Kubernetes and Cloud Native Security Associate (KCSA, CNCF) (KCSA) (KCSA) — Questions 1–75

Which TWO practices are essential for securing container images against supply chain vulnerabilities? (Choose two)

A compliance officer wants to continuously audit Kubernetes resource manifests for misconfigurations against security best practices before they are applied. Which tool type is best suited for this shift-left compliance approach?

An auditor is assessing compliance with NIST SP 800-53 controls for access control (AC) within a managed Kubernetes cluster. Which API object enforces fine-grained authorization decisions directly at the Kubernetes API server?

Which TWO mechanisms help secure Kubernetes Secrets against unauthorized access or exposure?

What is the security risk of configuring `privileged: true` in a container's SecurityContext?

A security auditor reviews a Kubernetes cluster threat model and identifies that the Kubelet API on port 10250 permits unauthenticated requests if not configured properly. What authentication and authorization mode should be enforced on the Kubelet to prevent unauthorized remote code execution?

An enterprise undergoes an ISO/IEC 27001 audit for their Kubernetes environment. The auditor requests evidence that secrets at rest are encrypted. Which configuration component enables encryption of Secret resources in etcd?

Which TWO tasks are typically performed during container image vulnerability scanning? (Choose two)

Which THREE of the following practices are recommended when securing container images to prevent supply chain attacks in a Kubernetes environment? (Choose THREE)

Which TWO tools or built-in Kubernetes features are used to secure container privileges and behaviors?

An organization adopts immutable infrastructure principles for their Kubernetes worker nodes. When a patch is required, they replace the entire node instance rather than updating packages in place. This practice primarily enhances security at which of the 4Cs layers?

You are securing a Kubernetes cluster control plane and need to ensure that the API server limits request payload sizes to prevent Denial of Service (DoS) attacks via memory exhaustion. Which mechanism or flag controls request body size limits in the Kubernetes API server?

When configuring Role-Based Access Control (RBAC), which Kubernetes object grants permissions across the entire cluster rather than within a single namespace?

An administrator wants to verify that etcd database defragmentation is performed periodically to reclaim storage space after large amounts of data churn. Which etcdctl command defragments an etcd member?

An organization is adopting Kubernetes and wants to understand where their responsibility lies under the shared responsibility model. According to the 4Cs of Cloud Native Security, who is primarily responsible for configuring the RBAC rules and network policies within the Kubernetes control plane and worker nodes?

An organization wants to prevent supply chain attacks where malicious code is injected into third-party Helm charts before deployment. What mitigation technique provides cryptographic verification of Helm chart integrity and authenticity?

Which TWO security features are provided by modern container runtimes like containerd or CRI-O? (Choose two)

An auditor is reviewing container image registries used by a Kubernetes cluster. They notice that public images are pulled directly without verification. Which security best practice should be implemented for image registries?

An administrator needs to restrict access so that a specific ServiceAccount in the production namespace can only list pods, but cannot delete or modify them. Which core Kubernetes API resource should be configured to achieve this using RBAC?

An enterprise cluster utilizes a service mesh with AuthorizationPolicies. You need to configure a policy that allows GET requests from service A to service B while explicitly denying DELETE requests on all paths. How are Istio AuthorizationPolicies evaluated when both allow and deny rules are present?

Which TWO layers complete the remaining set of the 4Cs of Cloud Native Security model alongside Code and Container? (Choose TWO)

A security engineer is performing a threat analysis on a Kubernetes cluster and identifies a risk where a compromised container can exhaust the available CPU and memory on the underlying worker node, causing a denial of service for other tenants. Which native Kubernetes admission mechanism is specifically designed to mitigate this threat vector?

Which Kubernetes control plane component is responsible for noticing and responding when nodes go down or fail health checks?

A security engineer identifies that an enterprise Kubernetes cluster has several cluster-admin bindings granted to user accounts that have left the company. Which Kubernetes security principle has been violated?

