View Full Linux Foundation KCSA Exam Dumps and Practice Test Dumps

 

Question 201.

A platform security team wants to minimize the impact if credentials used by an application pod are stolen. Which design BEST follows the principle of least privilege?

1. Give the application a dedicated service account with only the specific API permissions it requires
2. Use a shared namespace service account with read access to all objects
3. Grant a ClusterRole so future application features do not require permission changes
4. Use a common deployment credential shared by all workloads in the namespace

Correct Answer: 1. Give the application a dedicated service account with only the specific API permissions it requires

Explanation:

A dedicated service account with narrowly scoped permissions limits what an attacker can do if the workload’s credentials are stolen. Permissions should be based on the application’s actual API needs rather than anticipated future functionality. Sharing identities between workloads makes it harder to separate responsibilities and increases the potential blast radius of compromise. Even broad read access can be dangerous because Kubernetes resources may reveal sensitive configuration or help an attacker understand the environment. Service accounts should also avoid automatic token mounting when Kubernetes API access is unnecessary. Periodic RBAC reviews, audit logging, and short-lived credentials where supported further strengthen workload identity security. Least privilege works best when permissions are explicit, minimal, and tied to a specific workload purpose rather than granted broadly for convenience.

Question 202.

An application must list Pods across several namespaces but does not need to create, update, or delete any resources. Which authorization design is MOST appropriate?

1. Grant cluster-admin and restrict write operations using application logic
2. Create separate namespace administrator roles for each development team
3. Use a ClusterRole containing only the required read verbs and bind it to the application’s service account
4. Grant the application permission to impersonate a read-only administrator

Correct Answer: 3. Use a ClusterRole containing only the required read verbs and bind it to the application’s service account

Explanation:

A ClusterRole can define read-only permissions that apply to resources across namespaces without granting unrelated administrative capabilities. If the application only needs get, list, or watch permissions for Pods, those verbs should be explicitly defined and nothing more. Binding cluster-admin and relying on application logic to avoid misuse would provide far more privilege than necessary. Separate namespace administrator roles would also grant inappropriate write authority. Kubernetes RBAC should enforce authorization at the platform level rather than trusting application behavior alone. The service account should be dedicated to the workload, its permissions reviewed periodically, and access monitored through audit logs. Broad impersonation privileges can also become a serious escalation path and should not be granted merely to simplify cross-namespace visibility.

Question 203.

A security administrator wants to detect attempts to grant cluster-admin privileges through Kubernetes RBAC. Which data source provides the MOST direct visibility?

1. Container stdout logs
2. Kubernetes audit logs
3. Node CPU metrics
4. Container image scan reports

Correct Answer: 2. Kubernetes audit logs

Explanation:

Kubernetes audit logs record requests made to the API server and can capture creation or modification of ClusterRoleBindings, RoleBindings, ClusterRoles, and related authorization resources. Security monitoring can alert when a user or service account attempts to bind another identity to cluster-admin or another highly privileged role. Audit events can provide the authenticated identity, request type, target resource, namespace or cluster scope, timestamp, and result. Application logs may show workload behavior but do not reliably capture cluster-level authorization changes. CPU metrics provide operational information, while image scans identify known vulnerabilities in artifacts. Audit logs should be forwarded to protected centralized storage so that an attacker who gains cluster access cannot easily erase evidence. Preventive RBAC should also tightly limit who can modify privileged bindings.

Question 204.

A company wants to stop ordinary application workloads from using privileged mode, host PID, or host network access. Which control is BEST suited to enforce this before pods run?

1. Runtime alerting rules
2. NetworkPolicies
3. ResourceQuotas
4. Admission policy enforcement

Correct Answer: 4. Admission policy enforcement

Explanation:

Admission policies evaluate Kubernetes objects before they are accepted and persisted. They are therefore an effective control for preventing insecure pod settings such as privileged mode, hostPID, hostIPC, hostNetwork, unsafe capabilities, or prohibited hostPath volumes. Runtime alerting is useful after deployment but is less preventive because the dangerous workload may already be executing. NetworkPolicies govern traffic rather than pod privilege, and ResourceQuotas limit resource consumption rather than security settings. Admission enforcement can be aligned with Pod Security Standards or organizational policies and should include a documented exception process for trusted system components that legitimately require elevated access. This approach creates consistent cluster-side enforcement even when workloads are deployed through different CI/CD systems or by different teams.

