View Full Linux Foundation KCSA Exam Dumps and Practice Test Dumps

 

Question 361.

A Kubernetes application requires access to one Secret in its namespace and no other API resources. Which design BEST follows least privilege?

1. Use a dedicated service account with a Role permitting only the required read action on that Secret
2. Give the application read access to all Secrets in the namespace
3. Use the default service account with namespace-wide read permissions
4. Bind the application to a ClusterRole that includes read access to ConfigMaps, Secrets, and Pods

Correct Answer: 1. Use a dedicated service account with a Role permitting only the required read action on that Secret

Explanation:

A dedicated service account with narrowly scoped RBAC permissions limits the workload to exactly what it needs. If the application requires only one Secret, the Role can specify the necessary read verb and the particular resource rather than exposing every Secret in the namespace. Using the default service account can unintentionally share identity and permissions across unrelated workloads. A broad ClusterRole also expands the potential blast radius if the pod or its token is compromised. Least privilege should be applied to identity, verbs, resource types, namespaces, and even individual resource names where appropriate. Audit logging and periodic permission reviews help confirm that the application’s access remains aligned with its actual function.

Question 362.

A platform team discovers that a CI deployment account can modify ClusterRoleBindings, even though it only needs to update Deployments in one namespace. What is the BEST remediation?

1. Keep the permission but monitor all ClusterRoleBinding changes
2. Replace the CI account with the namespace default service account
3. Remove ClusterRoleBinding permissions and grant only the deployment actions required in the target namespace
4. Restrict the CI account’s network access while leaving RBAC unchanged

Correct Answer: 3. Remove ClusterRoleBinding permissions and grant only the deployment actions required in the target namespace

Explanation:

The ability to modify ClusterRoleBindings can provide a direct privilege-escalation path because the pipeline could bind itself or another identity to a highly privileged ClusterRole. If the CI process only updates Deployments in one namespace, its permissions should be limited to those deployment operations. Monitoring privileged changes is useful but does not remove the underlying excessive authorization. Network restrictions also do not address Kubernetes API permissions, and using the default service account may worsen identity separation. CI/CD systems should use dedicated, narrowly scoped identities, ideally with short-lived credentials and detailed audit logging. This reduces the impact if the pipeline, its configuration, or its credentials are compromised.

Question 363.

Which Kubernetes permission is MOST sensitive because it may allow an identity to act as another user or service account?

1. Permission to list Pods
2. Permission to impersonate users, groups, or service accounts
3. Permission to read Services
4. Permission to watch Deployments

Correct Answer: 2. Permission to impersonate users, groups, or service accounts

Explanation:

Impersonation can allow one principal to submit Kubernetes API requests under another identity’s security context. If the impersonated identity has greater permissions, this can become a privilege-escalation mechanism. For that reason, impersonation rights should be limited to trusted administrators or components with a clearly documented requirement. Read-only access to Pods, Services, or Deployments can expose operational information but normally does not provide the same direct ability to assume another identity. Kubernetes audit logging is especially important for impersonation because it can preserve both the initiating identity and the impersonated context. RBAC reviews should therefore examine indirect escalation paths such as impersonation, binding creation, and workload creation permissions.

Question 364.

A company wants to prevent application teams from deploying privileged containers, using hostPID, or mounting arbitrary hostPath volumes. Which control BEST enforces this before the workload starts?

1. Runtime behavioral monitoring
2. An ingress NetworkPolicy
3. ResourceQuota enforcement
4. Admission policy enforcement

Correct Answer: 4. Admission policy enforcement

Explanation:

Admission policies evaluate workload specifications before Kubernetes accepts and schedules them. This makes admission the best preventive control for known-risk settings such as privileged mode, host namespace access, dangerous hostPath mounts, excessive Linux capabilities, or missing security context settings. Runtime monitoring remains valuable because it can detect malicious behavior after execution, but it is less effective for configurations that can be blocked before the workload runs. NetworkPolicies control network paths, and ResourceQuotas control consumption rather than privilege. Organizations should align admission policy with Pod Security Standards or equivalent internal requirements and define a controlled exception process for trusted system components that genuinely require elevated access.

