KCSA Practice Question: An administrator notices that unauthorized users can view sensitive ConfigMaps across…
An administrator notices that unauthorized users can view sensitive ConfigMaps across different namespaces because default RoleBindings were overly permissive. Which security principle was violated?
⚠ Common exam trap
KCSA often tests the distinction between least privilege and other security principles — candidates may pick 'shared responsibility' because it sounds like a governance issue, but the specific violation of granting more access than needed is least privilege.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Least privilege access
Overly permissive default RoleBindings that allow unauthorized users to view ConfigMaps across namespaces violate the principle of least privilege. Least privilege requires granting only the minimum permissions necessary for a user or service to perform its function. Default RoleBindings that grant broad read access to ConfigMaps across namespaces exceed that minimum and expose sensitive configuration data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Least privilege access
Why this is correct
Least privilege means each user and service account gets only the permissions its task needs, in the narrowest scope. Bindings that let users read ConfigMaps across namespaces they do not work in break that. Use namespaced Roles and RoleBindings instead of broad ClusterRoleBindings, avoid wildcards, and audit with 'kubectl auth can-i --list --as <user> -n <namespace>'. Sensitive values belong in Secrets, not ConfigMaps.
- ✗
Shared responsibility model
Why it's wrong here
The shared responsibility model describes how security duties are split between a cloud provider and its customer, for example the provider securing a managed control plane and the customer configuring RBAC and workloads. Misconfigured RoleBindings fall on the customer's side of that split, but the principle actually broken by granting too much access is least privilege.
- ✗
Immutable infrastructure
Why it's wrong here
Immutable infrastructure means replacing components, such as container images or nodes, instead of changing them in place, which reduces configuration drift and makes deployments reproducible. It is valuable for security, but it is about how systems are built and updated, not about who is allowed to read resources. Overly broad RBAC permissions violate least privilege.
- ✗
Supply chain security
Why it's wrong here
Supply chain security protects how software is built and delivered: trusted base images, signed artifacts, dependency scanning and protected build pipelines. It addresses threats such as malicious images or compromised dependencies, not RBAC permissions granted to users inside a cluster. Here the problem is excessive access rights, a violation of least privilege.
About these practice questions
One of 292 original KCSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
You might also like
Similar KCSA questions
- Which TWO of the following principles are core tenets of cloud native security?
- An enterprise is conducting a security review of their container build and deployment pipeline. Which TWO security contr…
- When evaluating cloud native security principles, why is reliance on a traditional network firewall (perimeter security)…
- A security auditor is evaluating a cloud-native deployment. The team states they practice 'shift-left' security. Which o…
- An enterprise is deploying a zero-trust architecture across their Kubernetes environments. They mandate that all contain…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.