View Full Linux Foundation KCSA Exam Dumps and Practice Test Dumps

 

Question 21.

Which Kubernetes component is responsible for storing cluster configuration and state data?

1. etcd
2. kube-proxy
3. CoreDNS
4. kubelet

Correct Answer: 1. etcd

Explanation:

etcd is the distributed key-value store used by Kubernetes to persist cluster state and configuration data. Because it contains sensitive and operationally critical information, access to etcd should be tightly restricted. Organizations should also protect backups, use secure communication, and apply encryption at rest where appropriate. Compromise of etcd can expose Secrets, configuration, and other important cluster information.

Question 22.

Which Kubernetes component enforces pod specifications and manages containers on an individual node?

1. kube-scheduler
2. kubelet
3. API server
4. controller manager

Correct Answer: 2. kubelet

Explanation:

The kubelet runs on each Kubernetes node and ensures that containers described in assigned Pod specifications are running as expected. Because it interacts closely with the container runtime and node operating system, securing kubelet access is important. Unauthorized access to kubelet interfaces can increase the risk of workload or node compromise.

Question 23.

Why should direct access to the Kubernetes API server be tightly controlled?

1. It provides an administrative interface for managing cluster resources
2. It only serves static web pages
3. It controls physical network switches
4. It stores container images

Correct Answer: 1. It provides an administrative interface for managing cluster resources

Explanation:

The Kubernetes API server is the main interface through which cluster resources are created, modified, and queried. Excessive or unauthorized access could allow attackers to create workloads, read sensitive resources, or change cluster configuration. Strong authentication, authorization, network controls, audit logging, and least-privilege permissions are therefore important protections.

Question 24.

Which practice BEST reduces the security risk associated with Kubernetes administrative credentials?

1. Share one administrator credential across the team
2. Store credentials in public repositories
3. Use individual identities with least-privilege access and strong authentication
4. Disable audit logging

Correct Answer: 3. Use individual identities with least-privilege access and strong authentication

Explanation:

Individual identities improve accountability and make it easier to grant only the permissions each administrator needs. Strong authentication further reduces the risk of credential misuse. Shared administrator credentials weaken auditing and make it difficult to determine who performed an action. Credentials should also be protected from source-code repositories and other insecure storage.

Question 25.

What is the primary purpose of a RoleBinding in Kubernetes RBAC?

1. Grant permissions defined by a Role or ClusterRole to subjects within a namespace
2. Encrypt network traffic
3. Store application configuration
4. Schedule pods to nodes

Correct Answer: 1. Grant permissions defined by a Role or ClusterRole to subjects within a namespace

Explanation:

A RoleBinding associates users, groups, or service accounts with permissions defined in a Role or ClusterRole for a particular namespace. It is an important mechanism for implementing least privilege. ClusterRoleBindings, by contrast, can grant permissions at cluster scope. Careful use of bindings helps avoid unnecessarily broad administrative access.

Question 26.

Which Kubernetes RBAC object can define permissions that apply across the entire cluster?

1. ConfigMap
2. ClusterRole
3. Service
4. ReplicaSet

Correct Answer: 2. ClusterRole

Explanation:

A ClusterRole defines permissions that can apply to cluster-scoped resources or be reused across namespaces. It does not grant access by itself; permissions become effective when associated with subjects through a RoleBinding or ClusterRoleBinding. ClusterRoles should be designed carefully because broad permissions can substantially increase the impact of compromised credentials.

Question 27.

Why is granting wildcard permissions in Kubernetes RBAC generally discouraged?

1. It can provide broader access than a user or workload actually requires
2. It prevents pods from starting
3. It disables encryption
4. It prevents DNS resolution

Correct Answer: 1. It can provide broader access than a user or workload actually requires

Explanation:

Wildcard permissions can grant access to many resource types or actions, including future resources that were not considered when the policy was created. This conflicts with least privilege and increases the potential impact of account compromise. Explicit permissions should be preferred where practical so authorization remains understandable and narrowly scoped.

Question 28.

Which Kubernetes security setting can help prevent a container process from gaining additional Linux privileges?

1. allowPrivilegeEscalation: false
2. replicas: 10
3. hostNetwork: true
4. schedulerName

Correct Answer: 1. allowPrivilegeEscalation: false

Explanation:

Setting allowPrivilegeEscalation to false helps prevent a process inside a container from gaining more privileges than its parent process. This is an important workload-hardening measure. It should be combined with non-root execution, limited capabilities, seccomp profiles, and avoidance of privileged containers to reduce the impact of a compromise.

Question 29.

Which workload configuration increases security risk by giving a container broad access to host-level capabilities?

1. Running the container in privileged mode
2. Using a read-only root filesystem
3. Dropping Linux capabilities
4. Running as a non-root user

Correct Answer: 1. Running the container in privileged mode

Explanation:

Privileged containers receive extensive access to host capabilities and devices, substantially weakening container isolation. If compromised, such a container may provide an attacker with significant control over the node. Privileged mode should therefore be avoided unless there is a well-understood and justified requirement, with additional controls applied where necessary.

Question 30.

What is the security benefit of configuring a container filesystem as read-only when the application supports it?

1. It limits unauthorized modification of files inside the container filesystem
2. It guarantees network encryption
3. It replaces RBAC
4. It increases cluster CPU capacity

Correct Answer: 1. It limits unauthorized modification of files inside the container filesystem

Explanation:

A read-only root filesystem makes it more difficult for an attacker or compromised process to modify executables, configuration, or other filesystem content inside the container. Applications can still use explicitly writable volumes where necessary. This control supports workload hardening but should be combined with other protections such as non-root execution and limited capabilities.