Question 365.

A containerized application writes only temporary files under /tmp. Which configuration BEST limits the ability of a compromised process to alter the rest of the container filesystem?

1. Use a read-only root filesystem and mount a writable temporary volume only at /tmp
2. Keep the entire root filesystem writable but run the container as non-root
3. Mount the node’s /tmp directory directly into the container
4. Enable privileged mode and make only the application directory read-only

Correct Answer: 1. Use a read-only root filesystem and mount a writable temporary volume only at /tmp

Explanation:

A read-only root filesystem prevents a compromised application from modifying most binaries, libraries, and packaged configuration within the container image. If the only writable requirement is /tmp, a dedicated temporary volume there gives the application the functionality it needs without making the entire filesystem mutable. Running as non-root is also beneficial but does not stop the process from altering files it owns or can access. Mounting the host’s /tmp introduces unnecessary node exposure, while privileged mode substantially weakens isolation. This design applies least privilege to filesystem access and works best alongside non-root execution, capability reduction, seccomp, and disabled privilege escalation.

Question 366.

A workload requires one Linux capability to perform a legitimate operation. Which configuration BEST minimizes privilege?

1. Keep the runtime’s default capabilities because they are already limited
2. Run the container as root but disable interactive shells
3. Drop unnecessary capabilities and add back only the specific capability required
4. Enable privileged mode but apply a restrictive NetworkPolicy

Correct Answer: 3. Drop unnecessary capabilities and add back only the specific capability required

Explanation:

Linux capabilities split traditional root privileges into smaller units. If an application requires only one capability, the most secure approach is to remove the others and restore only the one with a documented functional requirement. Keeping a broad default set exposes unnecessary kernel-level powers. Running as root increases process privilege, while privileged mode weakens many isolation controls and cannot be compensated for simply by limiting network access. Capability minimization should be combined with non-root execution, allowPrivilegeEscalation: false, seccomp, and mandatory access control. The workload should be tested with the reduced capability set to ensure security improvements do not interfere with legitimate application behavior.

Question 367.

Which pod security control MOST directly prevents a process from gaining more privileges than its parent process?

1. readOnlyRootFilesystem: true
2. allowPrivilegeEscalation: false
3. automountServiceAccountToken: false
4. hostNetwork: false

Correct Answer: 2. allowPrivilegeEscalation: false

Explanation:

allowPrivilegeEscalation: false is specifically intended to stop a process from gaining additional privileges through mechanisms such as setuid executables or file capabilities. A read-only root filesystem protects against file modification, while disabling service account token automounting reduces Kubernetes credential exposure. Avoiding host networking preserves network namespace separation. These controls complement each other but address different security concerns. Strong workload hardening normally combines non-root execution, capability minimization, disabled privilege escalation, seccomp, mandatory access control, and limited writable paths. Using multiple layers makes it more difficult for a single application vulnerability to become a broader container or node compromise.

Question 368.

Which Linux mechanism is designed specifically to restrict which system calls a containerized process can make?

1. AppArmor
2. Kubernetes RBAC
3. NetworkPolicy
4. seccomp

Correct Answer: 4. seccomp

Explanation:

seccomp filters Linux system calls and can reduce the kernel attack surface available to a containerized process. Many applications require only a subset of the available syscall interface, so unnecessary operations can be blocked. AppArmor is another valuable host-level security mechanism, but it primarily enforces mandatory access rules around files and process behavior rather than acting specifically as a syscall filter. Kubernetes RBAC governs API authorization, while NetworkPolicy governs traffic. seccomp profiles should be tested carefully because denying a syscall that an application genuinely requires may cause failure. It is strongest when used alongside non-root execution, reduced capabilities, AppArmor or SELinux, and runtime monitoring.

Question 369.

Which control BEST restricts a container process from accessing sensitive files or devices even when normal Unix permissions might allow the operation?

