View Full Linux Foundation KCSA Exam Dumps and Practice Test Dumps

 

Question 321.

A workload needs to watch Deployments in a single namespace but does not need to modify any Kubernetes resources. Which RBAC design BEST follows least privilege?

1. Create a dedicated service account with a namespaced Role granting only get, list, and watch on Deployments
2. Bind the workload to a ClusterRole that permits read access to all workload and Secret resources
3. Grant namespace-admin temporarily and remove it after each deployment
4. Use the default service account with permission to read every resource in the namespace

Correct Answer: 1. Create a dedicated service account with a namespaced Role granting only get, list, and watch on Deployments

Explanation:

A namespaced Role can grant exactly the verbs and resource scope the workload requires. If the application only watches Deployments in one namespace, it should not receive write access, Secret access, or cluster-wide visibility. A dedicated service account also separates its identity from unrelated workloads and makes auditing easier. Granting broader read access may still expose sensitive configuration, while temporary namespace administration creates unnecessary privilege during the time it is active. Using the default service account can unintentionally couple multiple workloads to the same permissions. Kubernetes authorization should be explicit and narrowly scoped. Periodic permission reviews and audit logging help ensure the workload’s access remains aligned with its actual operational requirements over time.

Question 322.

A security engineer finds that an application service account can create Secrets even though its documented function only requires reading Services. What is the BEST remediation?

1. Keep the permission but monitor Secret creation through audit logs
2. Replace the service account with the namespace default account
3. Remove the unnecessary Secret-creation permission and retain only the required Service-read access
4. Restrict the workload’s network egress while keeping its RBAC unchanged

Correct Answer: 3. Remove the unnecessary Secret-creation permission and retain only the required Service-read access

Explanation:

Least privilege requires removing permissions that are not needed for the application’s current function. Permission to create Secrets can be abused by a compromised workload to introduce credentials, manipulate application behavior, or support persistence. Audit monitoring is useful but does not eliminate the risk created by excessive authorization. Replacing the dedicated identity with the default service account may make separation worse, while egress restrictions address network behavior rather than Kubernetes API permissions. RBAC should be reviewed not only for obvious administrator rights but also for write permissions that could be chained with other capabilities. A dedicated service account with narrowly scoped read access provides better containment and makes unauthorized API behavior easier to identify and investigate.

Question 323.

Which permission should be treated as especially sensitive because it can allow a user to assume another Kubernetes identity?

1. Permission to list Services
2. Permission to impersonate users, groups, or service accounts
3. Permission to read Pod status
4. Permission to watch Deployments

Correct Answer: 2. Permission to impersonate users, groups, or service accounts

Explanation:

Impersonation can allow one identity to submit Kubernetes API requests as another user, group, or service account. If the impersonated principal has stronger permissions, this may become a direct privilege-escalation path. For that reason, impersonation should be granted only to trusted systems or administrators with a clear and documented need. Listing Services, reading Pod status, and watching Deployments can reveal operational information but do not normally provide the same ability to assume another security context. Audit logs should capture impersonation activity so unexpected use can be investigated. RBAC reviews should consider indirect escalation paths such as impersonation, binding creation, or the ability to create workloads that inherit more privileged identities.

Question 324.

A company wants to enforce that ordinary workloads cannot use privileged mode, hostPID, hostIPC, or hostNetwork. Which security mechanism is BEST suited to enforce this before execution?

1. A centralized SIEM rule
2. An egress NetworkPolicy
3. A namespace ResourceQuota
4. Admission policy enforcement

Correct Answer: 4. Admission policy enforcement

Explanation:

Admission policies evaluate workload specifications before Kubernetes accepts and schedules them. This makes admission a strong preventive enforcement point for known-risk settings such as privileged mode, host namespace access, excessive capabilities, or dangerous hostPath mounts. A SIEM can detect suspicious events after they occur, but it does not prevent the deployment by itself. NetworkPolicies control traffic, and ResourceQuotas control resource consumption. Admission controls can align with Pod Security Standards or custom organization policies. Legitimate infrastructure components that require elevated access should follow a documented exception process and may need dedicated nodes, stricter RBAC, or enhanced monitoring. Preventive enforcement is generally more effective than relying only on post-deployment alerts for configuration risks that are known in advance.

