20+ practice questions focused on Platform Security — one of the most tested topics on the Kubernetes and Cloud Native Security Associate (KCSA, CNCF) (KCSA) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Platform Security PracticeA security administrator wants to prevent container processes from writing to any part of their root filesystem except for designated ephemeral volumes. Which security context field should be configured?
Explanation: The readOnlyRootFilesystem: true field in a Pod's securityContext mounts the container's root filesystem as read-only, preventing any writes to the image layers. Writable locations must then be explicitly provided via emptyDir, persistentVolumeClaim, or tmpfs volume mounts, which is exactly the requirement described.
What is the primary function of a container runtime interface (CRI) security boundary in Kubernetes?
Explanation: The primary function of a container runtime interface (CRI) security boundary in Kubernetes is to separate the management of container lifecycles from the kubelet while maintaining isolation (C). CRI allows kubelet to interact with different container runtimes via a standardized API, and the boundary ensures that runtime operations are isolated from the kubelet's core logic.
Which TWO mechanisms are commonly used by container runtime security tools to monitor container activity? (Choose two)
Explanation: Modern container runtime security tools monitor container behavior using Linux kernel tracing mechanisms such as eBPF and kernel modules or security hooks.
A platform team runs a multi-tenant Kubernetes cluster. They must guarantee that a workload in namespace `team-a` can never consume more than 2 CPU cores and 4Gi of memory, regardless of how many pods it schedules, and that pods are rejected at admission time if they omit resource requests. Which combination of resources should they configure?
Explanation: Namespace-scoped ResourceQuota objects are the native Kubernetes mechanism for enforcing aggregate compute ceilings per tenant. By defining requests and limits for CPU and memory, the platform team caps total consumption at 2 cores and 4Gi and causes the API server to reject pods that do not declare the mandated resource fields. LimitRange, PodDisruptionBudget, and NetworkPolicy address different concerns entirely.
A security engineer is configuring a seccomp profile for a critical application pod running in a hardened Kubernetes cluster to restrict system calls. The pod requires access to the networking stack but must block module loading. Where must this custom JSON seccomp profile be placed on a worker node running containerd so that it can be referenced via the pod security spec?
Explanation: Custom seccomp profiles referenced by kubelet must be placed in the kubelet's seccomp root directory, which defaults to /var/lib/kubelet/seccomp/ on the worker node. The pod spec then references the profile via securityContext.seccompProfile with type Localhost and a relative path under that directory. This is the documented location for local seccomp profiles in Kubernetes.
+15 more Platform Security questions available
Practice all Platform Security questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Platform Security. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Platform Security questions on the KCSA frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Platform Security is tested as part of the Kubernetes and Cloud Native Security Associate (KCSA, CNCF) (KCSA) blueprint. Practicing with targeted Platform Security questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free KCSA practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Platform Security is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Platform Security practice session with instant scoring and detailed explanations.
Start Platform Security Practice →