View Full Linux Foundation KCSA Exam Dumps and Practice Test Dumps

 

Question 341.

A Kubernetes application needs to read one ConfigMap and one Secret in its namespace but does not require any write access. Which RBAC design BEST follows least privilege?

1. Create a dedicated service account and a namespaced Role granting only the required read permissions on those specific resources
2. Grant the application read access to all ConfigMaps and Secrets across the cluster
3. Use the default service account with namespace-wide read permissions
4. Bind the application to a ClusterRole that includes read access to workloads, Secrets, and RBAC objects

Correct Answer: 1. Create a dedicated service account and a namespaced Role granting only the required read permissions on those specific resources

Explanation:

A dedicated service account combined with a narrowly scoped Role gives the workload only the permissions required for its function. If the application needs to read one ConfigMap and one Secret, access should be limited to those resources and read-only verbs. Cluster-wide read access creates unnecessary exposure, while use of the default service account can couple unrelated workloads to the same identity. A broader ClusterRole that includes RBAC objects also increases the potential impact of compromise. Least privilege applies not only to verbs such as get or list, but also to resource names, namespaces, and identity scope. Audit logging and periodic permission reviews can help ensure the workload’s permissions remain appropriate over time.

Question 342.

A platform team discovers that a service account used by a reporting application can create Deployments, even though the application only needs to list Pods. What is the BEST action?

1. Keep the permission but monitor deployment creation
2. Remove the unnecessary Deployment creation permission and retain only the required read access
3. Move the service account to a different namespace
4. Add a NetworkPolicy while leaving RBAC unchanged

Correct Answer: 2. Remove the unnecessary Deployment creation permission and retain only the required read access

Explanation:

Permission to create Deployments gives the identity the ability to launch new workloads, which can significantly increase the impact of compromise. If the reporting application only needs to list Pods, its RBAC should be reduced accordingly. Monitoring is valuable but does not eliminate the risk created by excessive authorization. Moving the account to another namespace does not necessarily remove the problematic permission, and NetworkPolicy controls traffic rather than Kubernetes API authorization. Excessive write permissions should be treated seriously because they may be chained with service accounts, Secrets, volumes, or workload settings to create indirect privilege escalation. Least privilege is stronger when unnecessary capabilities are removed instead of merely observed.

Question 343.

Which Kubernetes authorization capability should be treated as highly sensitive because it can allow one identity to act as another?

1. Permission to list Services
2. Permission to read Deployment status
3. Permission to impersonate users, groups, or service accounts
4. Permission to watch Pods

Correct Answer: 3. Permission to impersonate users, groups, or service accounts

Explanation:

Impersonation can allow a user or service account to submit API requests using another identity’s security context. If the impersonated identity has stronger permissions, this can become a privilege-escalation path. For that reason, impersonation permissions should be limited to trusted components or administrators with a clear, documented need. Listing Services, watching Pods, and viewing Deployment status can reveal useful information but usually do not provide the same ability to assume another identity. Kubernetes audit logs are especially important for tracking impersonation requests and identifying the initiating principal. RBAC reviews should examine not only obvious administrator roles but also permissions that create indirect escalation paths through identity or authorization manipulation.

Question 344.

A company wants to prevent developers from deploying workloads that request privileged mode, host networking, or unsafe hostPath volumes. Which control is BEST for preventive enforcement?

1. Runtime threat detection
2. NetworkPolicy
3. Namespace ResourceQuota
4. Admission policy enforcement

Correct Answer: 4. Admission policy enforcement

Explanation:

Admission policies evaluate workload specifications before Kubernetes accepts and schedules them. This makes them an effective preventive control for settings such as privileged mode, hostNetwork, hostPID, hostIPC, unsafe hostPath volumes, or excessive Linux capabilities. Runtime detection remains important for identifying malicious behavior after execution, but it is preferable to block known-dangerous configurations before they start. NetworkPolicies control traffic, while ResourceQuotas limit resource consumption rather than privilege. Admission rules can align with Pod Security Standards or custom enterprise policy. Legitimate exceptions for trusted system components should be narrowly scoped, documented, periodically reviewed, and paired with compensating controls such as node isolation, stronger monitoring, or restricted service accounts.

