Answer

Modifying the kube-proxy IPVS configuration

Question 9

You are configuring a runtime security agent that uses Falco to detect unexpected shell execution inside containers. The security rule triggers when a process spawns a shell binary (e.g., bash or sh) inside a container namespace. Which underlying Linux kernel mechanism allows Falco to detect this event with minimal overhead?

Accepted Answer

eBPF system call tracing and kernel event capture. Falco uses kernel modules or eBPF probe drivers to capture system calls and event streams from the Linux kernel, matching them against a rules engine to detect anomalous behavior.

Answer

Periodic polling of container logs using kubectl logs

Answer

Analyzing CoreDNS lookup history

Answer

Inspecting etcd database keys every second

Question 10

An enterprise cluster utilizes a service mesh with AuthorizationPolicies. You need to configure a policy that allows GET requests from service A to service B while explicitly denying DELETE requests on all paths. How are Istio AuthorizationPolicies evaluated when both allow and deny rules are present?

Accepted Answer

DENY rules take precedence and are evaluated before ALLOW rules. Istio AuthorizationPolicies evaluate DENY rules first, followed by ALLOW rules. If a request matches a DENY rule, it is immediately rejected regardless of any matching ALLOW rules.

Answer

Only the most recently created authorization policy is evaluated

Answer

ALLOW rules take precedence and override any DENY rules

Answer

Rules are evaluated in alphabetical order of their object names

Question 11

You are configuring an Ingress object with TLS termination. The TLS certificate and private key are stored in a Kubernetes Secret. Which specific secret type must be used to ensure the ingress controller recognizes and validates the TLS credentials correctly?

Accepted Answer

kubernetes.io/tls. Kubernetes expects TLS-related secrets used by Ingress or other components to be of type 'kubernetes.io/tls', containing 'tls.crt' and 'tls.key' data keys.

Answer

kubernetes.io/service-account-token

Answer

Opaque

Answer

kubernetes.io/dockerconfigjson

Question 12

What is the primary function of a container runtime interface (CRI) security boundary in Kubernetes?

Accepted Answer

To separate the management of container lifecycles from the kubelet while maintaining isolation. The CRI acts as the interface between the kubelet and the container runtime (such as containerd or CRI-O), ensuring that container isolation and execution are managed securely.

Answer

To provision persistent block storage volumes

Answer

To manage DNS lookups across cluster namespaces

Answer

To encrypt all secrets stored within Kubernetes Secrets objects

Question 13

Why should container images be built using multi-stage builds in Dockerfiles from a security perspective?

Accepted Answer

They exclude build-time tools, package managers, and source code from the final production image, reducing attack surface. Multi-stage builds allow developers to copy only the compiled binary and essential runtime dependencies into the final image, excluding build tools, package managers, and source code.

Answer

They encrypt the container image layer storage in the registry

Answer

They automatically enable kernel-level eBPF monitoring

Answer

They enforce mTLS encryption for all container network traffic

Question 14

You are reviewing a security alert indicating that a container running in your Kubernetes cluster attempted to modify host kernel parameters via /proc/sys. Which security configuration was likely missing or misconfigured for this container?

Accepted Answer

The container was run in privileged mode or lacked necessary capability and filesystem hardening. Containers must have their capabilities dropped (such as CAP_SYS_ADMIN) and should not run in privileged mode or with writable sysfs/procfs to prevent kernel parameter tampering.

Answer

The CoreDNS deployment had too few replicas

Answer

The Ingress controller did not enable TLS termination

Answer

The PersistentVolumeClaim lacked a storage class

Question 15

An administrator wants to ensure that containers cannot execute any system calls related to module loading or debugging, such as 'init_module' or 'kexec_load'. Which security mechanism in Kubernetes allows applying a predefined system call filter to containers?

Accepted Answer

Seccomp profiles. Seccomp (Secure Computing Mode) filters system calls made by a container, allowing administrators to block dangerous calls like module loading.

Answer

Pod Disruption Budgets

Answer

Kubernetes NetworkPolicies

Answer

ResourceQuotas