1. AppArmor or SELinux
2. Kubernetes ServiceAccount RBAC
3. ResourceQuota
4. Horizontal Pod Autoscaler

Correct Answer: 1. AppArmor or SELinux

Explanation:

AppArmor and SELinux provide mandatory access control at the operating-system layer. They can restrict which files, devices, paths, and resources a process may access even if ordinary discretionary permissions permit the action. This creates an additional containment layer for workloads that become compromised. ServiceAccount RBAC applies to Kubernetes API operations rather than local process access to filesystem resources. ResourceQuotas and autoscaling address resource usage and availability. Mandatory access control works best when combined with seccomp, capability reduction, non-root execution, and read-only filesystem settings. Policies should be carefully tested because overly restrictive rules can break legitimate workloads, while overly permissive policies may provide little meaningful protection.

Question 370.

A production image includes compilers, package managers, shells, and debugging tools that are required only during the build. Which approach BEST reduces runtime attack surface?

1. Keep the full image but restrict registry access
2. Use a multi-stage build and copy only the necessary runtime artifacts into the final image
3. Keep the tools but block outbound Internet access
4. Move the tools to a directory outside the application PATH

Correct Answer: 2. Use a multi-stage build and copy only the necessary runtime artifacts into the final image

Explanation:

Multi-stage builds allow build-time dependencies to remain in earlier stages while the final production image includes only the application and required runtime components. This reduces the number of potentially vulnerable packages and limits the utilities available to an attacker after compromise. Registry restrictions protect artifact distribution but do not reduce what is inside the image. Egress controls can contain network behavior but still leave unnecessary software present. Moving utilities outside PATH also does not prevent an attacker from invoking them directly. Minimal images should still be scanned, signed, patched, and tied to SBOM and provenance information. Removing unnecessary components is stronger than merely hiding or restricting them.

Question 371.

Which artifact is MOST useful for quickly identifying whether a deployed container image contains a newly vulnerable library version?

1. An SBOM tied to the image’s exact digest
2. Kubernetes audit logs
3. A NetworkPolicy manifest
4. A PodDisruptionBudget

Correct Answer: 1. An SBOM tied to the image’s exact digest

Explanation:

A Software Bill of Materials provides a structured inventory of the packages, libraries, and versions contained in an artifact. Associating the SBOM with an immutable image digest ensures the inventory corresponds to the exact image being assessed. When a vulnerability is disclosed, security teams can search SBOM data to identify potentially affected artifacts quickly. The SBOM does not automatically determine exploitability, so exposure analysis, vulnerability scanning, and remediation are still required. Audit logs describe API activity, NetworkPolicies describe traffic rules, and PodDisruptionBudgets support availability. None of those provide software composition information. Accurate SBOMs are therefore an important part of software supply chain visibility and vulnerability response.

Question 372.

A Kubernetes Deployment references a mutable image tag called approved. Which practice BEST ensures the exact reviewed image continues to be used?

1. Increase registry audit-log retention
2. Reference the approved image by immutable digest
3. Configure imagePullPolicy: Always
4. Limit Deployment restarts to cluster administrators

Correct Answer: 2. Reference the approved image by immutable digest

Explanation:

A digest identifies the exact contents of a container image, whereas a mutable tag can later be reassigned to different content. If the Deployment references only approved, a restart could pull a new artifact without any change to the workload manifest. Pinning the digest removes this ambiguity and improves reproducibility, rollback reliability, and forensic investigation. Audit logs help reveal tag changes but do not prevent them. imagePullPolicy: Always can actually make mutable tag replacement more dangerous because each pull retrieves the tag’s current content. Restricting restarts also does not solve artifact identity. Digest pinning should be combined with registry access controls, signatures, provenance, scanning, and admission verification.

Question 373.

A company wants the cluster to reject images that were not produced by its trusted build pipeline. Which control BEST satisfies this requirement?

