View Full Linux Foundation KCSA Exam Dumps and Practice Test Dumps

 

Question 301.

A workload only needs to read a single ConfigMap in its namespace. Which Kubernetes authorization design BEST minimizes risk if the workload is compromised?

1. Use a dedicated service account and grant only the required read permission on that ConfigMap
2. Grant read access to all namespaced resources so future configuration changes do not require RBAC updates
3. Bind the workload to a shared application ClusterRole that includes read access to ConfigMaps and Secrets
4. Use the default service account and rely on NetworkPolicies to restrict misuse

Correct Answer: 1. Use a dedicated service account and grant only the required read permission on that ConfigMap

Explanation:

Least privilege means giving the workload only the API permissions it actually requires. A dedicated service account makes the workload’s identity explicit, while a narrowly scoped Role can limit access to the required ConfigMap and read verbs. Granting access to all resources or including Secrets unnecessarily increases the blast radius if the application or its token is compromised. NetworkPolicies regulate network communication, not Kubernetes API authorization, so they cannot substitute for correct RBAC. Using the default service account may also unintentionally couple multiple workloads to the same identity. Permissions should be reviewed periodically, and service account tokens should not be mounted at all when Kubernetes API access is unnecessary.

Question 302.

A security engineer discovers that an application service account can create Pods in its namespace, even though the application only needs to list Services. Why is this permission particularly concerning?

1. It may prevent the scheduler from placing workloads correctly
2. It may allow the application to consume more CPU than expected
3. Pod-creation permission can provide indirect access to mounted credentials, volumes, or other workload capabilities
4. It disables admission control for that namespace

Correct Answer: 3. Pod-creation permission can provide indirect access to mounted credentials, volumes, or other workload capabilities

Explanation:

Pod-creation permission can be more powerful than it initially appears. Depending on what other resources are accessible in the namespace, an identity that can create Pods may be able to launch a workload that mounts a Secret, uses a service account, accesses a volume, or requests security settings that expand its effective capabilities. This is an example of why RBAC review must consider indirect privilege paths, not only obvious permissions such as cluster-admin. The application should receive only the permissions needed to list Services. CPU consumption and scheduling behavior are operational concerns, while Pod creation does not automatically disable admission control. Strong admission policies can reduce some risks, but excessive RBAC should still be removed.

Question 303.

Which Kubernetes permission presents the MOST direct risk of allowing a user to expand another identity’s privileges?

1. Permission to list Deployments
2. Permission to create or modify RoleBindings
3. Permission to view Pod logs
4. Permission to read Services

Correct Answer: 2. Permission to create or modify RoleBindings

Explanation:

RoleBindings associate users, groups, or service accounts with Roles or ClusterRoles. If a user can create or modify a RoleBinding and reference a more privileged role, that user may be able to grant additional authority to themselves or another identity. This can create an indirect privilege-escalation path even when the user does not initially hold broad permissions. Viewing Pod logs or listing Services and Deployments may expose information, but those permissions do not normally alter authorization relationships directly. Security teams should closely restrict access to Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings, and monitor changes through Kubernetes audit logs. Sensitive authorization changes may also require approval workflows in higher-assurance environments.

Question 304.

A company wants to ensure production pods cannot run in privileged mode, use hostPID, or mount arbitrary hostPath volumes. Which control is BEST for enforcing this consistently before workloads start?

1. NetworkPolicy
2. Runtime anomaly detection
3. ResourceQuota
4. Admission policy enforcement

Correct Answer: 4. Admission policy enforcement

Explanation:

Admission enforcement is designed to evaluate Kubernetes objects before they are persisted and scheduled. This makes it the strongest preventive layer for rejecting known-risk configurations such as privileged containers, hostPID, hostIPC, hostNetwork, unsafe hostPath mounts, or excessive Linux capabilities. Runtime monitoring remains important because it can detect malicious behavior after deployment, but it is less effective for conditions that can be blocked ahead of time. NetworkPolicies regulate network communication, and ResourceQuotas manage resource consumption. Admission policies can be aligned with Pod Security Standards or organization-specific security requirements. Legitimate exceptions should be rare, documented, narrowly scoped, and protected with compensating controls such as dedicated nodes and enhanced monitoring.

