Kubernetes and Cloud Native Security Associate (KCSA, CNCF) (KCSA) (KCSA) — Questions 301–320

Your security team has discovered that an application container image contains outdated packages with known remote code execution vulnerabilities. Which phase of the software development lifecycle is the most effective place to initially scan and remediate these vulnerabilities?

An auditor reviews container runtime configurations for compliance with NIST SP 800-190 recommendations on privilege escalation. Which Kubernetes feature controls whether a process can gain more privileges than its parent process?

Which THREE of the following steps are part of proper Kubernetes control plane certificate management? (Choose THREE)

An administrator suspects that someone is attempting brute-force attacks against the Kubernetes API server. Where should the administrator look to inspect authentication failures generated by the API server?

Which THREE security controls can be enforced by admission webhook policy engines (like Kyverno or OPA Gatekeeper) regarding container images? (Choose three)

An administrator wants to ensure that the Kubernetes API server rejects any incoming requests that do not match known API resource paths or have invalid syntax. Which admission controller helps validate request structures and schema compliance?

You are reviewing a security alert indicating that a container running in your Kubernetes cluster attempted to modify host kernel parameters via /proc/sys. Which security configuration was likely missing or misconfigured for this container?

A cluster administrator wants to mitigate supply chain risks stemming from vulnerable base images used by developers. Where in the software lifecycle should vulnerability scanning ideally be integrated first to shift-left security?

An organization uses AWS IAM to restrict access to their EKS cluster control plane endpoints. According to the shared responsibility model, configuring and maintaining these access entries and cluster RBAC roles is the responsibility of whom?

An auditor notices that a secret is mounted as a volume in a pod. Where is this secret stored on the worker node filesystem by default?

A Kubernetes cluster experiences an attack where an untrusted pod attempts to access the Kubernetes API server and discover cluster secrets. The cluster uses RBAC. What is the mechanism that prevents this pod from reading secrets in other namespaces?

You have deployed a NetworkPolicy in a namespace that selects backend pods, defining an 'ingress' rule with a 'from' block. No other NetworkPolicies exist in the namespace. What is the default behavior for traffic from pods not matched by the 'from' selector?

An enterprise security auditor is reviewing Kubernetes API server admission control configurations for compliance. Which THREE admission plugins or mechanisms are critical for enforcing security policies at admission time? (Choose THREE)

Which THREE of the following supply chain vulnerabilities or risks can impact Kubernetes application deployments during the build or deployment phase?

Which THREE of the following auditing or logging mechanisms should be configured on a secure Kubernetes control plane? (Choose THREE)

A security team needs to ensure that Kubernetes nodes have secure file permissions for the kubelet configuration files, in alignment with CIS benchmarks. What should the file permissions on "/etc/kubernetes/kubelet.conf" typically be set to?

You are auditing a Kubernetes cluster and notice that a specific ServiceAccount has been granted the 'impersonate' verb on users. What security risk does this permission introduce?

Which TWO configuration practices improve container runtime security on Kubernetes nodes? (Choose two)

A DevOps team uses mutable image tags like `:latest` in their deployment manifests. Under supply chain threat modeling, what vulnerability does this practice introduce?

A cluster administrator wants to implement admission control auditing to record all mutating and validating requests made to the API server. Which component configuration handles this requirement?