Question 205.

Which container configuration MOST directly reduces the risk that an attacker can modify executables or system files after compromising the application?

1. Configure a read-only root filesystem and provide writable storage only where required
2. Set a higher memory limit to prevent abnormal process behavior
3. Use a dedicated Service instead of a shared Service
4. Configure pod anti-affinity across worker nodes

Correct Answer: 1. Configure a read-only root filesystem and provide writable storage only where required

Explanation:

A read-only root filesystem limits the attacker’s ability to replace binaries, modify packaged configuration, install tools, or establish some forms of persistence inside the container. Applications that require writable areas can use narrowly scoped temporary or persistent volumes mounted only at the necessary paths. This follows least privilege for filesystem access. A read-only root filesystem does not prevent malicious network activity or misuse of existing application functionality, so it should be combined with non-root execution, reduced Linux capabilities, seccomp, prevention of privilege escalation, and runtime monitoring. Memory limits, Service design, and pod anti-affinity provide resource management, networking, and availability benefits but do not directly stop modification of container image files after compromise.

Question 206.

A container application can operate without root privileges. Which configuration BEST supports secure execution?

1. Run as root but remove package managers from the image
2. Enable privileged mode only during startup
3. Configure the image and pod to run as a non-root user
4. Run as root but apply a default-deny NetworkPolicy

Correct Answer: 3. Configure the image and pod to run as a non-root user

Explanation:

Running the application as a non-root user reduces the privileges available to an attacker who gains control of the process. The container image should be designed with appropriate ownership and file permissions so the application can function without UID 0. Kubernetes security context settings such as runAsNonRoot and an explicit user ID can help enforce this requirement. Removing package managers is also useful for reducing attack surface, but it does not address process privilege directly. Privileged mode dramatically weakens isolation, even if used temporarily. A NetworkPolicy limits communication paths but does not reduce Linux process privilege. Secure container design combines non-root execution with capability reduction, allowPrivilegeEscalation: false, seccomp, mandatory access control, and read-only filesystem settings where practical.

Question 207.

Which Linux security mechanism is designed to filter the system calls available to a container process?

1. AppArmor
2. seccomp
3. RBAC
4. NetworkPolicy

Correct Answer: 2. seccomp

Explanation:

seccomp reduces kernel attack surface by controlling which Linux system calls a process may invoke. Many applications require only a subset of all available system calls, so unnecessary operations can be blocked. Kubernetes supports seccomp profiles that can be applied to workloads through their security configuration. AppArmor is also a valuable security mechanism, but it is primarily a mandatory access control framework that restricts process interactions with files and other resources rather than serving specifically as a syscall filter. Kubernetes RBAC controls API authorization, and NetworkPolicy controls network communication. seccomp is most effective when layered with non-root execution, capability reduction, AppArmor or SELinux, a read-only root filesystem, and runtime detection. Profiles should be tested carefully to avoid blocking legitimate application functionality.

Question 208.

A company wants an additional operating-system control that restricts which files and resources a compromised container process can access. Which technology is MOST appropriate?

1. Horizontal Pod Autoscaler
2. NetworkPolicy
3. ClusterRole
4. AppArmor or SELinux**

Correct Answer: 4. AppArmor or SELinux

Explanation:

AppArmor and SELinux provide mandatory access control on supported Linux platforms. They can restrict which files, devices, paths, and operations a process is allowed to access even when normal Unix permissions would otherwise permit the action. This gives containers an additional containment layer if the application is compromised. Kubernetes RBAC controls access to Kubernetes API resources, while NetworkPolicy controls network traffic and the Horizontal Pod Autoscaler adjusts replica counts. Mandatory access control is especially valuable when combined with seccomp, non-root execution, restricted Linux capabilities, and prevention of privilege escalation. Policies should be tested and maintained because overly restrictive rules can cause application failures, while overly permissive profiles provide little security benefit. These controls strengthen node-level process isolation rather than replacing Kubernetes-layer authorization.

Question 209.

A development team uses a large general-purpose Linux base image for a simple production microservice. Which change BEST reduces container attack surface?