1. Admission-time verification of trusted signatures or build provenance
2. A namespace ResourceQuota
3. Runtime CPU monitoring
4. A default-deny ingress NetworkPolicy

Correct Answer: 1. Admission-time verification of trusted signatures or build provenance

Explanation:

Signatures and build provenance can provide evidence that an image was generated or approved through an authorized software supply chain. Verifying those signals during admission allows Kubernetes to block untrusted artifacts before they execute. ResourceQuotas regulate resource consumption, CPU monitoring observes runtime behavior, and ingress policy controls communication. None of these establishes artifact origin. Trust mechanisms must themselves be secured because compromised signing keys or build infrastructure can make malicious artifacts appear legitimate. Strong supply chain assurance combines admission verification with protected source repositories, secure CI/CD systems, immutable image references, trusted registries, vulnerability scanning, SBOMs, and narrowly scoped release credentials.

Question 374.

A deployment pipeline needs to update Deployments and Services in one namespace but should not manage RBAC. Which permission model is MOST secure?

1. Grant namespace-admin for operational flexibility
2. Grant only the exact Deployment and Service permissions required in that namespace
3. Permit RoleBinding creation but deny ClusterRoleBinding creation
4. Grant cluster-wide write access but use a short-lived credential

Correct Answer: 2. Grant only the exact Deployment and Service permissions required in that namespace

Explanation:

A CI/CD identity should receive only the verbs, resources, and scope necessary for its deployment function. If it updates Deployments and Services in one namespace, it should not have unrelated access to Secrets, Roles, RoleBindings, or other namespaces. Namespace-admin is broader than needed, while even RoleBinding creation can become a privilege-escalation path if powerful roles can be referenced. A short-lived token reduces exposure duration but does not make excessive cluster-wide permissions safe. Strong pipeline security also includes separate identities, protected configuration, artifact verification, and audit logging. Least privilege limits how much damage an attacker can cause if the pipeline or its credentials are compromised.

Question 375.

A service account that normally reads ConfigMaps suddenly starts listing Secrets and creating Pods. What should the security team investigate FIRST?

1. Whether the namespace ResourceQuota changed
2. Possible service account compromise, RBAC modification, or malicious workload behavior
3. Whether a liveness probe failed
4. Whether DNS records were recently updated

Correct Answer: 2. Possible service account compromise, RBAC modification, or malicious workload behavior

Explanation:

A significant change in an identity’s behavior is an important security signal. A service account that historically reads ConfigMaps but suddenly accesses Secrets or creates Pods may have been compromised or granted additional permissions. Security teams should review Kubernetes audit logs, recent Role and RoleBinding changes, workload processes, network activity, image identity, and deployment history. ResourceQuotas, liveness probes, and DNS changes do not automatically grant API privileges. Ideally, least-privilege RBAC would prevent the account from performing those actions at all. Behavioral monitoring is valuable because attackers often abuse valid credentials and permitted API requests rather than triggering obvious authentication failures.

Question 376.

A fixed-function production container unexpectedly launches a shell, downloads an executable, and starts it. Which response is MOST appropriate?

1. Increase the container’s CPU and memory limits for observation
2. Add the download destination to the application’s egress allowlist
3. Restart the pod repeatedly until the activity stops
4. Treat the event as a possible compromise, contain the workload, and preserve evidence

Correct Answer: 4. Treat the event as a possible compromise, contain the workload, and preserve evidence

Explanation:

Unexpected shell execution followed by downloading and running unfamiliar code is a strong indicator of exploitation or unauthorized activity. The incident-response process should prioritize containment while preserving evidence. Responders may isolate the workload, restrict network communication, preserve audit and application logs, record process state, identify image digests, and determine whether credentials were exposed. Restarting repeatedly can destroy evidence and does not correct the underlying vulnerability. Increasing resources or allowlisting the external host would make suspicious activity easier to continue. After containment, the organization should determine root cause, rotate affected credentials, rebuild from trusted artifacts, and validate remediation before restoring normal service.

Question 377.

Which network design BEST limits lateral movement if a front-end pod is compromised?

