KCSA Timed Practice Test 3 — 10 Questions

Question 1

An auditor is inspecting a Kubernetes cluster for compliance with the CIS Benchmark for etcd security. Which THREE configurations must be verified for the etcd cluster? (Choose THREE)

Accepted Answer

Peer communication is encrypted using TLS certificates. CIS benchmarks for etcd focus on client certificates (mTLS), peer communication encryption, and secure file permissions.

Answer

etcd auto-compaction is permanently disabled

Answer

etcd is exposed directly on the public internet without authentication

Question 2

You are tasked with securing a Kubernetes cluster where control plane nodes are hosted in a private network segment. To prevent unauthorized access to the API server from compromised internal workloads, which mechanism restricts which service accounts can access the API server?

Accepted Answer

Strict RBAC Role and ClusterRole bindings adhering to the principle of least privilege.. Role-Based Access Control (RBAC) combined with least-privilege binding ensures service accounts only access permitted API resources.

Answer

Setting kubelet readOnlyPort to 8080.

Answer

Enabling anonymous access.

Answer

Disabling the Node authorizer.

Question 3

A security architect is designing role-based access control (RBAC) to comply with NIST access control principles of least privilege. Which THREE best practices should be followed when creating Roles and ClusterRoles? (Choose THREE)

Accepted Answer

Scrutinize and restrict the use of ClusterRoleBindings to cluster-wide resources. Least privilege requires avoiding wildcards, scoping permissions tightly, and auditing bindings.

Answer

Allow all users to read Kubernetes Secrets by default

Answer

Grant cluster-admin permissions to all application service accounts for ease of deployment

Question 4

You are reviewing security logs on a control plane node and discover that an unauthenticated user accessed the kubelet's HTTPS port (10250) to execute commands inside containers. How should you restrict kubelet authentication and authorization to prevent this?

Accepted Answer

Set authentication.anonymous.enabled: false and authorization.mode: Webhook in the kubelet configuration file.. Kubelet must be configured with authentication enabled (such as X509 client certs or webhook token auth) and authorization set to Webhook.

Answer

Enable the kubelet insecure-port flag.

Answer

Set authorization.mode: AlwaysAllow in the kubelet configuration file.

Answer

Disable the API server proxy subresource.

Question 5

An administrator needs to ensure that the Kubernetes API server does not allow insecure cipher suites during TLS handshakes. Which API server flag allows specifying the exact cipher suites permitted?

Accepted Answer

--tls-cipher-suites. The --tls-cipher-suites flag allows administrators to define an explicit array of permitted cryptographic cipher suites.

Answer

--cipher-list

Answer

--secure-ciphers

Answer

--etcd-cipher-suites

Question 6

You are performing a security review of etcd cluster membership. You need to list all active members of the etcd cluster and check their health status using the command line. Which etcdctl command is correct?

Accepted Answer

etcdctl member list and etcdctl endpoint health. etcdctl member list and etcdctl endpoint health are the standard diagnostic commands for checking etcd cluster state.

Answer

etcdctl check membership

Answer

etcdctl cluster status

Answer

kubectl get etcdmembers

Question 7

An administrator needs to evaluate an existing Kubernetes cluster against the CIS Kubernetes Benchmark. Which tool provides automated scanning specifically tailored to this benchmark?

Accepted Answer

kube-bench. Kube-bench is an open-source tool that checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes Benchmark.

Answer

kube-hunter

Answer

falco

Answer

velero

Question 8

Where are static pods for a control plane node typically defined so that the kubelet can automatically create and manage them?

Accepted Answer

In the directory specified by staticPodPath in the kubelet configuration file (default /etc/kubernetes/manifests).. Static pods are defined by manifest files placed in the directory specified by the kubelet's --pod-manifest-path flag or staticPodPath configuration setting.

Answer

In the ~/.kube/config file of the root user.

Answer

In the etcd database under the /registry/staticpods prefix.

Answer

In the kube-system namespace as standard Deployment objects.

Question 9

Which Kubernetes control plane component is responsible for noticing and responding when nodes go down or fail health checks?

Accepted Answer

kube-controller-manager. The kube-controller-manager runs node lifecycle controllers that monitor node health and update node status.

Answer

CoreDNS

Answer

etcd

Answer

kube-proxy

Question 10

Which component is responsible for executing probes (liveness, readiness, startup) against containers running on a worker node?

Accepted Answer

kubelet. The kubelet executes liveness, readiness, and startup probes directly for containers on its node.

Answer

kube-scheduler

Answer

kube-controller-manager

Answer

kube-apiserver