Question 325.

A container needs to write only to /var/app/cache. Which design BEST limits filesystem modification if the workload is compromised?

1. Use a read-only root filesystem and mount a writable volume only at /var/app/cache
2. Keep the entire root filesystem writable but use non-root execution
3. Mount the node’s /var directory into the container
4. Use privileged mode but configure the application directory as read-only

Correct Answer: 1. Use a read-only root filesystem and mount a writable volume only at /var/app/cache

Explanation:

A read-only root filesystem reduces the ability of a compromised application to alter packaged binaries, libraries, or configuration files. If the application needs only one writable location, a dedicated volume at that path follows least privilege for filesystem access. Running as non-root is valuable but does not prevent modification of files the process is authorized to write. Mounting a host directory unnecessarily exposes node resources, while privileged mode weakens multiple isolation controls. A secure design should make only the paths required by the application writable. This can be combined with non-root execution, dropped capabilities, seccomp, AppArmor or SELinux, and allowPrivilegeEscalation: false for stronger layered workload hardening.

Question 326.

A containerized application requires one specific Linux capability to function. Which configuration is MOST appropriate?

1. Retain the entire default capability set to avoid compatibility issues
2. Drop unnecessary capabilities and add back only the capability the application requires
3. Run the container as privileged but restrict access through NetworkPolicies
4. Grant SYS_ADMIN because it covers many possible future requirements

Correct Answer: 2. Drop unnecessary capabilities and add back only the capability the application requires

Explanation:

Linux capabilities divide traditional root authority into smaller privileges. A container that needs only one capability should not receive a broad default set or privileged mode. Dropping unnecessary capabilities and explicitly adding back only the required one follows least privilege and reduces the actions available to an attacker after compromise. SYS_ADMIN is particularly powerful and should not be granted as a general compatibility measure. NetworkPolicies control connectivity and cannot compensate for excessive kernel-level privileges. Capability reduction is most effective when combined with non-root execution, disabled privilege escalation, seccomp, mandatory access control, and limited writable storage. The application should be tested with the minimized capability set so security improvements do not unintentionally break required functionality.

Question 327.

Which security setting MOST directly prevents a container process from gaining more privileges than its parent process?

1. runAsNonRoot: true
2. readOnlyRootFilesystem: true
3. allowPrivilegeEscalation: false
4. automountServiceAccountToken: false

Correct Answer: 3. allowPrivilegeEscalation: false

Explanation:

allowPrivilegeEscalation: false is designed to prevent a process from gaining additional privileges through mechanisms such as setuid executables or file capabilities. Running as non-root is also important but does not specifically control privilege transitions. A read-only root filesystem limits modification and persistence, while disabling service account token mounting protects Kubernetes API credentials. These controls address different parts of the attack surface and work best together. Strong workload hardening typically includes non-root execution, capability minimization, disabled privilege escalation, seccomp, mandatory access control, and restricted writable paths. Layered controls reduce the likelihood that a single application vulnerability can lead to a broader container or host compromise.

Question 328.

Which Linux security mechanism is specifically used to restrict which system calls a containerized process may execute?

1. SELinux
2. Kubernetes RBAC
3. NetworkPolicy
4. seccomp

Correct Answer: 4. seccomp

Explanation:

seccomp provides syscall filtering at the Linux kernel level. Many applications require only a subset of available system calls, so blocking unnecessary ones reduces the kernel attack surface available to a compromised process. Kubernetes workloads can use runtime-default or custom seccomp profiles depending on application needs and organizational policy. SELinux provides mandatory access control but is not primarily a syscall filter. Kubernetes RBAC governs API authorization, and NetworkPolicy controls network communication. seccomp should be tested carefully because denying a required syscall can break application behavior. It is strongest when layered with non-root execution, capability reduction, AppArmor or SELinux, read-only filesystems, and runtime monitoring to provide both preventive and detective protection.

Question 329.

Which control BEST provides mandatory access restrictions on files and resources for containerized processes on supported Linux nodes?