Question 345.

A containerized application needs temporary writable storage only under /tmp. Which configuration BEST limits filesystem modification?

1. Configure a read-only root filesystem and mount a writable volume only at /tmp
2. Keep the root filesystem writable but run the process as non-root
3. Mount the node’s /tmp directory directly into the container
4. Run the container as privileged and mark only application binaries read-only

Correct Answer: 1. Configure a read-only root filesystem and mount a writable volume only at /tmp

Explanation:

A read-only root filesystem prevents the application process from modifying most content packaged in the image, including binaries, libraries, and configuration. If the workload needs temporary writes only under /tmp, a dedicated writable volume at that path provides the required functionality while minimizing writable attack surface. Running as non-root is also important but does not stop modification of all files the process can access. Mounting a host directory introduces unnecessary node exposure, while privileged mode significantly weakens container isolation. This approach follows least privilege for filesystem access and should be combined with capability reduction, disabled privilege escalation, seccomp, and mandatory access control where compatible.

Question 346.

A service requires one specific Linux capability but does not need any others. Which security configuration is MOST appropriate?

1. Retain the default capability set for compatibility
2. Drop unnecessary capabilities and add back only the specific required capability
3. Run the container as root and rely on seccomp
4. Enable privileged mode and restrict network traffic

Correct Answer: 2. Drop unnecessary capabilities and add back only the specific required capability

Explanation:

Linux capabilities let applications receive individual privileged operations without being given full root-style authority. If one capability is required, the safest design removes the rest and explicitly restores only that one. Retaining a broad default set leaves unnecessary privilege available to an attacker after compromise. Running as root expands process authority, while privileged mode weakens many isolation mechanisms and cannot be made equivalent to least privilege through network restrictions. Capability minimization is best combined with non-root execution, allowPrivilegeEscalation: false, seccomp, AppArmor or SELinux, and limited writable storage. The minimized configuration should be tested so the application remains functional while exposing as little kernel-level privilege as possible.

Question 347.

Which security setting MOST directly prevents a process from gaining additional privileges through mechanisms such as setuid executables?

1. allowPrivilegeEscalation: false
2. readOnlyRootFilesystem: true
3. automountServiceAccountToken: false
4. hostNetwork: false

Correct Answer: 1. allowPrivilegeEscalation: false

Explanation:

allowPrivilegeEscalation: false is specifically designed to prevent a process from gaining more privileges than its parent process. This can block common escalation mechanisms involving setuid binaries or file capabilities. A read-only filesystem limits file changes but does not directly govern privilege transitions. Disabling service account token mounting protects Kubernetes API credentials, and avoiding host networking preserves network namespace isolation. These controls address different security concerns and are strongest when combined. A hardened container typically uses non-root execution, capability reduction, disabled privilege escalation, seccomp, mandatory access control, and narrowly scoped writable paths to create multiple independent barriers against compromise escalation.

Question 348.

Which Linux security mechanism is designed specifically to restrict the system calls a containerized process can execute?

1. AppArmor
2. Kubernetes RBAC
3. NetworkPolicy
4. seccomp

Correct Answer: 4. seccomp

Explanation:

seccomp reduces kernel attack surface by filtering the Linux system calls available to a process. Many applications use only a subset of all syscalls, so unnecessary operations can be blocked. Kubernetes can apply runtime-default or custom seccomp profiles to workloads. AppArmor is also a valuable Linux security control, but it provides mandatory access restrictions around files and process behavior rather than functioning primarily as a syscall filter. RBAC controls Kubernetes API permissions, while NetworkPolicy governs network communication. seccomp should be tested because blocking a required syscall can cause application failure. It works best as one layer in a broader container-hardening strategy that also includes non-root execution and capability minimization.

Question 349.

A security engineer wants to restrict a container process from accessing sensitive files even when traditional Unix permissions would permit the access. Which mechanism is MOST appropriate?

