KCSA Platform Security — Timed 30 Questions

Question 1

Which TWO mechanisms are commonly used by container runtime security tools to monitor container activity? (Choose two)

Accepted Answer

eBPF (Extended Berkeley Packet Filter) programs attached to kernel tracepoints. Modern container runtime security tools monitor container behavior using Linux kernel tracing mechanisms such as eBPF and kernel modules or security hooks.

Answer

Kubernetes persistent volume snapshotting

Answer

CoreDNS query log analysis

Question 2

A security engineer is configuring a seccomp profile for a critical application pod running in a hardened Kubernetes cluster to restrict system calls. The pod requires access to the networking stack but must block module loading. Where must this custom JSON seccomp profile be placed on a worker node running containerd so that it can be referenced via the pod security spec?

Accepted Answer

/var/lib/kubelet/seccomp/. Container runtime implementations like containerd look for custom seccomp profiles relative to the kubelet root directory, specifically inside the seccomp subdirectory (e.g., /var/lib/kubelet/seccomp/).

Answer

/var/log/containers/

Answer

/etc/kubernetes/manifests/

Answer

/etc/containerd/certs.d/

Question 3

When configuring a container to run securely in a Kubernetes cluster, you want to ensure that the container process cannot gain any new privileges during its lifecycle, even if it runs as root or exploits a setuid binary. Which Linux kernel feature should be enabled in the container security context?

Accepted Answer

allowPrivilegeEscalation: false. The 'allowPrivilegeEscalation' field in the security context controls whether a process can gain more privileges than its parent, which maps directly to the Linux PR_SET_NO_NEW_PRIVS kernel flag.

Answer

readOnlyRootFilesystem: false

Answer

privileged: true

Answer

runAsNonRoot: false

Question 4

You are troubleshooting a container image vulnerability scan report that flagged a high-severity CVE in a base image layer. The development team wants to ensure that vulnerable container images are automatically prevented from being deployed to any namespace in the cluster. Which Kubernetes mechanism should you implement?

Accepted Answer

Configure a validating admission webhook to inspect image metadata and reject deployments with known CVEs. An admission controller, specifically a validating webhook or a policy engine like OPA Gatekeeper or Kyverno, can intercept image creation requests and block images that fail vulnerability checks.

Answer

Enable resource quotas on the default namespace

Answer

Rotate the cluster certificate authority

Answer

Add network policies to restrict outbound CVE database queries

Question 5

Your security team has discovered that an application container image contains outdated packages with known remote code execution vulnerabilities. Which phase of the software development lifecycle is the most effective place to initially scan and remediate these vulnerabilities?

Accepted Answer

CI/CD pipeline build stage. Scanning images during the CI/CD pipeline build phase allows developers to patch or replace vulnerable packages before the image is ever pushed to a registry or deployed to production.

Answer

Node OS package manager updates

Answer

Kubelet container startup phase

Answer

Kubernetes API server audit logging

Question 6

You are configuring an Ingress resource using the NGINX Ingress Controller to expose a sensitive internal application. To prevent unauthorized clients from connecting, you want to enable mutual TLS authentication at the ingress layer. Which annotation is required in the Ingress resource definition to specify the Kubernetes Secret containing the trusted Client CA certificate?

Accepted Answer

nginx.ingress.kubernetes.io/auth-tls-secret. The NGINX ingress controller uses specific annotations such as 'nginx.ingress.kubernetes.io/auth-tls-secret' to point to the Kubernetes secret containing the CA certificate used to verify client certificates.

Answer

ingress.kubernetes.io/backend-protocol

Answer

kubernetes.io/ingress.class

Answer

nginx.ingress.kubernetes.io/ssl-redirect

Question 7

An organization requires that all container images pulled into a Kubernetes cluster are cryptographically signed and verified before execution. Which tool integrates with Kubernetes admission control to enforce signature verification using Cosign?

Accepted Answer

Kyverno policy engine. Policy engines such as Kyverno or OPA Gatekeeper integrate with Sigstore Cosign to verify container image signatures during admission control.

Answer

Cilium CNI plugin

Answer

Metrics-server

Answer

Helm package manager

Question 8

An administrator needs to enforce mTLS (Mutual TLS) across all microservices within a service mesh without modifying application code. Which component is automatically injected into each application pod to handle the encryption and decryption of traffic?

Accepted Answer

Sidecar proxy. Service meshes like Istio or Linkerd inject a sidecar proxy (typically Envoy) into application pods to intercept all incoming and outgoing traffic and handle mTLS transparently.

Answer

Container runtime shim

Answer

Kube-proxy

Answer

Ingress controller

Question 9

A platform engineer wants to configure a container runtime security tool that monitors system calls and sends alerts about potential threats in a Kubernetes cluster. Which component of the container runtime architecture intercepts these system calls?

Accepted Answer

eBPF kernel probes. The Linux kernel relies on security modules and tracing mechanisms, while the container runtime uses interfaces like seccomp or Linux Security Modules (LSM) to interact with the kernel. Container runtime monitors often use eBPF programs attached to kernel tracepoints to observe system calls without modifying the kernel.

Answer

The coreDNS plugin

Answer

The Kubernetes storage controller

Answer

The kube-apiserver admission webhook

Question 10

An auditor is reviewing container image registries used by a Kubernetes cluster. They notice that public images are pulled directly without verification. Which security best practice should be implemented for image registries?