An administrator needs to restrict kubelets so they can only modify resources associated with their own node (such as their own Node object and Pods bound to them). Which authorization mode must be enabled alongside RBAC?

An administrator notices that a compromised Pod is attempting to access the cloud provider metadata service to retrieve IAM role credentials. Which native Kubernetes resource is best suited to block this specific attack vector at the network layer?

An administrator notices that a container in a Kubernetes cluster running containerd is attempting to write files to the root filesystem (/), which should be strictly immutable. Which configuration in the Pod's securityContext should be enforced to prevent this?

Which THREE fields are required when defining an egress rule in a Kubernetes NetworkPolicy?

Which THREE of the following mechanisms are essential for securing the Kubernetes control plane against unauthorized access and privilege escalation?

You are auditing a multi-tenant Kubernetes cluster and notice that users can read ServiceAccount tokens belonging to other namespaces through improper RBAC configuration. Which ClusterRole permission should be strictly avoided or audited to prevent token theft via secret inspection?

A security scan reveals that the kubelet read-only port (typically port 1055) is active and exposes unauthenticated pod and cluster metadata. How should this vulnerability be remediated?

An incident response team suspects that an attacker has gained unauthorized access to the cluster via an unencrypted etcd backup file containing sensitive cluster state. Which etcd utility should be used to securely snapshot and backup etcd data?

An attacker gains execution in a container and attempts to perform a denial of service attack on other workloads sharing the same Kubernetes node by consuming all available CPU and memory resources. What Kubernetes feature prevents this cross-workload resource exhaustion?

You are performing a security review of etcd cluster membership. You need to list all active members of the etcd cluster and check their health status using the command line. Which etcdctl command is correct?

Which component in the Kubernetes control plane is directly responsible for interacting with etcd to persist and retrieve cluster state?

According to the CIS Kubernetes Benchmark, anonymous requests to the Kubernetes API server should be disabled. Which kube-apiserver flag enforces this setting?

An organization is hardening their Kubernetes cluster configuration to secure the Cluster layer. Which THREE configurations or practices should they implement? (Choose THREE)

An enterprise is adopting the Cloud Native Security Framework to map their controls. Which of the 4Cs of Cloud Native Security represents the outermost layer encompassing physical data centers and hardware?

Which THREE methods can be used to inject Kubernetes Secrets into a running pod?

By default, how are Kubernetes Secrets stored in etcd when created without additional encryption-at-rest configurations?

Which TWO features are typically provided by service mesh architectures to enhance platform security? (Choose two)

Which THREE of the following are official Pod Security Standard enforcement levels recognized by Kubernetes?

Which TWO actions can be performed using Kubernetes RBAC rules?

A security architect is designing a multi-tenant Kubernetes platform. They need to ensure that a compromise in one tenant's namespace cannot allow packet sniffing or unauthorized traffic interception from another tenant's pods. Which Kubernetes feature should they implement to satisfy cloud native network isolation principles?

When evaluating a Kubernetes cluster against security and compliance baselines, which TWO tools are commonly used for automated auditing and benchmarking? (Choose TWO)

You are configuring an Ingress resource using the NGINX Ingress Controller to expose a sensitive internal application. To prevent unauthorized clients from connecting, you want to enable mutual TLS authentication at the ingress layer. Which annotation is required in the Ingress resource definition to specify the Kubernetes Secret containing the trusted Client CA certificate?

You want to ensure that a newly created Role in namespace 'finance' cannot be modified or deleted by regular developers who have edit permissions. Which RBAC feature or design prevents unauthorized privilege escalation through Role manipulation?

A security analyst wants to scan container images for known Common Vulnerabilities and Exposures (CVEs) as part of a continuous compliance pipeline. Which tool is widely used for this purpose?

Which attack vector involves tricking a Kubernetes cluster user or service into executing unintended actions via authenticated sessions, frequently mitigated by robust CSRF defenses and proper API design?