Question 305.

A containerized application does not require root privileges. Which configuration BEST reduces the impact of a potential application compromise?

1. Configure the image and pod to run as a non-root user
2. Keep root execution but apply a default-deny NetworkPolicy
3. Keep root execution but remove package managers from the image
4. Use privileged mode only during application startup

Correct Answer: 1. Configure the image and pod to run as a non-root user

Explanation:

Running as non-root reduces the privileges available to an attacker who gains code execution inside the container. The image should be built with suitable file ownership, permissions, and application ports so it can operate without UID 0. Kubernetes security context settings such as runAsNonRoot can help enforce the requirement. NetworkPolicies and minimal images provide additional protection, but they do not reduce the Linux privilege of the running process. Privileged mode, even temporarily, significantly weakens isolation and should not be used for ordinary applications. Non-root execution is most effective when combined with dropped capabilities, allowPrivilegeEscalation: false, seccomp, mandatory access control, and read-only root filesystems where practical.

Question 306.

A service requires a single Linux capability to perform one network operation. Which hardening approach BEST follows least privilege?

1. Run the container as root while keeping the default capability set
2. Drop unnecessary capabilities and add back only the capability the application requires
3. Enable privileged mode and restrict egress
4. Add SYS_ADMIN so the container can handle future operational requirements

Correct Answer: 2. Drop unnecessary capabilities and add back only the capability the application requires

Explanation:

Linux capabilities allow individual privileges to be granted without providing the full authority of root or privileged mode. A secure configuration removes unnecessary capabilities and explicitly restores only the capability that has a demonstrated functional requirement. Keeping the default set exposes more kernel-level privileges than necessary, while privileged mode grants far broader access. SYS_ADMIN is especially powerful and should not be added for convenience or future flexibility. Capability reduction should be combined with non-root execution, seccomp, mandatory access control, and prevention of privilege escalation. The resulting configuration should be tested carefully so the application retains required functionality without exposing unnecessary authority to a compromised process.

Question 307.

Which pod security setting is specifically intended to prevent a process from gaining more privileges than its parent process?

1. allowPrivilegeEscalation: false
2. readOnlyRootFilesystem: true
3. automountServiceAccountToken: false
4. hostNetwork: false

Correct Answer: 1. allowPrivilegeEscalation: false

Explanation:

Setting allowPrivilegeEscalation to false helps prevent a container process from gaining additional privileges through mechanisms such as setuid binaries or file capabilities. A read-only root filesystem limits modification of files but does not directly control process privilege transitions. Disabling automatic service account token mounting reduces credential exposure, while avoiding host networking preserves network namespace isolation. All of these are useful hardening measures, but allowPrivilegeEscalation most directly addresses privilege gain within the process execution model. Strong workloads often combine this setting with non-root execution, capability reduction, seccomp, AppArmor or SELinux, and limited writable paths. Layered controls are more resilient than relying on any one setting in isolation.

Question 308.

Which Linux security feature is MOST appropriate for reducing the kernel attack surface by limiting the system calls a container process can invoke?

1. SELinux labeling
2. seccomp
3. Kubernetes RBAC
4. NetworkPolicy

Correct Answer: 2. seccomp

Explanation:

seccomp filters Linux system calls and can block kernel operations that an application does not require. Because many applications need only a subset of the available syscall interface, using an appropriate seccomp profile can reduce the attack surface exposed to a compromised process. SELinux is a mandatory access control framework and can restrict resource access, but it is not primarily a syscall filter. Kubernetes RBAC controls authorization to API resources, while NetworkPolicy governs network communication. seccomp profiles should be tested before broad enforcement because blocking a required syscall can cause application failure. They work best as one layer of container hardening alongside non-root execution, capability reduction, mandatory access control, and runtime monitoring.

Question 309.

A security team wants to prevent a compromised container process from reading files that are outside its approved access profile, even when normal Unix permissions might allow them. Which control is MOST appropriate?

