20+ practice questions focused on Kubernetes Security Fundamentals — one of the most tested topics on the Kubernetes and Cloud Native Security Associate (KCSA, CNCF) (KCSA) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Kubernetes Security Fundamentals PracticeWhich admission controller plugin is responsible for intercepting requests to modify objects and checking whether the user has sufficient RBAC permissions?
Explanation: The RBAC admission controller enforces authorization decisions based on Role and ClusterRole bindings.
Which THREE fields are required when defining an egress rule in a Kubernetes NetworkPolicy?
Explanation: Option A is correct because the egress list block is the core of an egress rule: each entry under spec.egress defines a rule with optional to and ports matchers, and at least one egress entry is required to permit outbound traffic. Option C is correct because policyTypes must include 'Egress' for the policy to govern outbound traffic; without it, the egress section is ignored and the policy only applies to ingress. Option E is correct because the to block specifies destination matchers (ipBlock, namespaceSelector, podSelector) that determine which destinations the egress rule allows; an empty to matches all destinations. Option B is incorrect because storageClassName is a PersistentVolumeClaim field for volume binding, unrelated to NetworkPolicy egress rules. Option D is incorrect because nodeSelector is a Pod spec field for scheduling pods onto nodes, not a NetworkPolicy egress field.
Which THREE features are enforced or verified by the Kubernetes 'restricted' Pod Security Standard profile?
Explanation: Option B is correct because the restricted profile requires that containers drop ALL Linux capabilities and only permits adding back NET_BIND_SERVICE, ensuring minimal privilege. Option C is correct because restricted mandates allowPrivilegeEscalation: false, preventing processes from gaining more privileges than their parent. Option E is correct because restricted enforces runAsNonRoot: true, requiring containers to run as a non-root user. Option A is incorrect because privileged mode is explicitly forbidden by the restricted profile, not allowed. Option D is incorrect because host network namespace access is disallowed under restricted, not permitted without restriction.
You are troubleshooting a pod that fails to start because it attempts to run a container with privileges. The cluster enforces the 'baseline' Pod Security Standard. Which container configuration will cause the Pod Security Admission controller to reject the pod?
Explanation: The baseline Pod Security Standard explicitly forbids privileged containers, so setting securityContext.privileged: true causes the Pod Security Admission controller to reject the pod. Privileged mode grants the container all Linux capabilities and full access to the host, which violates baseline's core restrictions.
You need to isolate a database pod so that only pods with the label 'tier=frontend' within the same namespace can connect to it on port 5432. Which NetworkPolicy resource configuration achieves this?
Explanation: A NetworkPolicy with an ingress rule using a podSelector for 'tier=frontend' and a port of 5432 restricts inbound traffic to the database pod so only matching pods in the same namespace can connect. Because NetworkPolicy is namespace-scoped and the podSelector matches labels within the policy's namespace, this precisely satisfies the requirement. The policy must also select the database pod via its own podSelector in the spec.
+15 more Kubernetes Security Fundamentals questions available
Practice all Kubernetes Security Fundamentals questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Kubernetes Security Fundamentals. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Kubernetes Security Fundamentals questions on the KCSA frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Kubernetes Security Fundamentals is tested as part of the Kubernetes and Cloud Native Security Associate (KCSA, CNCF) (KCSA) blueprint. Practicing with targeted Kubernetes Security Fundamentals questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free KCSA practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Kubernetes Security Fundamentals is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Kubernetes Security Fundamentals practice session with instant scoring and detailed explanations.
Start Kubernetes Security Fundamentals Practice →