1. Use a minimal runtime image containing only required libraries and application components
2. Keep the general-purpose image but disable shell history
3. Install additional diagnostic packages for faster troubleshooting
4. Increase the number of image layers to separate packages

Correct Answer: 1. Use a minimal runtime image containing only required libraries and application components

Explanation:

Minimal runtime images reduce the number of packages, binaries, and libraries that may contain vulnerabilities or provide useful tools to an attacker. Multi-stage builds are commonly used so compilers, package managers, and build dependencies remain in an earlier stage while the final production image contains only runtime components. Disabling shell history does not remove shells or vulnerable software, and additional diagnostic packages increase the attack surface. The number of image layers does not inherently improve security if the same unnecessary components remain present. Minimal images should still be scanned, signed, patched, and associated with reliable provenance because small images can still contain vulnerable application libraries. Image minimization is one element of a broader secure software supply chain.

Question 210.

A company wants to know whether a newly disclosed vulnerability exists in any of its production container images. Which information source can MOST directly accelerate this analysis?

1. Kubernetes Events
2. Container image SBOMs associated with exact image versions
3. Pod readiness probe results
4. Namespace ResourceQuotas

Correct Answer: 2. Container image SBOMs associated with exact image versions

Explanation:

A Software Bill of Materials provides an inventory of software components and dependency versions included in an artifact. When a new vulnerability is disclosed, security teams can compare the affected component against SBOM data to quickly identify potentially impacted images. Associating the SBOM with an exact image digest is important because mutable tags may later point to different content. An SBOM does not determine automatically whether a vulnerability is exploitable, so exposure analysis, vulnerability scanning, and remediation are still required. Kubernetes Events and readiness probes describe runtime or operational state, while ResourceQuotas manage resource consumption. They do not provide a package inventory. Accurate SBOMs significantly improve vulnerability response and software supply chain visibility when generated and maintained through trusted build processes.

Question 211.

A registry tag called production can be overwritten with a new image. Which deployment practice BEST ensures Kubernetes runs the exact artifact that passed security review?

1. Deploy using the approved immutable image digest
2. Deploy the production tag but increase registry audit logging
3. Scan the image each time a pod starts
4. Allow only namespace administrators to reference the tag

Correct Answer: 1. Deploy using the approved immutable image digest

Explanation:

An image digest identifies exact artifact content and remains stable even if a mutable tag such as production is later changed to point elsewhere. Digest-based deployment therefore improves reproducibility, auditability, rollback confidence, and incident investigation. Registry audit logging is valuable for detecting changes but does not stop a deployment from retrieving altered content under the same tag. Runtime scanning may identify vulnerabilities but does not establish that the running image is the one originally approved. Access control over who references a tag does not protect the tag from registry-side modification. Strong supply chain security combines digest pinning with restricted registry writes, image signing, provenance, vulnerability scanning, and admission policies that verify approved artifacts before execution.

Question 212.

Which control BEST verifies that a container image was approved by a trusted signing authority before it is allowed to run?

1. NetworkPolicy validation
2. Runtime process monitoring
3. Signature verification during admission
4. ResourceQuota enforcement

Correct Answer: 3. Signature verification during admission

Explanation:

Digital signatures can provide evidence that an artifact was approved or produced by a trusted signing identity and has not changed since signing. Verifying those signatures during admission allows the cluster to reject unsigned or untrusted images before they execute. This is stronger than checking signatures manually after deployment. The signing keys themselves must be protected carefully because compromise of a trusted signing key could allow an attacker to sign malicious artifacts that appear legitimate. Signature verification should be combined with trusted build provenance, immutable digests, vulnerability scanning, controlled registries, and secure CI/CD systems. NetworkPolicies and ResourceQuotas address runtime networking and resource consumption, while runtime monitoring detects behavior after deployment. They do not validate artifact authenticity before execution.

Question 213.

A CI/CD pipeline can publish images to a production registry but does not need to delete repositories or modify registry administrators. Which access model is MOST secure?

