20+ practice questions focused on Compliance And Security Frameworks — one of the most tested topics on the Kubernetes and Cloud Native Security Associate (KCSA, CNCF) (KCSA) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Compliance And Security Frameworks PracticeA security engineer is reviewing the NIST SP 800-190 container security application and needs to identify the primary control category for securing container image registries. Under NIST guidelines, which layer is primarily responsible for verifying the integrity of images before deployment?
Explanation: NIST SP 800-190 defines the container security lifecycle in layers, and the registry layer is explicitly responsible for image integrity verification, signing, and vulnerability scanning before deployment. The registry acts as the trusted source of truth, and controls like content trust (Notary), image signing (Cosign), and admission controllers that verify signatures are all registry-layer concerns. This is why 'Registry security' is the correct primary control category for verifying image integrity.
To comply with CIS benchmarks regarding pod security, an administrator wants to prevent containers from running with root privileges. Which field in a Pod Security Standard (restricted profile) enforces this?
Explanation: In the Kubernetes Pod Security Standards restricted profile, runAsNonRoot: true is the field that enforces containers cannot run as UID 0 (root). The restricted profile requires this at the pod or container securityContext level, and the kubelet will refuse to start the container if the image's USER is root or unset. This directly satisfies CIS Benchmark controls (e.g., 5.2.6) that prohibit root containers.
An auditor is reviewing compliance with CIS Kubernetes Benchmark control 1.2.20, which relates to the kube-apiserver admission control configuration. Which admission plugin is recommended by CIS to prevent default service accounts from automatically mounting API credentials?
Explanation: The ServiceAccount admission controller, along with disabling automatic token mounting via serviceAccountName/automountServiceAccountToken, is governed by admission plugins. Specifically, NamespaceLifecycle and PodNodeSecurity are relevant, but for service account automation management, the ServiceAccount admission controller governs default behavior.
An administrator is reviewing the CIS Kubernetes Benchmark for node security. Which TWO of the following settings are explicitly recommended by CIS to secure kubelet configurations? (Choose TWO)
Explanation: CIS benchmarks recommend ensuring authorization mode is webhook and disabling anonymous authentication on the kubelet.
A platform team is preparing for a SOC 2 Type II audit of their Kubernetes-based SaaS. The auditor asks how they ensure that container workloads cannot run with excessive privileges that would violate the principle of least privilege. The team already enforces Pod Security Standards at the namespace level. Which additional Kubernetes-native mechanism should they implement to satisfy the auditor's requirement for defense in depth?
Explanation: An admission controller like OPA Gatekeeper enforces policies at pod creation time, ensuring that containers cannot request privilege escalation. This provides a preventive, auditable control that complements Pod Security Standards. The other options address node authorization, API access, or network traffic, none of which directly limit container process privileges. For SOC 2, evidence of enforced least privilege at the workload level is required.
+15 more Compliance And Security Frameworks questions available
Practice all Compliance And Security Frameworks questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Compliance And Security Frameworks. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Compliance And Security Frameworks questions on the KCSA frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Compliance And Security Frameworks is tested as part of the Kubernetes and Cloud Native Security Associate (KCSA, CNCF) (KCSA) blueprint. Practicing with targeted Compliance And Security Frameworks questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free KCSA practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Compliance And Security Frameworks is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Compliance And Security Frameworks practice session with instant scoring and detailed explanations.
Start Compliance And Security Frameworks Practice →