How should I use these Kubernetes Threat Model practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Kubernetes Threat Model questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Kubernetes Threat Model domain.

KCSA · topic practice

Kubernetes Threat Model practice questions

Practise Kubernetes and Cloud Native Security Associate (KCSA, CNCF) (KCSA) Kubernetes Threat Model practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Kubernetes Threat Model

Practice 10 questions Browse domain →

What the exam tests

What to know about Kubernetes Threat Model

Kubernetes Threat Model questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Kubernetes Threat Model exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Kubernetes Threat Model questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full Kubernetes Threat Model explanation →

An attacker with read access to a Kubernetes cluster's etcd database wants to compromise node-level runtimes. What high-value secret stored within etcd presents the most immediate risk of allowing cluster-wide node takeover if extracted?

Trap 1: Internal DNS records for CoreDNS

CoreDNS records map names to IPs but do not inherently provide cryptographic authentication material.

Trap 2: HorizontalPodAutoscaler metric configurations

HPA configs contain scaling targets, not sensitive credential material.

Trap 3: PersistentVolume claim capacity metadata

PVC metadata describes storage size and access modes, lacking credential value.

Study all Kubernetes Threat Model common traps →

A
ServiceAccount tokens with high-privilege clusterrole bindings
Service account tokens stored in secrets provide direct authentication to the Kubernetes API server, allowing an attacker to impersonate that service account and leverage its clusterrole bindings.
B
Internal DNS records for CoreDNS
Why wrong: CoreDNS records map names to IPs but do not inherently provide cryptographic authentication material.
C
HorizontalPodAutoscaler metric configurations
Why wrong: HPA configs contain scaling targets, not sensitive credential material.
D
PersistentVolume claim capacity metadata
Why wrong: PVC metadata describes storage size and access modes, lacking credential value.

Kubernetes Threat Model practice questions

What to know about Kubernetes Threat Model

Common Kubernetes Threat Model exam traps

Kubernetes Threat Model questions

An attacker with read access to a Kubernetes cluster's etcd database wants to compromise node-level runtimes. What high-value secret stored within etcd presents the most immediate risk of allowing cluster-wide node takeover if extracted?

An administrator wishes to adhere to the principle of least privilege regarding pod service accounts. How should a Pod that does not need to interact with the Kubernetes API server be configured?

When analyzing the container supply chain threat surface, which TWO practices help mitigate the introduction of vulnerable or malicious artifacts?

An auditor is evaluating the Kubernetes control plane attack surface. Which component exposes the primary interface for cluster management and must be protected with strong authentication and authorization?

A cluster administrator wants to mitigate supply chain risks stemming from vulnerable base images used by developers. Where in the software lifecycle should vulnerability scanning ideally be integrated first to shift-left security?

A security engineer is analyzing supply chain risks for container images. An unsigned image from an untrusted public registry is pulled into a secure cluster. Which Admission Controller plugin can be leveraged to prevent the deployment of unsigned container images?

A developer configures a Kubernetes Pod with `hostNetwork: true`. Under the STRIDE threat model, which threat category is most directly introduced or elevated by this configuration?

A security team discovers that an application container running as root has successfully mounted the host's Docker socket (`/var/run/docker.sock`). What is the primary attack vector enabled by this misconfiguration?

An administrator notices that a compromised Pod is attempting to access the cloud provider metadata service to retrieve IAM role credentials. Which native Kubernetes resource is best suited to block this specific attack vector at the network layer?

Which of the following represents a common cloud-native supply chain attack vector where malicious actors publish packages with names similar to popular libraries?

A security auditor reviews a Kubernetes cluster threat model and identifies that the Kubelet API on port 10250 permits unauthenticated requests if not configured properly. What authentication and authorization mode should be enforced on the Kubelet to prevent unauthorized remote code execution?

An organization wants to analyze potential threats to their Kubernetes cluster using the STRIDE model. Which STRIDE category maps to an attacker eavesdropping on unencrypted internal cluster traffic between pods?

An adversary successfully compromises a workload and extracts the default service account token. By default, what permission level does this unconfigured service account token possess in modern Kubernetes clusters?

An attacker with compromised Kubernetes credentials attempts to hide malicious activity by deleting Kubernetes audit logs on the worker node. Where should audit logs ideally be stored and managed in a securely hardened cluster to prevent tampering and ensure non-repudiation?

Which attack vector involves tricking a Kubernetes cluster user or service into executing unintended actions via authenticated sessions, frequently mitigated by robust CSRF defenses and proper API design?

An attacker gains execution inside a container that has the `CAP_SYS_ADMIN` capability enabled and shares the host's IPC namespace. How does `CAP_SYS_ADMIN` facilitate container escape?

Which Kubernetes feature allows administrators to define mandatory security baselines, such as disallowing privileged containers, across an entire namespace or cluster?

A DevOps team uses mutable image tags like `:latest` in their deployment manifests. Under supply chain threat modeling, what vulnerability does this practice introduce?

Track your progress over time

Start a Kubernetes Threat Model only practice session

Related KCSA topic practice pages

Kubernetes Security Fundamentals practice questions

Overview OF Cloud Native Security practice questions

Compliance And Security Frameworks practice questions

Kubernetes Cluster Component Security practice questions

Kubernetes Threat Model practice questions

Platform Security practice questions

KCSA fundamentals practice questions

KCSA scenario practice questions

KCSA troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid