KCSA Kubernetes Security Fundamentals Practice Question

Which THREE components are involved when an external client authenticates to the Kubernetes API server using OpenID Connect (OIDC)? (Choose THREE)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The OIDC Identity Provider (IdP) issuing ID tokens.

OIDC authentication involves the client (e.g. kubectl), the OIDC identity provider, and the kube-apiserver.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The OIDC Identity Provider (IdP) issuing ID tokens.
Why this is correct
The IdP authenticates the user and provides the JSON Web Token (JWT).
✗
The CoreDNS server resolving the OIDC provider domain.
Why it's wrong here
DNS resolution is incidental, not a core cryptographic authentication component.
✓
The client (such as kubectl) presenting the OIDC token in the Authorization header.
Why this is correct
The client obtains the token and sends it with API requests.
✗
The Kubelet running on worker nodes.
Why it's wrong here
Kubelets do not handle cluster-wide OIDC user authentication flows.
✓
The kube-apiserver configured with OIDC issuer flags.
Why this is correct
The API server validates the incoming JWT against the configured IdP.

About these practice questions

Courseiva writes every KCSA question from scratch — 320 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint

Ready to practise?

Put this into practice with a full scored session.

Start practice session

Scored practice sessions

Quick scored rounds with instant marking and a written explanation per question.

KCSA Practice Exam 2 — 20 Questions→KCSA Practice Exam 3 — 20 Questions→

Domain-focused practice

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

Kubernetes Security Fundamentals Platform Security Overview OF Cloud Native Security

Practice by question type

Practise one question format at a time: exhibits, multi-select, drag-and-drop, troubleshooting.

Browse scenarios

Practice by topic

Each topic page collects the questions that test one concept, plus the theory behind it.

Kubernetes Security Fundamentals practice questions KCSA troubleshooting practice questions KCSA scenario practice questions Overview OF Cloud Native Security practice questions

Keep going

Study guide All CNCF / Linux Foundation practice questions All KCSA questions

This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.