1. Grant only the image-push permissions required for the target production repository
2. Grant registry administrator privileges but protect the token with encryption
3. Share one registry administrator account across all pipelines
4. Give the pipeline delete access so it can clean up failed builds automatically

Correct Answer: 1. Grant only the image-push permissions required for the target production repository

Explanation:

CI/CD identities should receive narrowly scoped permissions based on their required actions. If a pipeline only needs to publish images to one production repository, it should not be able to administer the registry, modify unrelated repositories, or delete protected artifacts. Least privilege reduces the impact of pipeline compromise. Encrypting a highly privileged token protects it at rest but does not reduce what an attacker could do after obtaining or misusing it. Shared administrator accounts also weaken accountability and increase the blast radius. Separate pipeline identities, short-lived credentials where practical, audit logging, protected repositories, immutable releases, and signature verification provide stronger supply chain protection. Permissions should be periodically reviewed as pipeline responsibilities evolve.

Question 214.

A developer accidentally commits a production API key to a private source repository that is accessible to the engineering team. What should be done FIRST?

1. Remove the key from the latest commit and continue using it
2. Rotate or revoke the key and investigate potential exposure
3. Change the repository from private to internal visibility
4. Add the key to .gitignore without changing it

Correct Answer: 2. Rotate or revoke the key and investigate potential exposure

Explanation:

A credential committed to source control should be treated as exposed because repository history may retain it even after the latest file is changed. Other developers, automated systems, backups, mirrors, or integrations may already have copied the secret. Rotating or revoking the key removes the value of any leaked copies. The organization should also review repository access and service logs to determine whether the credential was misused. Secret scanning and secure secret-management systems can help prevent recurrence. Adding the file to .gitignore protects against future accidental commits but does not remove existing historical exposure. Private repositories still have multiple authorized readers and may themselves be compromised, so private visibility does not make committed production secrets safe.

Question 215.

A runtime security system reports that a normally static application container has launched bash, executed a network scanner, and begun contacting unfamiliar internal addresses. What should the security team assume?

1. The behavior is suspicious and should trigger investigation and containment procedures
2. The activity is expected because Kubernetes performs internal health checks
3. The application is simply discovering Services more efficiently
4. The behavior confirms that the container image is correctly signed

Correct Answer: 1. The behavior is suspicious and should trigger investigation and containment procedures

Explanation:

Unexpected shell execution combined with network scanning is a strong runtime anomaly for a workload that normally serves a fixed application. It may indicate successful exploitation, unauthorized debugging, credential theft, or lateral movement activity. The security team should investigate the process tree, command execution, network destinations, service account permissions, image digest, recent deployments, and Kubernetes audit logs. Containment may involve isolating the workload or restricting its network access while preserving evidence. Kubernetes health probes do not normally launch interactive shells and scan neighboring services. Image signatures establish artifact authenticity but do not guarantee safe runtime behavior. Runtime monitoring is therefore essential because malicious activity can occur after an otherwise trusted image has been successfully deployed.

Question 216.

A workload has been confirmed compromised. Which incident-response action BEST balances containment with forensic needs?

1. Immediately delete every related pod, node log, and audit event
2. Restart the Deployment repeatedly until suspicious behavior stops
3. Isolate the affected workload while preserving logs, image identity, runtime evidence, and relevant API activity
4. Scale the Deployment to zero and permanently discard all associated telemetry

Correct Answer: 3. Isolate the affected workload while preserving logs, image identity, runtime evidence, and relevant API activity

Explanation:

Containment should stop or limit malicious activity while preserving enough evidence to understand how the compromise occurred and what else may have been affected. Depending on organizational procedures, responders may isolate the workload with network controls, remove it from service, capture process and network information, preserve Kubernetes audit logs, record exact image digests, and identify potentially exposed credentials. Deleting logs or repeatedly restarting pods can destroy volatile evidence while leaving the underlying vulnerability unresolved. Scaling to zero may be appropriate in some incidents, but telemetry should be preserved first whenever practical. Incident-response playbooks should define these actions in advance so responders do not improvise under pressure. Effective response includes containment, investigation, eradication, recovery, and lessons learned.

Question 217.

Which network design BEST reduces lateral movement from a compromised front-end service to internal databases?

