View Full Linux Foundation KCSA Exam Dumps and Practice Test Dumps

 

Question 121.

An organization wants to reduce the risk that compromised credentials can be used to access multiple Kubernetes clusters. Which identity design BEST supports this goal?

1. Use centralized identity with separate, least-privilege authorization for each cluster
2. Share one cluster-admin credential across all environments
3. Store kubeconfig files in a public repository
4. Disable authentication on development clusters

Correct Answer: 1. Use centralized identity with separate, least-privilege authorization for each cluster

Explanation:

Centralized identity can simplify authentication while still allowing each Kubernetes cluster to enforce its own least-privilege authorization. This helps organizations avoid long-lived shared administrator credentials and improves accountability because actions can be tied to individual identities. Access should be scoped according to job responsibilities and environment sensitivity. Production permissions should usually be more restrictive than development permissions, and access should be reviewed regularly. Strong authentication, short-lived credentials where practical, RBAC, audit logging, and prompt revocation all strengthen the model. Sharing one administrative credential across many clusters creates a large blast radius because compromise of that single credential may expose every environment it can access.

Question 122.

A user needs temporary administrative access to troubleshoot a production Kubernetes issue. Which security approach is MOST appropriate?

1. Give the user permanent cluster-admin access
2. Grant time-limited, auditable privileged access only for the required task
3. Share another administrator’s kubeconfig
4. Disable audit logs during troubleshooting

Correct Answer: 2. Grant time-limited, auditable privileged access only for the required task

Explanation:

Temporary privileged access reduces the risk associated with standing administrative permissions. A mature access model grants elevated rights only when required, for a limited duration, and with appropriate approval and auditability. This supports least privilege while still allowing administrators to respond to operational incidents. The access should be revoked automatically or promptly after the task ends. Audit logs should remain enabled so sensitive actions can be reviewed later. Permanent cluster-admin access expands the blast radius of account compromise, while shared kubeconfig files weaken accountability and make revocation difficult. Privileged access should be treated as an exception that is monitored closely rather than a normal default state.

Question 123.

Which practice BEST improves accountability for sensitive Kubernetes administrative actions?

1. Use individual user identities instead of shared administrator accounts
2. Disable authentication
3. Use one service account for all administrators
4. Delete audit logs daily

Correct Answer: 1. Use individual user identities instead of shared administrator accounts

Explanation:

Individual identities allow actions to be attributed to specific people, which is essential for accountability, auditing, and incident investigation. Shared administrator credentials make it difficult to determine who performed a sensitive action and complicate access removal when staff responsibilities change. Individual identities should be combined with strong authentication, role-based permissions, temporary elevation where appropriate, and centralized audit logging. Sensitive administrative changes such as modifying RBAC, deleting namespaces, or creating privileged workloads should be monitored carefully. Accountability is not only useful after an incident; it also discourages unsafe behavior and supports compliance requirements. Deleting logs or sharing service account credentials would weaken rather than strengthen operational security.

Question 124.

A security engineer wants to restrict administrators from accessing Kubernetes Secrets unless their role specifically requires it. Which control should be used?

1. NetworkPolicy
2. Pod affinity
3. RBAC permissions that omit Secret access for users who do not need it
4. Horizontal Pod Autoscaling

Correct Answer: 3. RBAC permissions that omit Secret access for users who do not need it

Explanation:

Kubernetes RBAC can restrict access by resource type and action. Administrators who do not need to read Secrets should not receive verbs such as get, list, or watch on Secret resources. Secret access is highly sensitive because it may expose database credentials, API keys, tokens, certificates, or other authentication material. Permissions should also be reviewed for indirect access paths, such as the ability to create pods that mount Secrets. Least privilege means considering what a user can achieve through combinations of permissions rather than looking only at one resource. NetworkPolicy controls network traffic, while pod affinity and autoscaling relate to scheduling and workload capacity rather than API authorization.

Question 125.

Which security principle is MOST important when assigning RBAC permissions to a CI/CD deployment service account?

1. Least privilege
2. Maximum replication
3. High availability
4. Service discovery

Correct Answer: 1. Least privilege

Explanation:

A CI/CD deployment identity should receive only the permissions needed to deploy the intended resources into the intended environments. It should not automatically receive cluster-admin privileges or access to unrelated namespaces. Pipeline identities are attractive targets because compromise can allow an attacker to deploy malicious software through a trusted automation path. Organizations should therefore restrict RBAC permissions, protect pipeline credentials, separate build and deployment authority where practical, use short-lived credentials, and monitor deployment activity. Least privilege limits the damage an attacker can cause if the pipeline or its credentials are compromised. Scaling and availability concepts do not address authorization risk.

Question 126.

A company wants to prevent users from deploying containers with unrestricted host access. Which policy should be enforced?

1. Allow privileged mode for all workloads
2. Deny privileged containers and unnecessary host namespace access through admission policies
3. Disable image scanning
4. Grant all users cluster-admin

Correct Answer: 2. Deny privileged containers and unnecessary host namespace access through admission policies

Explanation:

Privileged containers and host namespace access can significantly weaken isolation between workloads and Kubernetes nodes. Admission policies can reject configurations that request privileged mode, hostPID, hostIPC, hostNetwork, or dangerous hostPath mounts unless an approved exception exists. Preventing insecure configurations before they run is stronger than relying only on runtime detection. System components with legitimate host access requirements should be narrowly scoped and reviewed carefully. Additional protections may include dedicated nodes, restricted capabilities, seccomp, mandatory access control, and enhanced monitoring. Disabling scanning or granting broad administrative access would increase the attack surface rather than reduce it.