Question 31.

Which Linux security technology can restrict the system calls a container process is allowed to make?

1. seccomp
2. DNS
3. DHCP
4. RAID

Correct Answer: 1. seccomp

Explanation:

seccomp can restrict the Linux system calls available to a process. Containers typically require only a subset of all kernel system calls, so limiting access can reduce the attack surface. A well-designed seccomp profile helps prevent compromised applications from invoking dangerous or unnecessary kernel functionality.

Question 32.

Which security mechanism can provide mandatory access control for containerized workloads on supported Linux systems?

1. AppArmor or SELinux
2. Horizontal Pod Autoscaler
3. CoreDNS
4. IngressClass

Correct Answer: 1. AppArmor or SELinux

Explanation:

AppArmor and SELinux provide mandatory access control mechanisms that can restrict how processes interact with files, devices, and other system resources. When properly configured, they provide another layer of workload containment beyond traditional Unix permissions. They are commonly used as part of defense-in-depth strategies for Linux and container environments.

Question 33.

Why should container images avoid unnecessary package managers and debugging tools in production?

1. They can increase the image attack surface and provide useful tools to an attacker
2. They prevent Kubernetes from using Services
3. They disable persistent storage
4. They prevent pod scheduling

Correct Answer: 1. They can increase the image attack surface and provide useful tools to an attacker

Explanation:

Unnecessary tools and packages increase the number of components that may contain vulnerabilities. They can also provide useful utilities to an attacker after a workload is compromised. Production images should generally contain only what the application needs to run, while debugging can be handled through controlled operational processes.

Question 34.

Which practice provides the strongest protection against accidentally deploying an untrusted container image?

1. Use trusted registries and verify image signatures or provenance
2. Use the latest tag for every image
3. Allow anyone to push images
4. Disable admission controls

Correct Answer: 1. Use trusted registries and verify image signatures or provenance

Explanation:

Trusted registries combined with artifact-signing and verification policies help establish that an image came from an expected source and has not been altered. Provenance can also provide information about how the artifact was built. This strengthens supply chain security and reduces the risk of deploying unauthorized or tampered images.

Question 35.

Why is using the latest container image tag often discouraged for production deployments?

1. It can make the exact deployed image ambiguous and reduce reproducibility
2. It prevents network access
3. It disables logging
4. It blocks RBAC

Correct Answer: 1. It can make the exact deployed image ambiguous and reduce reproducibility

Explanation:

The latest tag can point to different images over time, making it harder to determine exactly which artifact was deployed. Using immutable tags or image digests improves reproducibility, auditability, and rollback confidence. Security investigations also benefit from being able to identify the exact artifact that was running at a particular time.

Question 36.

Which supply chain artifact can provide information about the components and dependencies included in software?

1. Software Bill of Materials
2. ServiceAccount
3. NetworkPolicy
4. Ingress

Correct Answer: 1. Software Bill of Materials

Explanation:

A Software Bill of Materials, or SBOM, provides an inventory of software components and dependencies used in an application or image. This information can help organizations determine whether a newly disclosed vulnerability affects their software. SBOMs improve supply chain visibility but should be combined with vulnerability management and secure build practices.

Question 37.

Why should CI/CD pipeline credentials be treated as highly sensitive?

1. They may have permission to build, publish, or deploy production artifacts
2. They only control UI themes
3. They cannot affect Kubernetes resources
4. They are always public information

Correct Answer: 1. They may have permission to build, publish, or deploy production artifacts

Explanation:

CI/CD credentials can provide powerful access to source repositories, registries, cloud environments, and Kubernetes clusters. If compromised, attackers may be able to modify software or inject malicious artifacts into trusted deployment pipelines. Pipeline credentials should therefore use least privilege, secure secret storage, rotation, monitoring, and restricted access.

Question 38.

Which practice BEST protects a Kubernetes cluster from vulnerable third-party dependencies?

1. Continuously inventory and scan dependencies and update vulnerable components
2. Never update software
3. Disable vulnerability scanning
4. Trust every dependency automatically

Correct Answer: 1. Continuously inventory and scan dependencies and update vulnerable components

Explanation:

Third-party libraries and packages can introduce vulnerabilities even when application code is secure. Organizations should maintain dependency inventories, scan for known issues, assess exploitability, and patch or replace vulnerable components. This process should continue throughout the application lifecycle because new vulnerabilities are discovered after software has already been deployed.

Question 39.

Which security control can help detect an unexpected shell being launched inside a production container?

1. Runtime monitoring and behavioral detection
2. Horizontal Pod Autoscaling
3. Service discovery
4. Storage provisioning

Correct Answer: 1. Runtime monitoring and behavioral detection

Explanation:

Runtime security tools can observe process creation, system calls, network activity, and other workload behavior. An unexpected interactive shell inside a production container may indicate compromise or unauthorized administrative activity. Behavioral detection helps identify suspicious activity that static image scanning cannot detect after deployment.

Question 40.

Which approach BEST improves Kubernetes security across the full application lifecycle?

1. Rely only on runtime monitoring
2. Focus only on securing the cluster perimeter
3. Combine secure development, trusted builds, image scanning, admission policies, least privilege, network controls, and runtime monitoring
4. Give every workload administrator permissions

Correct Answer: 3. Combine secure development, trusted builds, image scanning, admission policies, least privilege, network controls, and runtime monitoring

Explanation:

Cloud-native security should cover the complete lifecycle rather than relying on one control. Secure development and supply chain protections reduce risk before deployment, admission controls enforce policy, RBAC and network policies limit access, and runtime monitoring helps detect active threats. Layering these controls creates defense in depth and reduces dependence on any single security mechanism.