1. AppArmor or SELinux
2. ServiceAccount RBAC
3. ResourceQuota
4. PodDisruptionBudget

Correct Answer: 1. AppArmor or SELinux

Explanation:

AppArmor and SELinux enforce mandatory access control at the operating-system layer. They can restrict a process’s access to files, devices, paths, and other resources even when traditional discretionary permissions might otherwise permit the operation. This provides an additional containment layer if an application is compromised. ServiceAccount RBAC governs Kubernetes API authorization rather than ordinary host filesystem access. ResourceQuotas manage resource consumption, and PodDisruptionBudgets support availability. Mandatory access control profiles should be designed and tested carefully because overly restrictive policies can break legitimate applications. They complement seccomp, non-root execution, capability reduction, read-only filesystems, and admission policy enforcement as part of a broader container-hardening strategy.

Question 330.

A production image contains compilers, package managers, and debugging tools that are required only during the build stage. Which approach BEST reduces runtime attack surface?

1. Keep the tools but block outbound Internet traffic
2. Use a multi-stage build and copy only required runtime artifacts into the final image
3. Keep the full image but enforce a read-only root filesystem
4. Move the debugging tools into a separate directory inside the image

Correct Answer: 2. Use a multi-stage build and copy only required runtime artifacts into the final image

Explanation:

Multi-stage builds allow build-time tools to remain in earlier image stages while only the final application and runtime dependencies are copied into the production artifact. This reduces the number of vulnerable components and limits the utilities available to an attacker after compromise. Blocking Internet access or using a read-only filesystem provides useful protection, but unnecessary tools and libraries remain present. Moving tools to another directory does not prevent their execution. Minimal runtime images should still be scanned, patched, signed, and associated with provenance and SBOM data. Attack surface reduction is strongest when unnecessary software is removed rather than merely restricted, hidden, or made harder to use.

Question 331.

Which artifact provides the MOST direct inventory for determining whether a container image includes a newly vulnerable dependency?

1. An SBOM associated with the exact image digest
2. Kubernetes audit logs
3. A NetworkPolicy manifest
4. A PodDisruptionBudget

Correct Answer: 1. An SBOM associated with the exact image digest

Explanation:

A Software Bill of Materials identifies the components and dependency versions contained in an artifact. Linking it to the exact image digest ensures the inventory corresponds to the precise image deployed rather than a mutable tag that may later change. When a vulnerability is disclosed, teams can search SBOM data for the affected library and identify potentially impacted images quickly. The SBOM does not automatically indicate whether the vulnerability is exploitable, so vulnerability scanning, exposure analysis, and remediation are still required. Audit logs, NetworkPolicies, and PodDisruptionBudgets provide different operational and security functions but do not contain a software component inventory. Reliable SBOM generation is a foundational software supply chain visibility capability.

Question 332.

A Deployment references a mutable image tag such as current. Which practice BEST ensures that the exact reviewed image continues to run?

1. Increase registry audit logging
2. Pin the Deployment to the approved image digest
3. Set imagePullPolicy: Always
4. Restrict pod restarts to administrators

Correct Answer: 2. Pin the Deployment to the approved image digest

Explanation:

A digest identifies exact image contents, while a mutable tag can be reassigned to a different artifact. If the Deployment references only a tag, a later restart may pull content that was never reviewed even though the manifest did not change. Digest pinning removes that ambiguity and improves reproducibility, rollback confidence, and incident investigation. Registry logging is helpful for detecting changes but does not prevent altered content from being used. imagePullPolicy: Always may increase exposure because it retrieves the current content behind the tag on each pull. Restricting restarts also does not solve the underlying artifact integrity issue. Digests should be combined with signatures, provenance, controlled registry writes, and admission policy.

Question 333.

A company wants Kubernetes to reject images that were not produced by its trusted build system. Which control is MOST appropriate?