1. AppArmor or SELinux
2. ResourceQuota
3. ServiceAccount RBAC
4. Horizontal Pod Autoscaler

Correct Answer: 1. AppArmor or SELinux

Explanation:

AppArmor and SELinux provide mandatory access control at the operating-system layer. They can constrain which files, devices, paths, and other system resources a process may access, even when normal discretionary permissions would otherwise allow it. This creates an additional containment layer for compromised workloads. Kubernetes RBAC governs access to API resources rather than local filesystem operations. ResourceQuotas and autoscaling manage capacity rather than process access control. Mandatory access control profiles must be tested carefully because incorrect rules can break legitimate applications. They are most effective when combined with seccomp, non-root execution, capability reduction, read-only filesystems, and admission policies that enforce secure workload configuration consistently.

Question 350.

A production image contains a compiler, source code, shell utilities, and a package manager that are required only during the build. Which approach BEST reduces runtime attack surface?

1. Keep the full image but apply strict egress policies
2. Use a multi-stage build and include only required runtime artifacts in the final image
3. Keep the tools but disable package repositories
4. Put the build tools in a directory that is not included in the application PATH

Correct Answer: 2. Use a multi-stage build and include only required runtime artifacts in the final image

Explanation:

Multi-stage builds allow build-time dependencies to remain in earlier image stages while only the application and necessary runtime libraries are copied into the final image. This reduces the number of packages that may contain vulnerabilities and limits the tools available to an attacker after compromise. Egress restrictions help contain network activity but do not remove unnecessary binaries. Disabling package repositories still leaves installed tools present, while removing them from PATH does not prevent direct execution. Minimal runtime images should still be scanned, signed, patched, and linked to SBOM and provenance data. Removing unnecessary components is a stronger preventive control than relying on attackers not to find or use them.

Question 351.

Which artifact provides the BEST inventory for identifying whether a production image contains a newly vulnerable software package?

1. An SBOM tied to the exact image digest
2. Kubernetes audit logs
3. A NetworkPolicy manifest
4. A PodDisruptionBudget

Correct Answer: 1. An SBOM tied to the exact image digest

Explanation:

An SBOM lists software components and dependency versions contained in an artifact. Tying it to an exact image digest ensures the inventory corresponds to the precise image rather than a mutable tag. When a vulnerability is disclosed, security teams can search SBOM data to identify potentially affected images quickly. An SBOM does not automatically establish whether the vulnerability is exploitable, so teams must still consider reachability, exposure, business impact, and remediation. Audit logs, NetworkPolicies, and PodDisruptionBudgets provide important operational information but do not describe the contents of a software artifact. Accurate SBOMs are therefore a key component of mature software supply chain and vulnerability-management programs.

Question 352.

A Deployment references the mutable tag production. Which practice BEST guarantees that the exact approved artifact is used?

1. Increase registry log retention
2. Reference the approved image by immutable digest
3. Enable imagePullPolicy: Always
4. Restrict Deployment restarts to administrators

Correct Answer: 2. Reference the approved image by immutable digest

Explanation:

A digest uniquely identifies the exact content of a container image. A mutable tag such as production can later be reassigned to different content, potentially causing a restarted pod to run an image that was never reviewed. Using an immutable digest removes this ambiguity and improves reproducibility, rollback confidence, and forensic investigation. Registry logs can help detect tag changes but do not prevent them. imagePullPolicy: Always may actually make tag replacement more impactful because the current content is pulled on each restart. Restricting restarts does not solve the artifact identity problem. Digest pinning should be layered with restricted registry writes, signatures, provenance, scanning, and admission verification.

Question 353.

A company wants Kubernetes to allow only images produced by its approved build system. Which control BEST supports this requirement?

1. Admission-time verification of trusted signatures or build provenance
2. A PodDisruptionBudget
3. A namespace ResourceQuota
4. Runtime memory monitoring

Correct Answer: 1. Admission-time verification of trusted signatures or build provenance

Explanation:

Signatures and trusted provenance can provide evidence that an image was generated or approved by a recognized build process. Performing verification during admission allows the cluster to reject artifacts that do not meet supply chain trust requirements before they execute. PodDisruptionBudgets and ResourceQuotas address availability and resource consumption, while memory monitoring observes runtime behavior. None of those controls establishes artifact origin. Signing keys and provenance systems must themselves be strongly protected because compromised trust infrastructure can make malicious artifacts appear legitimate. Admission verification should be combined with secure source control, hardened CI/CD systems, trusted registries, immutable digests, vulnerability scanning, and restricted release permissions.

