KCSA Kubernetes Cluster Component Security Practice Question

You are performing a security assessment on an existing Kubernetes cluster. You discover that the kubelet API permits users with valid service account tokens to read sensitive container environment variables and logs. How should you configure the kubelet authorization mode to prevent unauthorized token holders from reading arbitrary pod data?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Set kubelet authorization mode to Webhook so the API server evaluates RBAC permissions for kubelet requests.

Enabling Webhook authorization on the kubelet ensures that API server RBAC rules govern access to kubelet subresources like logs and exec.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Set kubelet authorization mode to Webhook so the API server evaluates RBAC permissions for kubelet requests.
Why this is correct
Webhook authorization forces the kubelet to delegate access checks to the API server's RBAC authorizer.
✗
Set kubelet authorization mode to AlwaysAllow.
Why it's wrong here
AlwaysAllow permits all requests.
✗
Enable anonymous access on port 10250.
Why it's wrong here
Anonymous access makes security worse.
✗
Disable the kubelet authentication certificate.
Why it's wrong here
Disabling certificates breaks node communication entirely.

Quick reference

Access Control Model Comparison

Model	Acronym	Who Controls Access?	Best For
Discretionary Access Control	DAC	Resource owner	Small teams, file shares
Mandatory Access Control	MAC	System / security labels	Classified govt / military
Role-Based Access Control	RBAC	Administrator (via roles)	Enterprise environments
Attribute-Based Access Control	ABAC	Policy engine (user + resource attributes)	Fine-grained, dynamic policies
Rule-Based Access Control	RuBAC	System rules / ACLs	Firewall rules, network ACLs

About these practice questions

One of 320 original KCSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint

Ready to practise?

Put this into practice with a full scored session.

Start practice session

Scored practice sessions

Short scored sets — answer, get feedback, read the explanation, move on.

KCSA Practice Questions 2 — 50 Questions→KCSA Practice Test 5 — 25 Questions→

Practice by domain

Drill one exam section at a time instead of jumping between unrelated topics.

Kubernetes Cluster Component Security Kubernetes Threat Model Platform Security

Practice by scenario

Practise one question format at a time: exhibits, multi-select, drag-and-drop, troubleshooting.

Browse scenarios

Topic-level practice

One concept per page — questions, worked explanations, and a short concept guide.

Kubernetes Cluster Component Security practice questions Platform Security practice questions Overview OF Cloud Native Security practice questions Compliance And Security Frameworks practice questions KCSA scenario practice questions

Where to go next

Exam domains KCSA practice test All CNCF / Linux Foundation practice questions

This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.