1. Use default-deny policies and explicitly allow only required front-end-to-backend communication
2. Permit all namespace traffic but require TLS everywhere
3. Place all services behind ClusterIP resources
4. Use different DNS names for each application tier

Correct Answer: 1. Use default-deny policies and explicitly allow only required front-end-to-backend communication

Explanation:

A default-deny network model restricts workloads from communicating unless a policy explicitly allows the required path. A front-end may need to reach an API backend but should not automatically have direct access to databases or unrelated services. This reduces the attacker’s options after compromising the front-end workload. TLS protects confidentiality and identity for permitted connections but does not by itself stop unauthorized workloads from attempting to connect. ClusterIP Services are not security boundaries, and DNS naming provides service discovery rather than access control. Network segmentation should be combined with workload identity, application authentication, separate credentials, RBAC, and runtime monitoring for stronger defense in depth.

Question 218.

A payment-processing pod requires access to a specific external payment endpoint but should not reach arbitrary Internet destinations. Which control is MOST appropriate?

1. A Kubernetes Role limiting Secret access
2. An egress NetworkPolicy or equivalent outbound network control
3. A read-only root filesystem
4. A PodDisruptionBudget

Correct Answer: 2. An egress NetworkPolicy or equivalent outbound network control

Explanation:

Egress restrictions can limit the destinations a workload is allowed to contact and reduce the risk of command-and-control traffic, data exfiltration, malware downloads, or external scanning after compromise. The policy should allow required infrastructure such as DNS and the approved payment endpoint while denying unnecessary destinations. Kubernetes NetworkPolicy support depends on the networking implementation, and dynamic external addresses may require additional egress technologies or gateway controls. RBAC limits Kubernetes API access, a read-only filesystem reduces modification inside the container, and a PodDisruptionBudget supports availability. Those controls are useful but do not directly constrain outbound network destinations. Sensitive payment workloads benefit from combining restricted egress with TLS, strong credentials, runtime monitoring, and least-privilege workload identities.

Question 219.

Which logging strategy BEST supports investigation when Kubernetes pods may be rescheduled or deleted during an incident?

1. Forward application, Kubernetes audit, node, and runtime security logs to protected centralized storage
2. Retain logs only inside each container to preserve workload isolation
3. Keep only Kubernetes Events because they are cluster-native
4. Disable long-term log retention to reduce the amount of sensitive evidence stored

Correct Answer: 1. Forward application, Kubernetes audit, node, and runtime security logs to protected centralized storage

Explanation:

Kubernetes workloads are ephemeral, so local container logs may disappear when pods are restarted, rescheduled, scaled down, or deleted by an attacker. Centralized logging preserves evidence independently of the workload lifecycle and enables correlation across multiple layers. Kubernetes audit logs show API operations, runtime telemetry captures suspicious processes and network activity, application logs provide service context, and node logs may reveal host-level compromise. Kubernetes Events are helpful but normally do not provide sufficient detail for full forensic analysis. The centralized logging platform should itself have strong authorization, retention, integrity protection, encryption, and monitoring. Sensitive information should be minimized or protected appropriately, but eliminating useful retention can make later investigation impossible.

Question 220.

Which approach BEST reflects a sustainable Kubernetes security program for a rapidly growing production environment?

1. Establish strong perimeter security and trust workloads once they pass image scanning
2. Perform an annual RBAC review and otherwise rely on platform defaults
3. Prioritize runtime monitoring while allowing developers broad deployment permissions
4. Continuously manage identity, RBAC, supply chain security, workload hardening, network controls, policy enforcement, monitoring, vulnerability management, and incident readiness**

Correct Answer: 4. Continuously manage identity, RBAC, supply chain security, workload hardening, network controls, policy enforcement, monitoring, vulnerability management, and incident readiness

Explanation:

Kubernetes environments change continually as applications, dependencies, users, clusters, and deployment pipelines evolve. Security must therefore be an ongoing process rather than a one-time hardening activity. Identity and RBAC should be reviewed regularly, vulnerable images rebuilt, admission policies maintained, registry and CI/CD access controlled, and workload security settings enforced consistently. Network communication should be minimized, while audit logging and runtime monitoring provide detection capabilities. Incident-response playbooks should be tested so teams can contain workloads, rotate credentials, preserve evidence, and recover safely. Supply chain controls should track provenance, signatures, SBOMs, and trusted artifact promotion. No single layer can address every cloud-native threat, so sustainable security depends on continuously maintained defense in depth.