When configuring Pod Security Standards on a namespace, which THREE security restrictions are enforced by the 'restricted' profile that are NOT enforced by the 'baseline' profile? (Choose THREE)

To comply with CIS benchmarks regarding pod security, an administrator wants to prevent containers from running with root privileges. Which field in a Pod Security Standard (restricted profile) enforces this?

In a zero-trust Kubernetes architecture, an attacker attempts to exploit the Kubernetes API server via a Server-Side Request Forgery (SSRF) flaw in a poorly written custom controller. Which defense-in-depth mechanism specifically protects against unauthorized API requests originating from inside the cluster network?

Which THREE of the following criteria should be evaluated when reviewing Kubernetes RBAC policies to ensure least privilege? (Choose THREE)

You need to ensure that an ingress controller processing TLS termination uses strong cryptographic ciphers and disables outdated protocols such as TLSv1.0 and TLSv1.1. Where are these TLS configuration settings typically managed in an NGINX Ingress deployment?

An enterprise Kubernetes cluster uses a service mesh with strict authorization policies configured. A developer complains that their frontend service cannot communicate with the backend database service. Upon inspecting the mesh configuration, you notice a PeerAuthentication resource set to STRICT mode. What does this setting enforce?

Which TWO of the following kubelet security configurations are critical for preventing container escape and unauthorized node API access? (Choose TWO)

Which TWO of the following practices directly address security concerns within the 'Container' layer of the 4Cs of Cloud Native Security?

Which THREE fields are required when defining a standard Kubernetes NetworkPolicy resource? (Choose THREE)

Which TWO actions should be taken when an image vulnerability scanner reports a critical CVE in a running production container? (Choose two)

An administrator needs to analyze the STRIDE threat model category that encompasses an attacker gaining unauthorized elevation of privilege inside a Kubernetes cluster by exploiting a misconfigured RBAC ClusterRoleBinding. Which threat category does this represent?

A platform engineering team is reviewing security layers for a newly provisioned Kubernetes cluster on AWS using Amazon EKS. Which layer of the 4Cs of Cloud Native Security encompasses patching the underlying Linux kernel of the worker nodes?

Which of the following best describes the principle of 'Defense-in-Depth' in cloud native security architectures?

You are hardening etcd on a dedicated control plane host. You want to ensure that etcd database files on disk are protected against unauthorized physical or filesystem access. Which control mechanism is best suited for this?

You need to isolate a database pod so that only pods with the label 'tier=frontend' within the same namespace can connect to it on port 5432. Which NetworkPolicy resource configuration achieves this?

An administrator is designing a security posture for a microservices application deployed in a Kubernetes cluster. According to the 4Cs of Cloud Native Security, which component falls under the 'Code' layer?

An administrator wants to secure the communication channel between the Kubernetes API server and extension API servers (such as metrics-server). Which API server flag specifies the Certificate Authority used to verify extension API server certificates?

What role does image scanning play in a shift-left security strategy for platform security?

Which TWO of the following practices are core principles of cloud native security? (Choose TWO)

When modeling threats related to Kubernetes secrets management, which TWO actions help protect secrets from unauthorized access?

You are troubleshooting a control plane failure where the Kubernetes API server cannot communicate with etcd because of expired client certificates. Which command-line flag on the kube-apiserver specifies the client TLS certificate used for authentication against etcd?

An administrator wants to audit who created or modified specific resources in the cluster. Where are API server audit records sent if configured with the log backend?

An auditor is assessing an organization's cloud-native supply chain security posture. Which THREE controls should be in place to ensure artifact integrity and safety across the Code and Container layers? (Choose THREE)

Which THREE of the following statements regarding cloud native security principles are correct? (Choose THREE)

A security engineer wants to ensure that a pod cannot escalate its privileges to gain root access on the node. Which securityContext setting should be configured to prevent privilege escalation?

An administrator needs to store sensitive database credentials securely so that they can be mounted as environment variables inside a specific pod. Which Kubernetes object is designed for this purpose?