KCSA Platform Security Practice Question
Which TWO actions help secure Ingress traffic in a Kubernetes cluster? (Choose two)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enforcing TLS termination with strong cipher suites and valid certificates
Securing ingress traffic involves enforcing TLS encryption for all incoming web traffic and restricting ingress access using appropriate firewall or network policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Exposing all internal debugging endpoints via unencrypted HTTP on port 80
Why it's wrong here
Exposing debug endpoints over unencrypted HTTP creates severe security risks.
- ✓
Enforcing TLS termination with strong cipher suites and valid certificates
Why this is correct
TLS encryption protects data in transit between clients and the ingress controller.
- ✗
Disabling all authentication mechanisms at the ingress gateway
Why it's wrong here
Disabling authentication allows unauthorized clients to access backend services.
- ✓
Restricting ingress controller exposure and using Web Application Firewalls (WAF)
Why this is correct
Protecting the ingress perimeter with WAF and proper network access controls hardens edge security.
- ✗
Storing TLS private keys in plaintext ConfigMaps
Why it's wrong here
TLS private keys must be stored securely in Kubernetes TLS secrets, never in plaintext ConfigMaps.
About these practice questions
This KCSA question is part of Courseiva's 320-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.