1. A ResourceQuota on production namespaces
2. Runtime CPU monitoring
3. Admission-time verification of trusted image signatures or provenance
4. A default-deny ingress NetworkPolicy

Correct Answer: 3. Admission-time verification of trusted image signatures or provenance

Explanation:

Image signatures and trusted provenance can provide evidence that an artifact was generated or approved by a recognized build process. Verifying that evidence during admission enables Kubernetes to reject artifacts that fail organizational trust requirements before they execute. ResourceQuotas control resource usage, CPU monitoring detects runtime anomalies, and NetworkPolicies restrict communication. Those controls do not verify artifact origin. The signing and provenance systems themselves must be strongly protected because compromised signing keys or build infrastructure could allow malicious artifacts to appear legitimate. Admission verification is strongest when combined with protected source control, secure CI/CD systems, trusted registries, immutable image digests, vulnerability scanning, and tightly scoped release credentials.

Question 334.

A CI pipeline needs to deploy workloads to one namespace but does not need to modify RBAC. Which access model BEST limits the impact of pipeline compromise?

1. Grant namespace-admin and rely on manual deployment approvals
2. Grant only the specific deployment permissions required in the target namespace
3. Allow RoleBinding creation but deny ClusterRoleBinding creation
4. Grant cluster-wide write access but use a short-lived token

Correct Answer: 2. Grant only the specific deployment permissions required in the target namespace

Explanation:

A CI deployment identity should receive only the verbs, resource types, and namespace scope required for its function. Namespace-admin provides many unrelated permissions, while RoleBinding creation may still become a privilege-escalation path depending on which roles the pipeline can reference. A short-lived token reduces credential lifetime but does not make excessive cluster-wide authorization safe. Least privilege should be enforced at the authorization layer rather than relying solely on procedural approvals. Strong pipeline security also benefits from separate identities for build and deployment functions, protected CI configuration, short-lived credentials where possible, audit logging, and trusted artifact verification. Limiting the deployment identity’s authority reduces the blast radius if the CI environment is compromised.

Question 335.

A service account that normally reads ConfigMaps suddenly begins creating Pods and listing Secrets. What should the security team investigate FIRST?

1. Possible credential misuse, RBAC changes, or workload compromise
2. Whether the scheduler has changed node affinity rules
3. Whether the application’s readiness probe is failing
4. Whether the namespace ResourceQuota was recently increased

Correct Answer: 1. Possible credential misuse, RBAC changes, or workload compromise

Explanation:

A sudden change in the API behavior of a service account can be a strong indicator of compromise or privilege expansion. Security teams should inspect Kubernetes audit logs, recent Role and RoleBinding changes, workload runtime activity, network connections, deployment history, and the exact image in use. A service account does not automatically gain privileges because of scheduling, readiness probes, or resource quotas. Ideally, least-privilege RBAC would prevent the identity from creating Pods or reading Secrets if those actions were unnecessary. Behavioral monitoring is useful because attackers often abuse valid credentials and authorized API paths rather than generating obvious authentication failures. Unexpected access to sensitive resources should therefore be investigated even when the request succeeds.

Question 336.

A runtime security system detects that a normally static application container has spawned a shell and begun downloading unfamiliar executables. Which response is MOST appropriate?

1. Increase the container’s resource limits to support analysis
2. Treat the behavior as a possible compromise, contain the workload, and preserve evidence
3. Add the download destination to the egress allowlist
4. Restart the workload repeatedly until the behavior stops

Correct Answer: 2. Treat the behavior as a possible compromise, contain the workload, and preserve evidence

Explanation:

Unexpected shell activity and downloaded executables are strong indicators of exploitation or unauthorized behavior in a fixed-function production container. The team should follow incident-response procedures, which may involve isolating the workload, restricting network communication, preserving audit and application logs, capturing relevant process state, and identifying the exact image and credentials involved. Restarting repeatedly can destroy evidence without addressing the underlying vulnerability. Increasing resources or allowlisting the destination would make suspicious activity easier. After containment, investigators should determine the root cause, rotate exposed credentials, rebuild from trusted artifacts, and validate the remediation before returning the application to normal service. Prepared playbooks reduce confusion during high-pressure incidents.

Question 337.

Which network design BEST limits lateral movement from a compromised front-end service to unrelated internal systems?