1. Use default-deny NetworkPolicies and explicitly allow only the communication paths required by the application
2. Permit all internal traffic but use TLS for every connection
3. Put application tiers in separate Deployments without policy enforcement
4. Use unique Service names for each tier

Correct Answer: 1. Use default-deny NetworkPolicies and explicitly allow only the communication paths required by the application

Explanation:

A default-deny network posture restricts communication unless the application architecture explicitly requires it. A front-end workload may need access to an API backend but should not automatically reach databases, monitoring systems, or unrelated namespaces. TLS protects confidentiality and identity for allowed connections, but it does not prevent unauthorized workloads from attempting to connect when network reachability remains broad. Separate Deployments and Service names provide organization rather than isolation. Network segmentation should be combined with service authentication, separate credentials, workload identity, and runtime monitoring. This defense-in-depth design assumes any one workload can become compromised and therefore limits what it can reach afterward.

Question 378.

A sensitive application should contact only DNS and two approved external services. Which control BEST limits unnecessary outbound network access?

1. A namespace-scoped Role
2. An egress NetworkPolicy or equivalent outbound filtering control
3. A read-only root filesystem
4. A PodDisruptionBudget

Correct Answer: 2. An egress NetworkPolicy or equivalent outbound filtering control

Explanation:

Egress filtering directly restricts the destinations a workload can contact. If the application requires only DNS and two approved external services, unrestricted Internet connectivity creates unnecessary risk of command-and-control communication, malicious downloads, data exfiltration, or external scanning after compromise. Kubernetes NetworkPolicy can provide this control when supported by the networking implementation, while dynamic external services may require gateways or firewall-based controls. RBAC controls Kubernetes API authorization, a read-only filesystem limits local modification, and a PodDisruptionBudget supports availability. These controls do not constrain outbound destinations. Runtime network monitoring should complement egress restrictions so unusual or blocked connection attempts are visible and investigated.

Question 379.

Which logging design BEST supports forensic investigation when compromised pods may be deleted or replaced before responders can inspect them?

1. Forward Kubernetes audit, application, node, and runtime security telemetry to protected centralized storage
2. Store all logs inside the pod’s writable filesystem
3. Retain only Kubernetes Events
4. Disable long-term log retention to reduce exposure of sensitive information

Correct Answer: 1. Forward Kubernetes audit, application, node, and runtime security telemetry to protected centralized storage

Explanation:

Pods are ephemeral and may disappear because of restarts, scaling, rescheduling, containment actions, or attacker behavior. Logs stored only in the workload can therefore vanish before an investigation begins. Centralized logging preserves evidence outside the pod lifecycle and enables correlation across multiple layers. Kubernetes audit logs reveal API actions, runtime telemetry captures suspicious processes and network behavior, application logs provide service context, and node logs can reveal host-level events. Kubernetes Events are useful but typically insufficient for detailed forensics. Centralized storage should have strong access controls, encryption, integrity protections, retention policies, and monitoring. Incident readiness depends on collecting important telemetry before a compromise occurs.

Question 380.

Which approach BEST represents a mature Kubernetes security program across software development, deployment, and runtime?

1. Focus on image scanning and trust approved artifacts afterward
2. Secure the cluster perimeter and allow broad internal workload communication
3. Use RBAC and monitoring while giving CI/CD systems broad permissions for convenience
4. Continuously combine identity security, least privilege, workload hardening, software supply chain controls, network segmentation, policy enforcement, vulnerability management, monitoring, logging, and incident response

Correct Answer: 4. Continuously combine identity security, least privilege, workload hardening, software supply chain controls, network segmentation, policy enforcement, vulnerability management, monitoring, logging, and incident response

Explanation:

A mature Kubernetes security program uses defense in depth throughout the entire cloud-native lifecycle. Identity controls and RBAC protect API access. Workload hardening reduces process privilege, writable attack surface, and unnecessary kernel access. Supply chain controls protect source code, dependencies, build infrastructure, registries, signatures, provenance, and artifact promotion. Admission policies prevent known-insecure configurations from reaching runtime, while NetworkPolicies reduce lateral movement and unnecessary egress. Continuous vulnerability management addresses weaknesses discovered after deployment. Runtime monitoring and centralized logging provide detection and investigation capabilities when preventive measures fail. Finally, tested incident-response procedures help teams contain compromised workloads, rotate credentials, preserve evidence, eradicate root causes, and recover safely.