Accepted Answer

Use private registries with integrated vulnerability scanning and image pull policies. Using private, trusted container registries with vulnerability scanning and access control helps ensure that only approved and secure images are deployed.

Answer

Grant cluster-admin permissions to all developers

Answer

Store plaintext passwords in ConfigMaps

Answer

Disable all network policies in the cluster

Question 11

A security administrator wants to prevent container processes from writing to any part of their root filesystem except for designated ephemeral volumes. Which security context field should be configured?

Accepted Answer

readOnlyRootFilesystem: true. Setting 'readOnlyRootFilesystem: true' in the container's security context makes the root filesystem read-only, enhancing security by preventing attackers from modifying binaries or writing malware.

Answer

runAsUser: 1000

Answer

allowPrivilegeEscalation: false

Answer

privileged: false

Question 12

You need to ensure that an ingress controller processing TLS termination uses strong cryptographic ciphers and disables outdated protocols such as TLSv1.0 and TLSv1.1. Where are these TLS configuration settings typically managed in an NGINX Ingress deployment?

Accepted Answer

Ingress controller ConfigMap parameters such as ssl-ciphers and ssl-protocols. NGINX Ingress Controllers allow global configuration of SSL parameters, ciphers, and protocols via ConfigMap settings or specific ingress annotations.

Answer

The core DNS configuration map

Answer

The kube-apiserver static pod manifest file

Answer

Persistent Volume Claim storage classes

Question 13

A platform engineer is hardening a container runtime setup on worker nodes. They want to ensure that containers cannot make unauthorized changes to network configurations or mount host filesystems. Which capability must be explicitly dropped from the default container capabilities set?

Accepted Answer

CAP_SYS_ADMIN. The 'CAP_SYS_ADMIN' capability grants a broad range of administrative privileges, including mounting filesystems and modifying kernel parameters, and should be dropped in hardened environments.

Answer

CAP_CHOWN

Answer

CAP_NET_BIND_SERVICE

Answer

CAP_DAC_OVERRIDE

Question 14

An administrator needs to restrict a container from accessing any devices on the host system via device nodes. By default, how does Docker or containerd handle device access for containers when no custom security profile is applied?

Accepted Answer

By applying a default device allowlist that restricts access to essential devices like /dev/null and /dev/random. Container runtimes like containerd and Docker apply a default set of cgroups and device rules that restrict access, but can be further locked down using device plugins or cgroup rules.

Answer

By disabling all system calls related to file I/O

Answer

By routing all device access requests through kube-proxy

Answer

By mounting the entire host /dev directory in read-write mode

Question 15

Your team is implementing image caching and proxying to protect against external container registry rate limits and security incidents. Which upstream project acts as a CNCF-compliant registry proxy and caching mechanism?

Accepted Answer

Harbor. Harbor is an open-source, CNCF-graded cloud-native registry that stores, signs, and scans content with vulnerability management and proxy caching features.

Answer

Fluentd

Answer

Jaeger

Answer

Prometheus

Question 16

An enterprise Kubernetes cluster uses a service mesh with strict authorization policies configured. A developer complains that their frontend service cannot communicate with the backend database service. Upon inspecting the mesh configuration, you notice a PeerAuthentication resource set to STRICT mode. What does this setting enforce?

Accepted Answer

All incoming traffic to the targeted workloads must use mutual TLS encryption. In a service mesh like Istio, setting PeerAuthentication to STRICT mode requires all incoming traffic to workloads in that scope to use mutual TLS (mTLS).

Answer

Pod security standards must be enforced at the baseline level

Answer

Network policies must block all traffic from outside the namespace

Answer

All external ingress traffic must pass through a Web Application Firewall

Question 17

What is the primary security benefit of implementing Ingress TLS termination at the ingress controller rather than inside the application pods?

Accepted Answer

Centralized certificate management and reduced cryptographic overhead on application pods. Terminating TLS at the ingress controller centralizes certificate management and offloads cryptographic overhead from the backend application pods.

Answer

Automatically encrypting persistent volume storage

Answer

Preventing the container runtime from executing untrusted binaries

Answer

Ensuring that all pod-to-pod communication is blocked

Question 18

What role does image scanning play in a shift-left security strategy for platform security?

Accepted Answer

Detecting vulnerabilities and misconfigurations in container images during development and CI/CD. Shift-left security moves security checks earlier in the development lifecycle, allowing teams to identify and fix image vulnerabilities before deployment.

Answer

Automatically encrypting secrets stored in etcd

Answer

Generating TLS certificates for ingress controllers

Answer

Enforcing role-based access control policies

Question 19

A security engineer wants to inspect container runtime logs for potential security violations or runtime errors. Which log file or mechanism on a worker node managed by systemd and containerd provides container lifecycle events?

Accepted Answer

journalctl -u containerd. In Kubernetes nodes managed by systemd, containerd logs its activities and container lifecycle events to the systemd journal, which can be queried using journalctl.

Answer

kubectl get events --all-namespaces

Answer

/var/log/coredns.log

Answer

/var/log/kube-apiserver.log

Question 20

Why is running containers as the root user discouraged in Kubernetes platform security best practices?

Accepted Answer

It increases the impact of potential container breakout or compromise by granting root privileges inside the container. Running as root inside a container means that if an attacker achieves container escape or remote code execution, they may have elevated privileges on the host or inside the container namespace.

Answer

It prevents the kubelet from starting the pod

Answer

It disables network policy enforcement

Answer

It stops container image vulnerability scanning