1. Use default-deny NetworkPolicies and explicitly allow only required communication paths
2. Allow all internal traffic but encrypt every connection
3. Place workloads in separate Deployments without network controls
4. Use unique DNS names for each service tier

Correct Answer: 1. Use default-deny NetworkPolicies and explicitly allow only required communication paths

Explanation:

A default-deny network posture reduces internal reachability by allowing only connections required by the application’s design. A front-end may need access to one API backend but not databases, monitoring systems, or workloads owned by other teams. Encryption protects confidentiality and integrity of allowed traffic but does not prevent unauthorized connection attempts when network reachability remains broad. Separate Deployments and DNS names provide organization rather than isolation. Network segmentation should be combined with application authentication, workload identity, separate credentials, and runtime monitoring. Zero-trust design assumes that a workload can become compromised and therefore limits what it can reach even when it is already inside the cluster network.

Question 338.

A workload should communicate externally only with DNS and a small set of approved APIs. Which control BEST limits outbound network exposure?

1. A dedicated ServiceAccount
2. An egress NetworkPolicy or equivalent outbound filtering mechanism
3. A read-only root filesystem
4. A PodDisruptionBudget

Correct Answer: 2. An egress NetworkPolicy or equivalent outbound filtering mechanism

Explanation:

Egress controls restrict the external destinations a workload can contact. If the workload requires only DNS and a known set of APIs, unrestricted Internet access creates unnecessary opportunity for command-and-control traffic, malware downloads, data exfiltration, or scanning. Kubernetes NetworkPolicy can provide egress filtering when supported by the networking implementation, while dynamic external destinations may require egress gateways or firewalls. A dedicated service account controls Kubernetes API identity, a read-only filesystem restricts local modification, and a PodDisruptionBudget supports availability. Those mechanisms do not directly limit outbound network destinations. Egress restrictions should be combined with runtime network monitoring so unexpected connection attempts are visible as well as blocked.

Question 339.

Which logging strategy BEST preserves evidence if compromised Pods are deleted before investigators can inspect them?

1. Forward application, Kubernetes audit, node, and runtime security logs to protected centralized storage
2. Store logs only in the Pod filesystem
3. Retain only Kubernetes Events
4. Disable audit logging to reduce sensitive data retention

Correct Answer: 1. Forward application, Kubernetes audit, node, and runtime security logs to protected centralized storage

Explanation:

Pods are ephemeral and may disappear through restarts, rescheduling, scaling, incident containment, or attacker activity. Logs stored only in the workload can be lost before an investigation starts. Centralized logging preserves evidence independently of the pod lifecycle and allows analysts to correlate multiple sources. Kubernetes audit logs reveal API actions, runtime telemetry captures suspicious processes and network behavior, application logs provide service context, and node logs can reveal host-level events. Kubernetes Events are useful but typically insufficient for detailed forensic analysis. Centralized storage should be strongly protected with access controls, integrity safeguards, encryption, retention policies, and monitoring because it contains valuable and potentially sensitive evidence.

Question 340.

Which approach BEST represents a sustainable Kubernetes security program for production environments?

1. Rely primarily on perimeter security and image scanning before deployment
2. Use RBAC and runtime monitoring while allowing broad CI/CD permissions
3. Focus on admission policies and assume approved workloads remain safe afterward
4. Continuously integrate identity security, least privilege, workload hardening, software supply chain controls, network segmentation, vulnerability management, monitoring, logging, policy enforcement, and incident response

Correct Answer: 4. Continuously integrate identity security, least privilege, workload hardening, software supply chain controls, network segmentation, vulnerability management, monitoring, logging, policy enforcement, and incident response

Explanation:

Kubernetes security must be maintained continuously because applications, identities, dependencies, infrastructure, and threats all change over time. Strong identity controls and RBAC reduce unauthorized API access. Workload hardening limits process privilege and writable attack surface. Supply chain controls protect source repositories, build systems, dependencies, registries, signatures, provenance, and artifact promotion. Admission policies prevent known-insecure configurations before execution, while NetworkPolicies reduce unnecessary communication. Continuous vulnerability management addresses newly discovered weaknesses. Runtime monitoring and centralized logging provide detection and investigative visibility when preventive controls fail. Tested incident-response procedures prepare teams to contain affected workloads, rotate credentials, preserve evidence, eradicate root causes, and recover safely. Sustainable security depends on maintaining all these layers rather than trusting any single control.