20+ practice questions focused on Kubernetes Threat Model — one of the most tested topics on the Kubernetes and Cloud Native Security Associate (KCSA, CNCF) (KCSA) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Kubernetes Threat Model PracticeAn attacker with read access to a Kubernetes cluster's etcd database wants to compromise node-level runtimes. What high-value secret stored within etcd presents the most immediate risk of allowing cluster-wide node takeover if extracted?
Explanation: Bootstrap tokens or service account tokens with cluster-admin bindings allow creating daemonsets or executing remote commands via the API server, but extracted kubelet client certificates or service account secrets can directly grant API privileges.
An administrator wishes to adhere to the principle of least privilege regarding pod service accounts. How should a Pod that does not need to interact with the Kubernetes API server be configured?
Explanation: Setting automountServiceAccountToken: false on the ServiceAccount or directly within the Pod spec prevents the token from being mounted into the container filesystem.
An adversary successfully compromises a workload and extracts the default service account token. By default, what permission level does this unconfigured service account token possess in modern Kubernetes clusters?
Explanation: In modern Kubernetes (1.24+), the default service account is no longer automatically granted any RBAC permissions — the legacy 'system:serviceaccount:<ns>:default' binding to the deprecated 'system:discovery' or permissive roles was removed. A freshly created default service account has zero explicit RoleBindings or ClusterRoleBindings, so its token can only perform actions granted by authenticated-user defaults (like /healthz or selfsubjectaccessreview). This is the core of least-privilege for service accounts: no permissions unless explicitly bound.
A Kubernetes cluster experiences an attack where an untrusted pod attempts to access the Kubernetes API server and discover cluster secrets. The cluster uses RBAC. What is the mechanism that prevents this pod from reading secrets in other namespaces?
Explanation: RBAC uses RoleBindings (namespaced) and ClusterRoleBindings (cluster-wide). A namespaced RoleBinding grants permissions only within that namespace, so a pod's service account cannot read secrets in other namespaces unless a ClusterRoleBinding explicitly grants it. This is the mechanism that confines the pod's API access.
When analyzing the container supply chain threat surface, which TWO practices help mitigate the introduction of vulnerable or malicious artifacts?
Explanation: Scanning container images for CVEs in the CI/CD pipeline and signing images cryptographically with tools like Cosign are core supply chain mitigations.
+15 more Kubernetes Threat Model questions available
Practice all Kubernetes Threat Model questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Kubernetes Threat Model. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Kubernetes Threat Model questions on the KCSA frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Kubernetes Threat Model is tested as part of the Kubernetes and Cloud Native Security Associate (KCSA, CNCF) (KCSA) blueprint. Practicing with targeted Kubernetes Threat Model questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free KCSA practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Kubernetes Threat Model is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Kubernetes Threat Model practice session with instant scoring and detailed explanations.
Start Kubernetes Threat Model Practice →