Question 354.

A deployment pipeline needs to update Deployments in one namespace but does not require permission to create Roles or RoleBindings. Which configuration is MOST secure?

1. Grant namespace-admin so future changes do not require policy updates
2. Grant only the required Deployment permissions in the target namespace
3. Permit RoleBinding creation but block ClusterRoleBinding creation
4. Grant cluster-wide write access but use a short-lived credential

Correct Answer: 2. Grant only the required Deployment permissions in the target namespace

Explanation:

The pipeline identity should receive only the verbs, resource types, and namespace scope required for deployment. Namespace-admin grants many unrelated capabilities, while RoleBinding creation can become an indirect privilege-escalation path if the pipeline can reference stronger roles. Short-lived credentials reduce exposure duration but do not make excessive cluster-wide authorization safe. Least privilege must be enforced at the authorization layer. Strong CI/CD security also includes dedicated identities, environment separation, protected pipeline configuration, artifact verification, and comprehensive audit logging. If deployment requirements change later, permissions can be reviewed and deliberately expanded rather than granting broad authority in advance for convenience.

Question 355.

A service account that normally reads ConfigMaps suddenly begins reading Secrets and creating Pods. Which explanation should the security team consider FIRST?

1. Possible credential compromise or an unexpected RBAC change
2. Normal behavior caused by pod rescheduling
3. Automatic privilege expansion by Kubernetes
4. A routine effect of NetworkPolicy updates

Correct Answer: 1. Possible credential compromise or an unexpected RBAC change

Explanation:

A service account’s sudden access to sensitive resources or write operations that do not match its established behavior is a significant security signal. The team should investigate Kubernetes audit logs, recent Role and RoleBinding changes, workload processes, network activity, deployment history, and image identity. Kubernetes does not automatically expand service account permissions during normal operations, and rescheduling or NetworkPolicy changes do not grant API privileges. Ideally, least-privilege RBAC would prevent these actions entirely. Behavioral monitoring remains valuable because attackers often abuse valid credentials and technically authorized API requests. Unexpected use of sensitive resources should therefore trigger investigation even when authentication and authorization succeed.

Question 356.

A runtime security tool detects a shell launching inside a fixed-function application container, followed by downloading and executing an unknown binary. What is the MOST appropriate response?

1. Increase the container’s CPU limit for further observation
2. Treat the event as a possible compromise, isolate the workload, and preserve evidence
3. Add the remote download host to the egress allowlist
4. Restart the pod and remove old logs

Correct Answer: 2. Treat the event as a possible compromise, isolate the workload, and preserve evidence

Explanation:

Unexpected shell execution followed by downloading and running an unfamiliar binary is a high-value indicator of possible exploitation or malicious activity. Incident-response procedures should prioritize containment while preserving evidence. The team may restrict network access, remove the workload from service, capture process and connection information, preserve audit and application logs, and identify exposed credentials. Increasing resources or allowlisting the destination would support suspicious behavior rather than contain it. Restarting the pod and deleting logs can destroy valuable forensic evidence without fixing the underlying vulnerability. After containment, the organization should determine root cause, rotate affected credentials, rebuild from trusted artifacts, and validate remediation before restoring normal service.

Question 357.

Which network design BEST prevents a compromised front-end pod from directly reaching a database that should only be accessed by the backend tier?

