Kubernetes and Cloud Native Security Associate (KCSA) - Blueprint Practice Exam 1

1. A cloud provider secures physical hardware. What remains the cluster operator's responsibility in a self-managed cluster?
2. A cluster encrypts Secrets in etcd. What additional protection is still required?
3. A cluster's API server certificate expires. Which operational practice best prevents this availability risk?
4. A compromised Pod can read the host filesystem through an unrestricted hostPath mount. Which boundary is weakened?
5. A deployment requires a narrowly scoped security exception. What is the best handling approach?
6. A namespace has a default-deny ingress NetworkPolicy. How should an approved frontend reach its database?
7. A namespace should reject privileged containers under a standard workload baseline. Which mechanism can enforce this at admission?
8. A platform uses one long-lived administrator kubeconfig in every CI job. What is a better design?
9. A Pod accesses the cloud instance metadata endpoint and obtains excessive permissions. Which control should be assessed?
10. A Pod does not call the Kubernetes API. Which change reduces unnecessary credential exposure?
11. A Pod sets runAsNonRoot: true. What is the intended effect?
12. A policy exception expires while the affected application is still running. What should happen?
13. A production policy requires images signed by trusted build identities. What enforces the policy before workload creation?
14. A public image repository contains a credential accidentally baked into an old layer. Which response is appropriate?
15. A scheduler places a Pod on a node. Does that decision replace runtime security enforcement?
16. A Secret manifest contains base64 data. What must the operator understand?
17. A security team maps data flows between workloads and external services. What does this support?
18. A service account should read ConfigMaps only within its own namespace. Which RBAC grant fits?
19. A service mesh enforces mutual TLS between workloads. What remains necessary?
20. A team patches its application but leaves a vulnerable node operating system. Which cloud-native security idea explains the gap?
21. A team uses a benchmark to assess its Kubernetes configuration. How should deviations be handled?
22. A tenant container must not access the host's control interfaces. Which design objective is most relevant?
23. A workload needs temporary API credentials. Which approach is preferable to long-lived copied tokens?
24. An API server's anonymous access exposes more resources than intended. Which controls should be reviewed?
25. An attacker exhausts node memory by creating many workloads. Which combination helps reduce this risk?
26. An attacker gains access to a node's kubelet API. Why is this serious?
27. An attacker persists through an unauthorized DaemonSet. Why might deleting one affected Pod be insufficient?
28. An auditor asks for evidence that production workloads meet the approved security baseline. What is strongest?
29. An exposed dashboard allows unauthenticated workload creation. What is the primary risk?
30. An image comes from an unknown public registry. What should happen before production admission?
31. An image has a known critical flaw. Why is signature verification alone insufficient?
32. An operator protects etcd backups but leaves old copies in a public bucket. What remains exposed?
33. What does a software bill of materials primarily provide?
34. Which setting helps prevent a container process from gaining additional privileges through setuid mechanisms?
35. Why is a compromised cluster-admin identity particularly dangerous?
36. Why should access to etcd be tightly restricted?
37. Why should audit logging be configured for sensitive Kubernetes API operations?
38. Why should cluster components and node software follow a planned patch lifecycle?
39. Why should container runtime sockets not be mounted into ordinary application Pods?
40. Why should control-plane components use authenticated, encrypted communication?

Comments — 0