View Full Linux Foundation KCSA Exam Dumps and Practice Test Dumps

 

Question 41.

An organization wants to reduce the risk that a compromised pod can communicate freely with every other workload in the cluster. Which security control should be implemented?

1. NetworkPolicies with explicitly allowed communication paths
2. Additional ReplicaSets
3. Horizontal Pod Autoscaling
4. Larger persistent volumes

Correct Answer: 1. NetworkPolicies with explicitly allowed communication paths

Explanation:

NetworkPolicies can restrict ingress and egress communication for selected pods when the cluster networking implementation supports policy enforcement. Instead of allowing every workload to communicate freely, the organization can define only the connections required for legitimate application behavior. A common approach is to establish restrictive defaults and then permit necessary traffic between application tiers, namespaces, or external destinations. This reduces opportunities for lateral movement if a workload is compromised. NetworkPolicies should be considered one layer of protection rather than a complete security boundary. They work best alongside workload identity, RBAC, secure application design, runtime monitoring, and appropriate encryption for sensitive communications.

Question 42.

Which Kubernetes security practice BEST reduces the risk associated with a pod unnecessarily accessing the host network namespace?

1. Increase the pod replica count
2. Avoid hostNetwork: true unless there is a justified requirement
3. Use a larger node instance
4. Disable application logging

Correct Answer: 2. Avoid hostNetwork: true unless there is a justified requirement

Explanation:

Using the host network namespace gives a pod direct access to the node’s network namespace and can weaken normal network isolation between containers and the host. Most applications do not require this level of access. Avoiding hostNetwork: true unless there is a clear operational need supports least privilege and reduces exposure to host-level networking resources. If host networking is necessary, the organization should apply additional controls such as restrictive permissions, limited container capabilities, careful network policy design where applicable, and strong monitoring. Security reviews should treat host-level namespace access as a sensitive exception rather than a normal workload configuration.

Question 43.

What is the primary security concern with mounting the container runtime socket, such as a Docker or container runtime socket, inside an application container?

1. It may allow the container to control or interact with the host container runtime
2. It prevents DNS resolution
3. It disables Kubernetes Services
4. It makes the image read-only

Correct Answer: 1. It may allow the container to control or interact with the host container runtime

Explanation:

A container runtime socket can provide powerful control over container creation, execution, and host-level resources. If an application container can access that socket, a compromise of the application may allow an attacker to create highly privileged containers, mount host filesystems, or otherwise interact with the node in dangerous ways. This can turn a workload compromise into a broader node compromise. Runtime sockets should not be mounted into ordinary application containers unless there is a carefully justified requirement. Alternatives should be considered whenever possible, and workloads requiring such access should receive additional security review, isolation, monitoring, and tightly controlled permissions.

Question 44.

Which configuration is MOST appropriate when an application does not need to write to its root filesystem?

1. Run the container in privileged mode
2. Mount the host filesystem
3. Configure a read-only root filesystem
4. Grant additional Linux capabilities

Correct Answer: 3. Configure a read-only root filesystem

Explanation:

A read-only root filesystem limits the ability of processes inside a container to modify binaries, libraries, configuration files, and other content in the container image. If an attacker gains code execution, this restriction can make persistence and certain forms of tampering more difficult. Applications that need temporary or persistent writable storage can use specifically defined writable volumes rather than making the entire root filesystem writable. This setting should be combined with other workload-hardening controls, including non-root execution, dropping unnecessary capabilities, preventing privilege escalation, and applying seccomp or mandatory access control profiles. No single control is sufficient, but a read-only filesystem meaningfully reduces the writable attack surface.

Question 45.

Which security approach BEST limits the permissions of an application pod that only needs to read ConfigMaps in its own namespace?

1. Create a namespaced Role with read permissions on ConfigMaps and bind it to the pod’s service account
2. Grant the service account cluster-admin
3. Create a ClusterRoleBinding that grants full access to all Secrets
4. Use the default service account with unrestricted permissions

Correct Answer: 1. Create a namespaced Role with read permissions on ConfigMaps and bind it to the pod’s service account

Explanation:

The principle of least privilege calls for granting only the permissions required for a workload to perform its function. If a pod only needs to read ConfigMaps in one namespace, a namespaced Role can define the required get, list, or watch permissions on ConfigMaps, and a RoleBinding can assign those permissions to the workload’s service account. Granting cluster-admin or broad cluster-level access would substantially increase the impact of a compromise. Dedicated service accounts are also preferable to unnecessarily sharing identities across unrelated workloads. Permissions should be reviewed periodically so old or excessive access does not remain after application requirements change.

Question 46.