1. Use default-deny NetworkPolicies and explicitly permit only approved application communication paths
2. Encrypt all internal traffic while allowing every pod to communicate freely
3. Put each tier in a separate Deployment without additional network controls
4. Use unique DNS names for each application component

Correct Answer: 1. Use default-deny NetworkPolicies and explicitly permit only approved application communication paths

Explanation:

Default-deny NetworkPolicies create an explicit communication model rather than assuming internal traffic is trusted. The front end can be allowed to contact the backend while direct database access remains blocked. This limits lateral movement after compromise. Encryption protects confidentiality and identity for permitted connections but does not prevent unauthorized workloads from attempting to connect. Separate Deployments and DNS names provide logical organization rather than enforceable network isolation. Network segmentation should be combined with strong service authentication, separate credentials, workload identities, and runtime monitoring. A robust architecture assumes any workload may eventually be compromised and therefore limits what it can reach even from inside the cluster.

Question 358.

A sensitive pod should make outbound connections only to DNS and two approved external APIs. Which control BEST limits unauthorized egress?

1. A namespace-scoped Role
2. An egress NetworkPolicy or equivalent outbound filtering control
3. A read-only root filesystem
4. A PodDisruptionBudget

Correct Answer: 2. An egress NetworkPolicy or equivalent outbound filtering control

Explanation:

Egress filtering directly limits the destinations a workload can contact. If the pod needs only DNS and two approved APIs, unrestricted Internet access creates unnecessary risk of command-and-control communication, malware downloads, data exfiltration, or external scanning after compromise. Kubernetes NetworkPolicy can provide this capability when supported by the cluster networking implementation, while dynamic external endpoints may require egress gateways or firewalls. RBAC controls Kubernetes API permissions, read-only filesystems restrict local writes, and PodDisruptionBudgets support availability. These controls do not constrain outbound destinations. Egress restrictions should be paired with runtime network monitoring so blocked or unusual connection attempts are visible and can be investigated.

Question 359.

Which logging architecture BEST preserves investigation evidence if a compromised pod is deleted before responders can inspect it?

1. Forward application, Kubernetes audit, node, and runtime security logs to protected centralized storage
2. Keep logs only inside each container
3. Retain only Kubernetes Events
4. Disable long-term log retention to reduce sensitive-data exposure

Correct Answer: 1. Forward application, Kubernetes audit, node, and runtime security logs to protected centralized storage

Explanation:

Pods are ephemeral and may disappear through restarts, scaling, rescheduling, containment, or attacker activity. Local evidence can therefore be lost before an investigation begins. Centralized logging preserves telemetry outside the pod lifecycle and allows correlation across multiple layers. Kubernetes audit logs reveal API activity, runtime telemetry captures suspicious processes and network behavior, application logs provide workload context, and node logs may show host-level compromise. Kubernetes Events are valuable but usually insufficient for detailed forensics. Centralized storage should be protected with strong authorization, encryption, integrity safeguards, retention policies, and monitoring. Effective incident readiness depends on collecting important telemetry before a security event because evidence that was never retained cannot be recreated later.

Question 360.

Which approach BEST represents a mature Kubernetes security strategy across development, deployment, and runtime?

1. Focus primarily on perimeter controls and image scanning
2. Use RBAC and monitoring but give CI/CD broad permissions for efficiency
3. Enforce secure workload policies and assume admitted workloads remain safe afterward
4. Continuously combine identity security, least privilege, workload hardening, software supply chain controls, network segmentation, policy enforcement, vulnerability management, monitoring, centralized logging, and incident response

Correct Answer: 4. Continuously combine identity security, least privilege, workload hardening, software supply chain controls, network segmentation, policy enforcement, vulnerability management, monitoring, centralized logging, and incident response

Explanation:

Cloud-native security spans the complete lifecycle. Identity controls and RBAC protect the API and administrative plane. Workload hardening reduces privilege, writable attack surface, and unnecessary kernel access. Supply chain controls protect source repositories, dependencies, CI/CD systems, registries, signatures, provenance, and artifact promotion. Admission policies prevent known-insecure configurations, while NetworkPolicies reduce lateral movement and unnecessary egress. Continuous vulnerability management is required because new weaknesses emerge after deployment. Runtime monitoring, Kubernetes audit logs, and centralized telemetry detect activity that preventive controls miss. Tested incident-response procedures prepare teams to contain workloads, rotate credentials, preserve evidence, eradicate root causes, and recover safely. Sustainable security depends on continuously maintaining all of these layers.