KCSA Timed Practice Test 1 — 10 Questions

Question 1

You are troubleshooting a container image vulnerability scan report that flagged a high-severity CVE in a base image layer. The development team wants to ensure that vulnerable container images are automatically prevented from being deployed to any namespace in the cluster. Which Kubernetes mechanism should you implement?

10 minute time limit — choose an answer to begin.

Accepted Answer

Configure a validating admission webhook to inspect image metadata and reject deployments with known CVEs. A validating admission webhook intercepts pod creation requests before they are persisted to etcd and can inspect image metadata (via registries or scanning tools) to reject deployments containing known CVEs. This enforces policy at the cluster level across all namespaces, preventing vulnerable images from ever running.

Answer

Enable resource quotas on the default namespace

Answer

Rotate the cluster certificate authority

Answer

Add network policies to restrict outbound CVE database queries

Question 2

Under NIST guidelines for continuous monitoring in cloud-native environments, which Kubernetes mechanism allows operators to enforce cryptographic integrity of container images at runtime?

Accepted Answer

Image signing and verification via admission controllers. Admission controllers in Kubernetes can intercept pod creation requests and validate that container images are signed by trusted authorities before allowing them to run. By integrating image signing (e.g., Cosign/Notary) with an admission controller (e.g., OPA Gatekeeper, Kyverno, or the Sigstore policy controller), operators enforce cryptographic integrity at runtime admission. This directly satisfies NIST continuous monitoring guidance for verifying artifact integrity in cloud-native environments.

Answer

Increasing pod memory limits

Answer

Disabling the default namespace

Answer

Using ClusterRoleBindings with wildcards

Question 3

Which THREE mechanisms are used in a zero-trust platform security model for cloud-native applications? (Choose three)

Accepted Answer

Implementing microsegmentation via Kubernetes NetworkPolicies and service mesh auth policies. Option B is correct because zero-trust requires microsegmentation, and Kubernetes NetworkPolicies restrict pod-to-pod traffic at L3/L4 while service mesh authorization policies (e.g., Istio AuthorizationPolicy) enforce identity-based L7 access controls between workloads. Option C is correct because enforcing mutual TLS for all internal service-to-service communications cryptographically verifies both client and server identities, eliminating implicit trust based on network location. Option D is correct because admission webhooks (ValidatingAdmissionWebhook) intercept API server requests before object persistence, allowing policies to reject non-compliant workloads and enforce security baselines at creation time. Option A is incorrect because granting cluster-admin to all service accounts violates least privilege and massively expands the blast radius, the opposite of zero-trust. Option E is incorrect because assuming the internal network is secure and trusting all pods by default is the classic perimeter-trust model that zero-trust explicitly rejects.

Answer

Granting cluster-admin permissions to all application service accounts

Answer

Assuming internal cluster networks are fully secure and trusting all pods by default

Question 4

An administrator wishes to defend against supply chain attacks involving malicious third-party Kubernetes operators installed from public catalogs. What security practice is most effective before installing such operators?

Accepted Answer

Reviewing requested RBAC permissions, operator manifests, and verifying image provenance. Before installing third-party operators, the most effective practice is to review the requested RBAC permissions, inspect the operator manifests for suspicious resources, and verify image provenance (e.g., signatures, trusted registries). This due diligence helps detect malicious intent, such as excessive privileges or backdoors, before the operator is deployed.

Answer

Enabling Horizontal Pod Autoscaling for CoreDNS replicas

Answer

Disabling the Kubernetes Dashboard service deployment

Answer

Configuring liveness probes on all worker nodes to check kubelet responsiveness

Question 5

Which TWO of the following principles are core tenets of cloud native security?

Accepted Answer

Shift-left security, integrating security checks early into the development and CI/CD pipeline.. Option A is correct because shift-left security is a foundational cloud native principle: security checks (SAST, SCA, container image scanning, IaC validation) are integrated early into development and the CI/CD pipeline so vulnerabilities are caught before deployment rather than after. Option D is correct because defense-in-depth is a core tenet of cloud native security, layering overlapping controls across the 4Cs (Cloud, Cluster, Container, Code) so that no single control failure compromises the workload. Option B is wrong because hardcoding administrative credentials in source code violates secrets management and least-privilege practices, creating a critical vulnerability rather than a security principle. Option C is wrong because implicit trust between microservices is an anti-pattern; cloud native security requires zero-trust, mutual authentication (e.g., mTLS) and explicit authorization between services. Option E is wrong because perimeter-only defense assumes a hard outer shell with a soft interior, which fails against lateral movement, insider threats, and compromised workloads in dynamic cloud environments.