1. AppArmor or SELinux
2. Horizontal Pod Autoscaler
3. ServiceAccount RBAC
4. PodDisruptionBudget

Correct Answer: 1. AppArmor or SELinux

Explanation:

AppArmor and SELinux provide mandatory access control at the Linux operating-system layer. They can restrict process access to files, devices, paths, and other resources even when traditional discretionary permissions would otherwise allow the action. This creates an additional containment layer for compromised workloads. ServiceAccount RBAC controls access to Kubernetes API resources and does not regulate ordinary filesystem interactions inside the operating system. Horizontal Pod Autoscaling and PodDisruptionBudgets address scaling and availability rather than access control. Mandatory access control policies should be tested carefully because overly restrictive rules can break legitimate workloads. They are most effective when combined with seccomp, non-root execution, capability minimization, and read-only filesystem settings.

Question 310.

A production image contains compilers, package managers, source code, and debugging tools that are required only during the build. Which practice BEST reduces runtime attack surface?

1. Keep the full image but use a private registry
2. Use a multi-stage build and copy only required runtime artifacts into the final image
3. Keep the tools and rely on NetworkPolicies to prevent misuse
4. Move development tools to a non-default directory inside the image

Correct Answer: 2. Use a multi-stage build and copy only required runtime artifacts into the final image

Explanation:

Multi-stage builds separate build-time dependencies from the production runtime. Compilers, package managers, source code, and diagnostic utilities can remain in an earlier stage, while the final image contains only the application and required runtime libraries. This reduces vulnerable software and limits the tools available to an attacker after compromise. A private registry protects distribution but does not reduce the contents of the image. NetworkPolicies restrict communication rather than software availability, and placing tools in another directory does not prevent their execution. Minimal runtime images should still be scanned, signed, patched, and associated with provenance and SBOM data. Reducing unnecessary components is a foundational supply chain and container-hardening practice.

Question 311.

Which artifact gives a security team the BEST software inventory for determining whether a newly disclosed vulnerability affects a container image?

1. An SBOM associated with the exact image digest
2. A Kubernetes audit log
3. A NetworkPolicy manifest
4. A PodSecurity configuration

Correct Answer: 1. An SBOM associated with the exact image digest

Explanation:

A Software Bill of Materials provides an inventory of software components and dependency versions included in an artifact. Linking the SBOM to an exact image digest ensures that the inventory corresponds to the precise content deployed rather than a mutable tag that may later change. When a vulnerability is disclosed, the team can search SBOM data for the affected package and identify potentially impacted images. An SBOM does not by itself determine whether a vulnerability is exploitable, so exposure analysis, scanning, and remediation remain necessary. Audit logs, NetworkPolicies, and Pod Security configuration describe runtime activity or platform policy rather than software composition. Accurate SBOMs improve vulnerability response and software supply chain transparency.

Question 312.

A deployment manifest references the tag prod-latest, which can be changed in the registry. Which control BEST ensures the exact approved artifact is deployed?

1. Require registry authentication for all pulls
2. Reference the approved image by immutable digest
3. Enable imagePullPolicy: Always
4. Increase registry log retention

Correct Answer: 2. Reference the approved image by immutable digest

Explanation:

A digest identifies the exact content of an image and does not change when a tag is reassigned. Mutable tags such as prod-latest can later point to different artifacts, which may cause a restarted workload to run unreviewed content even though the deployment manifest itself did not change. Registry authentication is important but does not prevent authorized or compromised users from replacing a tag. imagePullPolicy: Always can actually increase exposure because the pod retrieves whatever content the tag currently references. Registry logging helps detect changes but does not prevent them. Digest pinning should be combined with restricted registry writes, image signatures, provenance, vulnerability scanning, and admission policies for stronger supply chain assurance.

Question 313.

A company wants Kubernetes to reject images that were not produced by its approved CI pipeline. Which mechanism is MOST appropriate?

1. Admission-time verification of trusted image signatures or provenance
2. A namespace ResourceQuota
3. A default-deny ingress policy
4. Runtime CPU anomaly monitoring

Correct Answer: 1. Admission-time verification of trusted image signatures or provenance

Explanation:

Trusted signatures and build provenance can provide evidence that an image came from an approved build process. Verifying that evidence during admission allows Kubernetes to reject artifacts that do not meet organizational trust requirements before they execute. ResourceQuotas control resource consumption, NetworkPolicies restrict network paths, and runtime monitoring detects behavior after deployment. Those controls do not establish artifact origin. Signature and provenance systems must themselves be protected because compromised signing keys or build infrastructure could make malicious artifacts appear legitimate. Strong supply chain security therefore combines admission verification with protected source repositories, secure CI/CD systems, trusted registries, immutable digests, vulnerability scanning, and controlled release credentials.