A security team discovers that many pods automatically receive service account tokens even though the applications never call the Kubernetes API. Which mitigation should be considered?

1. Increase CPU requests
2. Disable automatic service account token mounting where it is not required
3. Add more namespaces
4. Increase pod restart limits

Correct Answer: 2. Disable automatic service account token mounting where it is not required

Explanation:

A service account token can be useful when a workload needs to authenticate to the Kubernetes API, but it creates unnecessary exposure when the application never uses it. If a container is compromised, an automatically mounted token could potentially be stolen and used according to the service account’s permissions. Disabling automatic token mounting for workloads that do not require Kubernetes API access reduces credential exposure and follows least-privilege principles. Workloads that genuinely need API access should use dedicated service accounts with narrowly scoped RBAC permissions. The organization should also review token lifetime, audience, and credential-handling practices as part of a broader workload identity strategy.

Question 47.

Which security control can be used to reject a pod that requests privileged mode before the pod is admitted to the cluster?

1. Admission policy enforcement
2. Horizontal Pod Autoscaler
3. Service load balancing
4. PersistentVolume reclaim policy

Correct Answer: 1. Admission policy enforcement

Explanation:

Admission controls operate on Kubernetes API requests after authentication and authorization but before objects are persisted. They can enforce workload security requirements by rejecting configurations that violate policy. For example, an admission policy can deny privileged containers, host namespace access, prohibited volume types, or workloads running as root. Pod Security Admission and other policy engines can be used to implement these requirements depending on the environment. Admission controls are especially valuable because they prevent insecure configurations from reaching runtime. They should complement secure defaults, CI/CD checks, image verification, RBAC, and monitoring rather than serving as the only security safeguard.

Question 48.

Which statement BEST describes the purpose of the Kubernetes Restricted Pod Security Standard?

1. It provides a baseline for unrestricted administrative workloads
2. It is designed to require strongly hardened pod configurations using current pod-security best practices
3. It configures cluster DNS
4. It automatically scans container images for vulnerabilities

Correct Answer: 2. It is designed to require strongly hardened pod configurations using current pod-security best practices

Explanation:

The Restricted Pod Security Standard represents a strongly hardened set of workload security expectations. It limits configurations that commonly increase risk, such as privileged containers, unnecessary privilege escalation, unsafe capabilities, and certain host-level access. The intent is to promote modern workload-hardening practices that are suitable for many ordinary application environments. It does not replace image scanning, network controls, RBAC, or runtime monitoring. Organizations should evaluate compatibility carefully because some system components or specialized workloads may legitimately require exceptions. Where exceptions exist, they should be narrowly scoped, documented, reviewed, and protected with compensating controls.

Question 49.

Why should production Kubernetes clusters generally restrict the use of hostPath volumes?

1. hostPath can expose files and directories from the Kubernetes node to a pod
2. hostPath prevents containers from starting
3. hostPath disables network traffic
4. hostPath automatically grants cluster-admin permissions

Correct Answer: 1. hostPath can expose files and directories from the Kubernetes node to a pod

Explanation:

A hostPath volume mounts part of the node’s filesystem directly into a pod. Depending on the path and mount permissions, this can expose sensitive files, runtime sockets, credentials, or system configuration to the container. A compromised workload may then be able to read or modify host resources, increasing the risk of node compromise. Most ordinary applications should use safer storage mechanisms rather than direct host filesystem access. If hostPath is unavoidable for a system component, the path should be narrowly selected, write access should be minimized, and the workload should receive additional isolation, policy enforcement, and security monitoring.

Question 50.

Which Kubernetes security setting helps ensure a container does not execute as UID 0 when the application supports non-root execution?

1. runAsNonRoot: true
2. hostPID: true
3. privileged: true
4. hostIPC: true

Correct Answer: 1. runAsNonRoot: true

Explanation:

Setting runAsNonRoot: true tells Kubernetes that the container should not run as the root user. This supports least privilege by reducing the authority available to an application process if it becomes compromised. The image and runtime user configuration must be compatible with non-root execution for the workload to start successfully. This control is stronger when combined with an explicitly defined non-root user, restricted Linux capabilities, allowPrivilegeEscalation: false, read-only filesystems where practical, and appropriate seccomp or mandatory access control profiles. Rootless execution does not eliminate all risk, but it reduces the consequences of many common container compromise scenarios.

Question 51.

An organization wants to reduce the possibility that a compromised container can use powerful Linux kernel capabilities. Which configuration approach is BEST?