Answer

Hardcoding administrative credentials directly into source code for operational simplicity.

Answer

Implicit trust of internal microservices communicating within the same cluster network.

Answer

Perimeter-only defense, relying exclusively on an external corporate firewall.

Question 6

An application pod needs to mount a Secret as environment variables. Which section of the Pod manifest should be configured to achieve this securely?

Accepted Answer

Using 'env' with 'valueFrom.secretKeyRef' or 'envFrom' with 'secretRef' in the container specification.. To expose a Secret as environment variables, you reference it in the container's env or envFrom block using valueFrom.secretKeyRef (for a single key) or envFrom.secretRef (for all keys). This is the standard, supported mechanism for injecting Secret data as environment variables in a Pod manifest.

Answer

Using 'volumeMounts' pointing to a PersistentVolumeClaim bound to the Secret.

Answer

Adding the Secret name directly to the container imagePullSecrets field.

Answer

Declaring the Secret in the container securityContext block.

Question 7

An organization requires compliance auditing of etcd access to ensure unauthorized clients cannot communicate with the data store. According to CIS benchmarks, how should etcd client communication be secured?

Accepted Answer

Mutual TLS (mTLS) client certificates. CIS Kubernetes Benchmark requires that etcd client communication be encrypted and mutually authenticated. Mutual TLS (mTLS) ensures both the client and the etcd server present certificates signed by a trusted CA, preventing unauthorized clients from connecting. This is enforced via flags like --cert-file, --key-file, --client-cert-auth, and --trusted-ca-file on the etcd server.

Answer

IPsec tunnel encapsulation

Answer

HTTP with token bearer headers

Answer

Plaintext loopback interface binding

Question 8

Which TWO of the following files or directories on a control plane node contain critical static pod manifests for core components? (Choose TWO)

Accepted Answer

/etc/kubernetes/manifests/etcd.yaml. Option A is correct because /etc/kubernetes/manifests/etcd.yaml is the static pod manifest that the kubelet on a control plane node watches and instantiates to run the etcd datastore as a static pod. Option E is correct because /etc/kubernetes/manifests/kube-apiserver.yaml is likewise a static pod manifest in the kubelet's configured staticPodPath, used to launch the kube-apiserver as a static pod. Option B is incorrect because /var/lib/kubelet/config.yaml is the kubelet's own configuration file (KubeletConfiguration), not a pod manifest. Option C is incorrect because /etc/default/kube-proxy is a service environment/defaults file for kube-proxy, not a static pod manifest. Option D is incorrect because ~/.kube/config is the client kubeconfig file used by kubectl to authenticate to the cluster, not a static pod manifest.

Answer

/var/lib/kubelet/config.yaml

Answer

/etc/default/kube-proxy

Answer

~/.kube/config

Question 9

An administrator needs to configure an Ingress resource to route traffic securely to a backend service using HTTPS (TLS between the ingress controller and the backend pod). Which NGINX Ingress annotation enables this backend HTTPS communication?

Accepted Answer

nginx.ingress.kubernetes.io/backend-protocol: "HTTPS". The annotation nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" tells the NGINX Ingress Controller to speak HTTPS when connecting to the backend service, enabling TLS between the controller and the pod. This is the standard way to terminate TLS at the ingress and re-encrypt to the backend, satisfying end-to-end encryption requirements. Without this annotation, NGINX defaults to HTTP for backend connections even if the Service port is named 'https'.

Answer

nginx.ingress.kubernetes.io/ssl-redirect: "true"

Answer

nginx.ingress.kubernetes.io/proxy-connect-timeout

Answer

nginx.ingress.kubernetes.io/cors-allow-origin

Question 10

A DevOps team is building container images using Dockerfiles. They decide to use official minimal distroless base images instead of standard Ubuntu images containing package managers and shell utilities. Which security benefit does this provide?

Accepted Answer

It reduces the container attack surface by removing unused binaries and shells. Distroless images contain only the application and its runtime dependencies — no package manager, no shell, no standard Linux utilities. Removing these components eliminates entire classes of attack vectors such as shell injection, package-manager abuse, and exploitation of unpatched utilities like bash or curl. This directly reduces the container attack surface, which is exactly what option A states.

Answer

It encrypts the container image layers at rest in the registry

Answer

It automatically configures cloud IAM roles for the container

Answer

It guarantees zero vulnerabilities in application code dependencies