Question 314.

A deployment pipeline needs to update Deployments in one namespace but does not need to modify RBAC objects. Which configuration BEST reduces the blast radius if the pipeline is compromised?

1. Grant namespace-admin so the pipeline can adapt to future changes
2. Grant only the required Deployment permissions and exclude RBAC administration
3. Allow RoleBinding creation but deny ClusterRoleBinding creation
4. Grant cluster-wide write access but require manual approvals for production runs

Correct Answer: 2. Grant only the required Deployment permissions and exclude RBAC administration

Explanation:

CI/CD identities should be limited to the resources, verbs, and environments they actually need. If the pipeline only updates Deployments in one namespace, there is no reason for it to modify RoleBindings, Roles, Secrets, or unrelated resources. Granting namespace-admin or cluster-wide write access creates a much larger blast radius. Even permission to create RoleBindings can become an escalation path if the pipeline can reference powerful roles. Manual approvals are useful governance controls but do not compensate for excessive authorization once the pipeline is compromised. Strong CI/CD security combines least privilege, dedicated identities, short-lived credentials where possible, protected pipeline configuration, artifact verification, and comprehensive audit logging.

Question 315.

A production service account that historically reads ConfigMaps suddenly begins listing Secrets and creating Pods. What is the BEST initial interpretation?

1. The activity may indicate credential misuse, an RBAC change, or workload compromise and should be investigated
2. The behavior is expected when Kubernetes rotates service account credentials
3. The service account is performing normal discovery for the scheduler
4. The activity proves the application has passed admission checks

Correct Answer: 1. The activity may indicate credential misuse, an RBAC change, or workload compromise and should be investigated

Explanation:

A sudden change in the resources an identity accesses is a significant behavioral signal. A service account that normally reads ConfigMaps but begins listing Secrets or creating Pods may have been compromised, granted additional permissions, or misused by an attacker. Security teams should review Kubernetes audit logs, recent Role and RoleBinding changes, runtime process activity, network connections, deployment history, and image identity. Service account token rotation does not automatically grant new permissions, and the scheduler does not require application service accounts to perform this type of discovery. Admission controls can prevent some insecure configurations but do not guarantee that every authorized runtime action is legitimate. Behavioral monitoring helps detect abuse of valid credentials.

Question 316.

A runtime security tool detects that a web container unexpectedly launches a shell, downloads a binary, and executes it. Which response is MOST appropriate?

1. Increase the pod’s CPU allocation so the suspicious process can be analyzed without interruption
2. Treat the behavior as a possible compromise, contain the workload, and preserve evidence
3. Add the external download host to the application allowlist
4. Restart the pod immediately and discard the previous container logs

Correct Answer: 2. Treat the behavior as a possible compromise, contain the workload, and preserve evidence

Explanation:

Unexpected shell execution, binary download, and execution are strong indicators of possible exploitation or unauthorized activity. The security team should follow incident-response procedures, which may include isolating the workload, restricting network communication, preserving logs, capturing relevant process and network state, and identifying the exact image and credentials involved. Restarting the pod without preserving evidence can destroy valuable information and may not fix the underlying vulnerability. Increasing resources or allowlisting the destination would facilitate suspicious activity rather than contain it. After containment, investigators can determine the root cause, rotate exposed credentials, rebuild workloads from trusted artifacts, and validate that the vulnerability or misconfiguration has been addressed before returning the service to production.

Question 317.

Which network design BEST reduces the chance that a compromised front-end pod can connect directly to sensitive database services?