1. Add all available capabilities
2. Run the container in privileged mode
3. Drop unnecessary capabilities and add back only those explicitly required
4. Enable host PID access

Correct Answer: 3. Drop unnecessary capabilities and add back only those explicitly required

Explanation:

Linux capabilities divide traditional root privileges into more granular permissions. Many containers do not need the full set of capabilities available by default. Dropping unnecessary capabilities reduces the actions a compromised process may perform, such as changing system settings or interacting with sensitive kernel features. A strong security approach is to start with a restricted capability set and add back only those capabilities that are demonstrably required by the application. This aligns with least privilege. Capability reduction should be used together with non-root execution, seccomp, mandatory access control, restricted filesystem access, and avoidance of privileged mode.

Question 52.

Which practice BEST improves the security of container images before they reach a production cluster?

1. Allow developers to deploy any locally built image directly to production
2. Use a controlled build pipeline with vulnerability scanning, provenance, signing, and trusted registries
3. Disable image scanning to improve build speed
4. Use only mutable tags such as latest

Correct Answer: 2. Use a controlled build pipeline with vulnerability scanning, provenance, signing, and trusted registries

Explanation:

A controlled software supply chain reduces the risk of tampered, vulnerable, or unauthorized artifacts reaching production. Secure pipelines can scan dependencies and images for known vulnerabilities, generate provenance information, sign approved artifacts, and publish them only to trusted registries. Admission controls can then verify that deployed images meet organizational requirements. Mutable tags such as latest weaken reproducibility and make investigations harder because the referenced image may change over time. Supply chain security is strongest when source protection, dependency management, secure builds, artifact integrity, registry controls, deployment policy, and runtime monitoring are treated as connected layers.

Question 53.

What is the primary security value of deploying a container image by immutable digest rather than only by a mutable tag?

1. It identifies the exact image content that should be executed
2. It automatically patches all vulnerabilities
3. It grants additional Kubernetes permissions
4. It encrypts the container’s network traffic

Correct Answer: 1. It identifies the exact image content that should be executed

Explanation:

An immutable image digest identifies a specific image based on its content, allowing operators to know exactly which artifact is being deployed. Tags can be changed to reference different images, so relying only on mutable tags can create ambiguity and make reproducibility more difficult. Using digests improves auditability, rollback confidence, and incident investigation because the deployed artifact can be identified precisely. Digests do not prove that an image is trustworthy or vulnerability-free, so organizations should combine them with signed artifacts, provenance verification, trusted registries, image scanning, and admission policies that enforce approved image sources.

Question 54.

A vulnerability scanner reports a critical vulnerability in a library included in an application image. What is the MOST appropriate response?

1. Ignore the finding because containers are isolated
2. Assess exploitability and exposure, then patch, update, or replace the vulnerable component according to risk
3. Disable vulnerability scanning
4. Increase the number of pod replicas

Correct Answer: 2. Assess exploitability and exposure, then patch, update, or replace the vulnerable component according to risk

Explanation:

A vulnerability finding should be evaluated in context. Security teams should determine whether the vulnerable component is present, reachable, and exploitable in the deployed application, then prioritize remediation according to severity, exposure, and business impact. Appropriate responses may include updating the dependency, rebuilding the image, changing the base image, applying configuration mitigations, or temporarily restricting exposure. Containers do not make vulnerable software harmless, and scaling replicas does nothing to address the issue. Mature vulnerability management combines scanning, asset inventory, risk assessment, remediation, retesting, and continuous monitoring for newly disclosed vulnerabilities.

Question 55.

Which artifact can help an organization quickly determine whether its container images include a newly vulnerable open-source library?

1. Software Bill of Materials
2. Kubernetes Service
3. PodDisruptionBudget
4. IngressClass

Correct Answer: 1. Software Bill of Materials

Explanation:

A Software Bill of Materials, or SBOM, provides an inventory of software components and dependencies included in an application or container image. When a new vulnerability is disclosed, the organization can compare the affected package or library against its SBOM data to identify potentially impacted applications more quickly. SBOMs improve supply chain transparency and support vulnerability response, but they do not replace vulnerability scanning or remediation. Their value depends on being complete, accurate, associated with specific artifacts, and kept aligned with the software actually deployed. SBOMs are most effective as part of a broader software supply chain security program.

Question 56.

Which runtime observation would be MOST suspicious for a production web container that normally runs only one application process?

