How should I use these Platform Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Platform Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Platform Security domain.

KCSA · topic practice

Platform Security practice questions

Practise Kubernetes and Cloud Native Security Associate (KCSA, CNCF) (KCSA) Platform Security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Platform Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Platform Security

Platform Security questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Platform Security exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Platform Security questions

20 questions · select your answer, then reveal the explanation

Question 1mediummulti select

Read the full Platform Security explanation →

Which TWO mechanisms are commonly used by container runtime security tools to monitor container activity? (Choose two)

Trap 1: Kubernetes persistent volume snapshotting

Volume snapshotting backs up storage data, unrelated to runtime security monitoring.

Trap 2: CoreDNS query log analysis

CoreDNS logs resolve domain name queries, not runtime container security events.

Study all Platform Security common traps →

A
eBPF (Extended Berkeley Packet Filter) programs attached to kernel tracepoints
eBPF provides high-performance, non-intrusive observation of system calls and network events.
B
Kubernetes persistent volume snapshotting
Why wrong: Volume snapshotting backs up storage data, unrelated to runtime security monitoring.
C
Kubernetes Horizontal Pod Autoscaler metrics collection
HPA scales replicas based on CPU/memory usage and does not monitor security runtime behavior.
D
Linux Security Modules (LSM) such as SELinux, AppArmor, or seccomp
LSMs enforce mandatory access controls and system call filtering at the kernel level.
E
CoreDNS query log analysis
Why wrong: CoreDNS logs resolve domain name queries, not runtime container security events.

Platform Security practice questions

What to know about Platform Security

Common Platform Security exam traps

Platform Security questions

Which TWO mechanisms are commonly used by container runtime security tools to monitor container activity? (Choose two)

Your security team has discovered that an application container image contains outdated packages with known remote code execution vulnerabilities. Which phase of the software development lifecycle is the most effective place to initially scan and remediate these vulnerabilities?

An organization requires that all container images pulled into a Kubernetes cluster are cryptographically signed and verified before execution. Which tool integrates with Kubernetes admission control to enforce signature verification using Cosign?

An administrator needs to enforce mTLS (Mutual TLS) across all microservices within a service mesh without modifying application code. Which component is automatically injected into each application pod to handle the encryption and decryption of traffic?

A platform engineer wants to configure a container runtime security tool that monitors system calls and sends alerts about potential threats in a Kubernetes cluster. Which component of the container runtime architecture intercepts these system calls?

An auditor is reviewing container image registries used by a Kubernetes cluster. They notice that public images are pulled directly without verification. Which security best practice should be implemented for image registries?

A security administrator wants to prevent container processes from writing to any part of their root filesystem except for designated ephemeral volumes. Which security context field should be configured?

You need to ensure that an ingress controller processing TLS termination uses strong cryptographic ciphers and disables outdated protocols such as TLSv1.0 and TLSv1.1. Where are these TLS configuration settings typically managed in an NGINX Ingress deployment?

A platform engineer is hardening a container runtime setup on worker nodes. They want to ensure that containers cannot make unauthorized changes to network configurations or mount host filesystems. Which capability must be explicitly dropped from the default container capabilities set?

An administrator needs to restrict a container from accessing any devices on the host system via device nodes. By default, how does Docker or containerd handle device access for containers when no custom security profile is applied?

Your team is implementing image caching and proxying to protect against external container registry rate limits and security incidents. Which upstream project acts as a CNCF-compliant registry proxy and caching mechanism?

What is the primary security benefit of implementing Ingress TLS termination at the ingress controller rather than inside the application pods?

What role does image scanning play in a shift-left security strategy for platform security?

A security engineer wants to inspect container runtime logs for potential security violations or runtime errors. Which log file or mechanism on a worker node managed by systemd and containerd provides container lifecycle events?

Why is running containers as the root user discouraged in Kubernetes platform security best practices?

Track your progress over time

Start a Platform Security only practice session

Related KCSA topic practice pages

Kubernetes Security Fundamentals practice questions

Overview OF Cloud Native Security practice questions

Compliance And Security Frameworks practice questions

Kubernetes Cluster Component Security practice questions

Kubernetes Threat Model practice questions

Platform Security practice questions

KCSA fundamentals practice questions

KCSA scenario practice questions

KCSA troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid