KCSA Kubernetes Cluster Component Security Practice Question

An administrator wants to ensure that a malicious container executing on a worker node cannot query the kubelet API to extract sensitive pod information. Which kubelet configuration setting controls whether requests to the kubelet require authorization?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

authorization.mode: Webhook

Setting authorization.mode to Webhook forces the kubelet to verify requests against the API server's RBAC system.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
protectKernelDefaults: false
Why it's wrong here
ProtectKernelDefaults validates kernel settings, not kubelet API authorization.
✗
tlsCertFile: /etc/certs/kubelet.crt
Why it's wrong here
TLS configuration manages encryption in transit, not authorization decisions.
✗
authentication.anonymous.enabled: true
Why it's wrong here
This enables anonymous access, which increases risk.
✓
authorization.mode: Webhook
Why this is correct
Webhook authorization delegates authz checks to the API server.

Quick reference

Access Control Model Comparison

Model	Acronym	Who Controls Access?	Best For
Discretionary Access Control	DAC	Resource owner	Small teams, file shares
Mandatory Access Control	MAC	System / security labels	Classified govt / military
Role-Based Access Control	RBAC	Administrator (via roles)	Enterprise environments
Attribute-Based Access Control	ABAC	Policy engine (user + resource attributes)	Fine-grained, dynamic policies
Rule-Based Access Control	RuBAC	System rules / ACLs	Firewall rules, network ACLs

About these practice questions

Courseiva writes every KCSA question from scratch — 320 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint

Ready to practise?

Turn this into a habit — start a practice session.

Start practice session

Practice tests

Scored 10-question sessions with instant feedback and explanations.

Free KCSA Practice Test 3 — 30 Questions→KCSA Practice Test 4 — 25 Questions→KCSA Practice Questions 1 — 50 Questions→

Practice by domain

Domains are weighted differently on the real exam — spend your time where you score lowest.

Kubernetes Cluster Component Security Overview OF Cloud Native Security Kubernetes Threat Model Compliance And Security Frameworks

Practice by question type

Practise one question format at a time: exhibits, multi-select, drag-and-drop, troubleshooting.

Browse scenarios

Topic-level practice

Narrow in on a single topic rather than practising the whole bank at once.

Kubernetes Cluster Component Security practice questions KCSA fundamentals practice questions KCSA troubleshooting practice questions Kubernetes Threat Model practice questions

Where to go next

Study guide Exam domains KCSA practice test

This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.