1. A replica restart after a planned update
2. An unexpected interactive shell and unfamiliar process being launched inside the container
3. Normal HTTP traffic to the application port
4. A health probe accessing its configured endpoint

Correct Answer: 2. An unexpected interactive shell and unfamiliar process being launched inside the container

Explanation:

Unexpected process creation can be an important runtime security signal. A production web container that normally runs only a known application process may not have any legitimate reason to launch an interactive shell, network utility, cryptocurrency miner, or unfamiliar executable. Such behavior could indicate exploitation, unauthorized administration, or malicious code execution. Runtime monitoring tools can detect process launches, system calls, file modifications, and network activity that deviate from expected behavior. Alerts should be investigated in context to reduce false positives. Runtime detection complements preventive controls because attackers may still exploit application vulnerabilities even when images and cluster configurations were initially secure.

Question 57.

What is the primary value of Kubernetes audit logs during a security incident?

1. They can provide a record of API requests, identities, resources, and outcomes for investigation
2. They automatically block every malicious request
3. They replace RBAC
4. They patch vulnerable container images

Correct Answer: 1. They can provide a record of API requests, identities, resources, and outcomes for investigation

Explanation:

Kubernetes audit logs can record activity directed at the API server, including who made a request, what action was requested, which resource was involved, and whether the request succeeded. During incident response, this information can help investigators reconstruct administrative actions, suspicious resource creation, Secret access, privilege changes, and other important events. Audit logging should be configured before an incident occurs, with an appropriate policy that balances visibility, storage cost, and sensitive-data exposure. Logs should also be forwarded or protected so an attacker with cluster access cannot easily erase evidence. Audit logs support investigation but do not replace preventive controls.

Question 58.

A cluster administrator wants to reduce the chance that attackers can use stolen credentials without detection. Which approach BEST supports this goal?

1. Share credentials among administrators
2. Use strong authentication, individual identities, least privilege, short-lived credentials where practical, and audit monitoring
3. Disable audit logging
4. Grant all authenticated users cluster-admin

Correct Answer: 2. Use strong authentication, individual identities, least privilege, short-lived credentials where practical, and audit monitoring

Explanation:

Credential security is strongest when several controls work together. Individual identities improve accountability, strong authentication makes credential theft harder, least privilege limits what compromised credentials can do, and shorter-lived credentials can reduce the duration of exposure. Audit monitoring can help detect abnormal or unauthorized activity. Shared administrator credentials weaken attribution and usually provide excessive access. Organizations should also secure credential storage, rotate compromised secrets, use approved identity providers where appropriate, and monitor authentication behavior. These practices reduce both the probability and potential impact of credential misuse in Kubernetes and related cloud-native systems.

Question 59.

An organization wants to limit the impact of a compromise in one application namespace. Which strategy BEST reflects defense in depth?

1. Use namespace-scoped RBAC, restrictive NetworkPolicies, hardened workloads, dedicated service accounts, and monitoring
2. Rely only on the namespace name
3. Give every namespace the same cluster-admin service account
4. Allow unrestricted network traffic between all namespaces

Correct Answer: 1. Use namespace-scoped RBAC, restrictive NetworkPolicies, hardened workloads, dedicated service accounts, and monitoring

Explanation:

Namespaces provide useful organizational boundaries but do not create complete security isolation by themselves. Stronger separation requires multiple supporting controls. Namespace-scoped RBAC can restrict API permissions, dedicated service accounts prevent unnecessary identity sharing, NetworkPolicies can limit lateral communication, workload-hardening settings reduce privilege, and monitoring provides visibility into suspicious activity. Resource quotas and admission policies can add further protection. Granting shared cluster-wide identities or unrestricted network access would undermine the intended separation. Defense in depth assumes individual controls may fail, so multiple layers are used to contain compromise and reduce an attacker’s ability to move elsewhere in the cluster.

Question 60.

Which approach BEST represents a mature cloud-native security program for Kubernetes workloads?

1. Focus exclusively on perimeter firewalls
2. Scan container images once before initial deployment and take no further action
3. Integrate security across source code, dependencies, build systems, registries, deployment policies, workload identity, network controls, runtime detection, and incident response
4. Depend entirely on Kubernetes defaults

Correct Answer: 3. Integrate security across source code, dependencies, build systems, registries, deployment policies, workload identity, network controls, runtime detection, and incident response

Explanation:

A mature cloud-native security program treats security as a continuous lifecycle rather than a single product or deployment gate. Source repositories and CI/CD systems must be protected, dependencies inventoried, images scanned and signed, registries controlled, and admission policies used to prevent unsafe deployments. Runtime environments then require least-privilege identities, hardened containers, network restrictions, audit logging, behavioral monitoring, and tested incident-response procedures. Continuous vulnerability management is necessary because new weaknesses can be discovered after deployment. This layered approach provides stronger resilience than relying only on perimeter controls, one-time scanning, or default Kubernetes settings, and it better reflects the dynamic nature of cloud-native systems.