KCSA Kubernetes Threat Model Practice Question
In the context of Kubernetes API server security, which TWO mechanisms are used to authenticate incoming API requests?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
X509 Client Certificates presented during TLS handshakes
X509 client certificates and Service Account bearer tokens are standard Kubernetes authentication mechanisms.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Kubernetes NetworkPolicy egress CIDR blocks
Why it's wrong here
NetworkPolicies control network traffic routing, not user or service authentication.
- ✗
PersistentVolume claim capacity metadata
Why it's wrong here
PVC metadata handles storage allocation, unrelated to authentication.
- ✓
X509 Client Certificates presented during TLS handshakes
Why this is correct
The API server validates client certificates signed by the cluster CA for authentication.
- ✗
Container image pull secrets stored in private registries
Why it's wrong here
Image pull secrets authenticate container runtimes to container registries, not users to the API server.
- ✓
Bearer Tokens (including ServiceAccount JWT tokens)
Why this is correct
Bearer tokens passed in the Authorization header authenticate users and service accounts.
About these practice questions
Courseiva writes every KCSA question from scratch — 320 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.