KCSA Practice Questions

Question 1

An enterprise security auditor is reviewing Kubernetes API server admission control configurations for compliance. Which THREE admission plugins or mechanisms are critical for enforcing security policies at admission time? (Choose THREE)

Accepted Answer

ValidatingAdmissionWebhook. NodeRestriction, ValidatingAdmissionWebhook, and PodSecurity are key admission mechanisms for enforcing security policies.

Answer

InsecureServing

Answer

AlwaysAllow

Question 2

A security engineer needs to verify that control plane component pods (such as kube-apiserver and etcd) have correct file ownership on the control plane node. According to CIS benchmarks, who should own these manifest files located in "/etc/kubernetes/manifests"?

Accepted Answer

root:root. CIS benchmarks state that control plane manifest files must be owned by the root user and root group (root:root).

Answer

nobody:nogroup

Answer

daemon:daemon

Answer

kube:kube

Question 3

A cluster administrator wants to implement admission control auditing to record all mutating and validating requests made to the API server. Which component configuration handles this requirement?

Accepted Answer

Configure an audit policy file and pass its path to the API server via --audit-policy-file.. Kubernetes Audit Policy configuration files define what events are recorded and at what log level by the API server audit backend.

Answer

Configure the kubelet audit webhook via /etc/kubernetes/audit.json.

Answer

Enable kube-proxy audit mode using --audit-proxy=true.

Answer

Set etcd logging level to DEBUG in the etcd configuration yaml.

Question 4

A compliance officer wants to continuously audit Kubernetes resource manifests for misconfigurations against security best practices before they are applied. Which tool type is best suited for this shift-left compliance approach?

Accepted Answer

Static code analysis and admission controllers. Policy-as-code engines like OPA Gatekeeper or Kyverno validate and audit Kubernetes manifests prior to admission into the cluster.

Answer

Log shippers

Answer

Packet analyzers

Answer

Kernel debuggers

Question 5

A security analyst wants to scan container images for known Common Vulnerabilities and Exposures (CVEs) as part of a continuous compliance pipeline. Which tool is widely used for this purpose?

Accepted Answer

Trivy. Trivy is a popular open-source vulnerability scanner for containers, filesystems, and Git repositories.

Answer

Envoy

Answer

CoreDNS

Answer

Calico

Question 6

When evaluating a Kubernetes cluster against security and compliance baselines, which TWO tools are commonly used for automated auditing and benchmarking? (Choose TWO)

Accepted Answer

kube-bench. Kube-bench and Kubescape are both widely recognized tools for auditing Kubernetes compliance against benchmarks.

Answer

Kustomize

Answer

Helm

Answer

Kubectl

Question 7

An enterprise is enforcing the CIS Kubernetes Benchmark for control plane configuration. Which TWO parameters must be correctly configured on the kube-apiserver to meet strict compliance auditing standards? (Choose TWO)

Accepted Answer

--audit-policy-file. CIS benchmarks require enabling auditing via audit log path and audit policy file configuration on the kube-apiserver.

Answer

--service-account-lookup=false

Answer

--enable-bootstrap-auth-only=true

Answer

--profiling=true

Question 8

Which NIST framework publication specifically addresses the security of container-based applications and orchestration systems?

Accepted Answer

NIST SP 800-190. NIST SP 800-190 is the Application Container Security Guide, providing specific security guidance for container environments.

Answer

NIST SP 800-37

Answer

NIST SP 800-53

Answer

NIST SP 800-88

Question 9

Which Kubernetes control plane component runs controllers that handle routine tasks such as replicating pods and managing service accounts?

Accepted Answer

kube-controller-manager. The kube-controller-manager houses core control loops including the replication controller, service account controller, and namespace controller.

Answer

CoreDNS

Answer

etcd

Answer

kube-proxy

Question 10

Which TWO of the following kubelet security configurations are critical for preventing container escape and unauthorized node API access? (Choose TWO)

Accepted Answer

Configure kubelet authorization mode to Webhook.. Disabling the read-only port and enforcing webhook authorization on the kubelet secure port are essential node security measures.

Answer

Enable anonymous authentication on the kubelet secure port.

Answer

Run kubelet containers in privileged mode.

Answer

Set authorization.mode to AlwaysAllow.

Question 11

Which THREE of the following practices should be followed when configuring Kubernetes audit logging? (Choose THREE)

Accepted Answer

Monitor audit logs regularly for suspicious authentication failures or privilege escalations.. Audit logging should use a defined policy, specify a secure log output path, and protect log files from unauthorized modification.

Answer

Store audit logs in unencrypted public ConfigMaps.

Answer

Disable audit logging entirely to maximize API server performance.

Question 12

Which TWO of the following are valid Kubernetes RBAC rule subjects that can be bound to roles or cluster roles?

Accepted Answer

User. Kubernetes RBAC supports three primary subjects: User, Group, and ServiceAccount.

Answer

Secret

Answer

Namespace

Answer

PersistentVolume

Question 13

Which TWO actions are core tenets of the "Shift-Left" security philosophy in cloud-native compliance? (Choose TWO)

Accepted Answer

Scanning infrastructure-as-code (IaC) templates for misconfigurations before deployment. Shift-left security focuses on integrating security checks early in the development lifecycle, such as in CI/CD and IaC scanning.

Answer

Disabling all automated security tooling to speed up commits

Answer

Waiting until a production breach occurs to audit logs

Answer

Relying entirely on manual code reviews post-release

Question 14

Which open-source auditing tool provides compliance scores and checks against Kubernetes security frameworks such as NSA-CISA and CIS?

Accepted Answer

Kubescape. Datree or Kubescape are prominent tools for compliance scoring. Kubescape specifically evaluates Kubernetes clusters against multiple security frameworks including CIS and NSA-CISA.

Answer

Kube-dns

Answer

Metric-server

Answer

Cilium

Question 15

According to the CIS Kubernetes Benchmark, anonymous requests to the Kubernetes API server should be disabled. Which kube-apiserver flag enforces this setting?

Accepted Answer

--anonymous-auth=false. The flag --anonymous-auth=false disables anonymous requests to the secure port of the API server, fulfilling CIS benchmark requirements.

Answer

--authorization-mode=Node,RBAC

Answer

--enable-admission-plugins

Answer

--insecure-port=0

Kubernetes and Cloud Native Security Associate (KCSA, CNCF) (KCSA) KCSA practice test

Three ways to study

Study KCSA by domain

Study KCSA by topic

Kubernetes Security Fundamentals practice questions

Overview OF Cloud Native Security practice questions

Compliance And Security Frameworks practice questions

Kubernetes Cluster Component Security practice questions

Kubernetes Threat Model practice questions

Platform Security practice questions

KCSA fundamentals practice questions

KCSA scenario practice questions

KCSA troubleshooting practice questions

Kubernetes and Cloud Native Security Associate (KCSA, CNCF) (KCSA) practice questions