How should I use these Kubernetes Security Fundamentals practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Kubernetes Security Fundamentals questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Kubernetes Security Fundamentals domain.

KCSA · topic practice

Kubernetes Security Fundamentals practice questions

Practise Kubernetes and Cloud Native Security Associate (KCSA, CNCF) (KCSA) Kubernetes Security Fundamentals practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Kubernetes Security Fundamentals

Practice 10 questions Browse domain →

What the exam tests

What to know about Kubernetes Security Fundamentals

Kubernetes Security Fundamentals questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Kubernetes Security Fundamentals exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Kubernetes Security Fundamentals questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Kubernetes Security Fundamentals explanation →

Which admission controller plugin is responsible for intercepting requests to modify objects and checking whether the user has sufficient RBAC permissions?

Trap 1: NamespaceLifecycle

NamespaceLifecycle ensures that requests to a non-existent namespace are rejected and prevents deletion of system namespaces.

Trap 2: DefaultStorageClass

DefaultStorageClass observes PersistentVolumeClaim creation and assigns a default storage class.

Trap 3: LimitRanger

LimitRanger enforces resource allocation limits within a namespace.

Study all Kubernetes Security Fundamentals common traps →

A
RBAC
The RBAC admission controller authorizes API requests.
B
NamespaceLifecycle
Why wrong: NamespaceLifecycle ensures that requests to a non-existent namespace are rejected and prevents deletion of system namespaces.
C
DefaultStorageClass
Why wrong: DefaultStorageClass observes PersistentVolumeClaim creation and assigns a default storage class.
D
LimitRanger
Why wrong: LimitRanger enforces resource allocation limits within a namespace.

Kubernetes Security Fundamentals practice questions

What to know about Kubernetes Security Fundamentals

Common Kubernetes Security Fundamentals exam traps

Kubernetes Security Fundamentals questions

Which admission controller plugin is responsible for intercepting requests to modify objects and checking whether the user has sufficient RBAC permissions?

Under the Pod Security Standards, a developer attempts to deploy a pod with 'privileged: true' in a namespace labeled with 'pod-security.kubernetes.io/enforce=baseline'. What will happen?

You need to restrict network traffic so that only pods with the label 'tier=frontend' can communicate with pods labeled 'tier=backend' in the same namespace. Which Kubernetes resource should you create?

You are auditing a Kubernetes cluster and notice that a specific ServiceAccount has been granted the 'impersonate' verb on users. What security risk does this permission introduce?

An application pod requires read access to secrets in the 'production' namespace. You need to bind a pre-existing ClusterRole named 'secret-reader' to a service account named 'app-sa' in that namespace. Which RBAC resource accomplishes this?

You have deployed a NetworkPolicy in a namespace that selects backend pods, defining an 'ingress' rule with a 'from' block. No other NetworkPolicies exist in the namespace. What is the default behavior for traffic from pods not matched by the 'from' selector?

A security engineer wants to apply Pod Security Standards globally across an entire namespace using the modern built-in admission mechanism. Which approach should be used?

Your cluster uses the Pod Security admission controller with the 'restricted' profile enforced. A legacy application pod fails to start because it requires running as root (runAsNonRoot: false). How should you handle this securely without disabling the standard?

A cluster administrator needs to grant read-only access to pods within the 'development' namespace using Kubernetes RBAC. Which resource kind should be used to define the permissions?

Which RBAC verb allows a user to delete an existing resource in a Kubernetes namespace?

An administrator needs to store sensitive database credentials securely so that they can be mounted as environment variables inside a specific pod. Which Kubernetes object is designed for this purpose?

By default, how are Kubernetes Secrets stored in etcd when created without additional encryption-at-rest configurations?

You are deploying a ValidatingWebhookConfiguration to inspect incoming pod creations. What happens if the webhook fails and the 'failurePolicy' in the webhook configuration is set to 'Fail'?

You want to enable encryption at rest for Kubernetes Secrets in your cluster using an external KMS (Key Management Service) provider. Which component on the control plane reads the EncryptionConfiguration file and handles this encryption?

You want to write a NetworkPolicy that allows backend pods to communicate with an external database located outside the cluster at IP address '203.0.113.50'. Which NetworkPolicy section must you configure?

When configuring a MutatingWebhookConfiguration, you notice that mutating webhooks are executed before validating webhooks. Why is this execution order critical for security and consistency?

An administrator wants to prevent users from creating pods that mount the host network ('hostNetwork: true'). Which tool or feature is best suited to enforce this restriction natively across the cluster?

You are troubleshooting a custom controller that fails to read ConfigMaps in the 'kube-system' namespace despite having a ClusterRole bound via a ClusterRoleBinding. What is the most likely reason for this failure?

An auditor notices that a secret is mounted as a volume in a pod. Where is this secret stored on the worker node filesystem by default?

Track your progress over time

Start a Kubernetes Security Fundamentals only practice session

Related KCSA topic practice pages

Kubernetes Security Fundamentals practice questions

Overview OF Cloud Native Security practice questions

Compliance And Security Frameworks practice questions

Kubernetes Cluster Component Security practice questions

Kubernetes Threat Model practice questions

Platform Security practice questions

KCSA fundamentals practice questions

KCSA scenario practice questions

KCSA troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid