KCSA Platform Security Practice Question
Which THREE of the following features or configurations are associated with securing Ingress traffic in a Kubernetes cluster? (Choose THREE)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configuring TLS blocks in the Ingress resource referencing a kubernetes.io/tls Secret.
Ingress security involves terminating TLS securely using TLS secrets, enforcing HTTPS redirects for unencrypted traffic, and applying authentication or Web Application Firewalls (WAF) at the Ingress layer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configuring TLS blocks in the Ingress resource referencing a kubernetes.io/tls Secret.
Why this is correct
This enables secure HTTPS communication by terminating TLS at the Ingress controller using stored certificate keys.
- ✗
Directly exposing internal Pod clusterIPs to the public internet via kube-proxy bypass rules.
Why it's wrong here
ClusterIPs are internal-only addresses and bypassing network rules to expose them directly is a severe security misconfiguration.
- ✓
Integrating Web Application Firewall (WAF) modules or OAuth/OIDC authentication filters via Ingress annotations or middleware.
Why this is correct
Ingress controllers often support middleware or annotations to inspect HTTP payloads for malicious traffic (WAF) or authenticate users before reaching backend services.
- ✗
Removing all network policies so the Ingress controller can freely probe unmanaged host ports.
Why it's wrong here
Removing network policies degrades cluster security by allowing unrestricted lateral movement.
- ✓
Using annotations to enforce HTTP-to-HTTPS redirection so unencrypted traffic is automatically upgraded.
Why this is correct
Enforcing HTTPS redirection prevents clients from inadvertently sending credentials or data in cleartext over HTTP.
About these practice questions
Courseiva writes every KCSA question from scratch — 320 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.