1. Use default-deny NetworkPolicies and explicitly permit only required front-end-to-backend traffic
2. Encrypt all east-west traffic but allow every pod to connect to every Service
3. Place the database in a separate Deployment without network policy
4. Use a different DNS suffix for database Services

Correct Answer: 1. Use default-deny NetworkPolicies and explicitly permit only required front-end-to-backend traffic

Explanation:

A default-deny network posture creates explicit communication paths rather than assuming all internal traffic is trustworthy. The front end may be permitted to reach an API backend while direct database access remains blocked. This limits lateral movement after compromise. Encryption is valuable for confidentiality and endpoint identity, but it does not prevent unauthorized connection attempts when every workload has network reachability. Separate Deployments and DNS naming provide organization, not security isolation. Network segmentation should be combined with application authentication, separate credentials, workload identity, and runtime monitoring. A strong architecture enforces the intended application communication graph instead of relying on developers or attackers to respect logical tier boundaries voluntarily.

Question 318.

A payment-processing pod should communicate externally only with DNS and two approved payment APIs. Which control BEST limits outbound exposure?

1. A namespace-scoped RBAC Role
2. An egress NetworkPolicy or equivalent outbound filtering mechanism
3. A read-only root filesystem
4. A PodDisruptionBudget

Correct Answer: 2. An egress NetworkPolicy or equivalent outbound filtering mechanism

Explanation:

Egress controls restrict which destinations a workload is allowed to contact. A payment workload that needs only DNS and two approved APIs should not have unrestricted Internet access. Restrictive egress reduces opportunities for command-and-control communication, malware downloads, external scanning, or data exfiltration if the workload is compromised. Kubernetes NetworkPolicy can provide this control when supported by the cluster networking implementation, while dynamic external destinations may require an egress gateway or firewall. RBAC controls Kubernetes API actions, a read-only filesystem limits local modification, and a PodDisruptionBudget supports availability. These controls do not constrain outbound destinations. Runtime network monitoring should complement egress restrictions so unusual connection attempts remain visible.

Question 319.

Which logging architecture BEST preserves security evidence when compromised pods may be restarted, rescheduled, or deleted before investigation begins?

1. Forward application, Kubernetes audit, node, and runtime logs to protected centralized storage
2. Store all logs only inside container filesystems
3. Retain only Kubernetes Events because they are cluster-native
4. Disable long-term retention to reduce the chance of storing sensitive information

Correct Answer: 1. Forward application, Kubernetes audit, node, and runtime logs to protected centralized storage

Explanation:

Kubernetes workloads are ephemeral, and local logs may disappear when pods restart, reschedule, scale down, or are deleted by an attacker. Centralized logging preserves evidence independently of the workload lifecycle and allows analysts to correlate multiple data sources. Kubernetes audit logs reveal API activity, runtime security telemetry captures suspicious processes and network behavior, application logs provide workload context, and node logs may reveal host-level compromise. Kubernetes Events are useful but generally insufficient for full forensic reconstruction. Centralized storage should have strong access controls, integrity protection, encryption, retention policies, and monitoring. Effective incident readiness requires collecting relevant evidence before compromise because data that was never retained cannot be recreated after the fact.

Question 320.

Which approach BEST represents a mature Kubernetes and cloud-native security program?

1. Rely on strong perimeter security and image scanning before deployment
2. Combine RBAC and NetworkPolicies while trusting approved CI/CD pipelines by default
3. Focus primarily on runtime monitoring and respond when suspicious activity occurs
4. Continuously integrate identity security, least privilege, workload hardening, software supply chain assurance, network segmentation, policy enforcement, vulnerability management, logging, monitoring, and incident response

Correct Answer: 4. Continuously integrate identity security, least privilege, workload hardening, software supply chain assurance, network segmentation, policy enforcement, vulnerability management, logging, monitoring, and incident response

Explanation:

A mature cloud-native security program uses defense in depth across the entire lifecycle. Identity and RBAC protect Kubernetes API access, while hardened workloads reduce privilege and writable attack surface. Supply chain controls protect source repositories, dependencies, build systems, registries, signatures, provenance, and artifact promotion. Admission policies stop known-insecure configurations before runtime, and NetworkPolicies limit lateral movement and unnecessary egress. Continuous vulnerability management is essential because new weaknesses can be discovered after deployment. Runtime monitoring, Kubernetes audit logs, and centralized telemetry provide visibility when preventive controls fail. Tested incident-response procedures prepare teams to contain affected workloads, rotate credentials, preserve evidence, eradicate root causes, and recover safely. Sustainable security depends on continuously maintaining all these layers as systems and threats evolve.