Question 127.

Which workload security setting MOST directly prevents a container from running as the root user when the image is compatible with non-root execution?

1. runAsNonRoot: true
2. hostPID: true
3. hostNetwork: true
4. privileged: true

Correct Answer: 1. runAsNonRoot: true

Explanation:

The runAsNonRoot setting tells Kubernetes that the container should not run as UID 0. This reduces the privileges available to an attacker who gains control of the application process. The container image must be designed to support non-root execution, including suitable file ownership and permissions. Non-root execution should be combined with other controls such as dropping unnecessary Linux capabilities, disabling privilege escalation, applying seccomp profiles, and using a read-only root filesystem where practical. Running as non-root does not eliminate all container security risks, but it meaningfully reduces the potential impact of compromise. The other options listed increase access to host-level resources and therefore weaken isolation.

Question 128.

A container must write temporary files but does not need to modify the rest of its filesystem. Which design is MOST secure?

1. Make the entire root filesystem writable
2. Mount the host root filesystem
3. Use a read-only root filesystem with a dedicated writable temporary volume
4. Run the container in privileged mode

Correct Answer: 3. Use a read-only root filesystem with a dedicated writable temporary volume

Explanation:

A read-only root filesystem limits what an attacker or compromised process can modify inside the container. If the application requires writable storage for temporary data, that requirement can be satisfied with a narrowly scoped writable volume mounted only where needed. This design reduces the writable attack surface while preserving application functionality. The temporary storage should also be managed according to data sensitivity and lifecycle requirements. Running the entire container filesystem as writable provides more opportunities for tampering and persistence. Host filesystem mounts and privileged mode further weaken isolation. This approach illustrates least privilege applied to filesystem access: provide exactly the writable locations the application needs and nothing more.

Question 129.

Why should production containers generally avoid including SSH servers?

1. They add an unnecessary network service and attack surface in most container workflows
2. SSH prevents pods from starting
3. SSH disables Kubernetes RBAC
4. SSH automatically grants cluster-admin access

Correct Answer: 1. They add an unnecessary network service and attack surface in most container workflows

Explanation:

Containers are generally managed through orchestration and controlled debugging mechanisms rather than by running an SSH daemon inside each workload. Including SSH adds another network service, authentication mechanism, package set, and potential vulnerability surface that usually provides little operational value. Secure container images should include only the services and tools required by the application. Debugging and troubleshooting should use controlled platform mechanisms with appropriate auditing and permissions. Removing SSH does not eliminate all risk, but it follows the broader hardening principle of minimizing unnecessary software and exposed interfaces. Any service that listens for connections creates an additional attack path that must be maintained, patched, monitored, and secured.

Question 130.

A security team wants to stop compromised application pods from downloading arbitrary tools from the Internet. Which control can MOST directly help?

1. Additional ReplicaSets
2. Restrictive egress NetworkPolicies or equivalent network controls
3. More ConfigMaps
4. Larger nodes

Correct Answer: 2. Restrictive egress NetworkPolicies or equivalent network controls

Explanation:

Egress controls can restrict workloads to the external and internal destinations they actually require. If an application only needs to reach a specific database and approved API, allowing unrestricted Internet access creates unnecessary risk. A compromised pod could otherwise download malicious tools, communicate with command-and-control infrastructure, or exfiltrate data. NetworkPolicy support depends on the networking implementation, and additional controls may be needed for advanced egress filtering. DNS access and dynamic endpoints should also be considered carefully. Network restrictions work best alongside minimal images, runtime monitoring, workload identity, and application-level controls. Replica counts, ConfigMaps, and node size do not prevent malicious outbound network communication.

Question 131.

Which approach BEST protects sensitive traffic between microservices from passive network interception?

1. Encrypt service-to-service communication using TLS where appropriate
2. Increase replica counts
3. Add more namespaces
4. Disable authentication

Correct Answer: 1. Encrypt service-to-service communication using TLS where appropriate

Explanation:

TLS protects the confidentiality and integrity of data in transit between communicating services. It can also provide server authentication, and mutual TLS can authenticate both endpoints where the architecture requires it. Encryption is particularly important when traffic carries credentials, personal information, financial data, or other sensitive content. TLS should be implemented with sound certificate issuance, rotation, trust, and revocation practices. Encryption does not replace authorization or network segmentation because an authenticated and encrypted connection can still be inappropriate. Strong service-to-service security combines identity, access control, encryption, NetworkPolicies, application authorization, and monitoring. Scaling or namespace separation alone does not protect packet contents from interception.

Question 132.

Which security risk can occur if a container image is pulled from an untrusted public registry without verification?

1. The image may contain malicious or tampered software
2. Kubernetes cannot create Services
3. Pods automatically lose networking
4. Persistent volumes are deleted

Correct Answer: 1. The image may contain malicious or tampered software

Explanation:

Untrusted registries can host images containing malicious code, backdoors, vulnerable dependencies, or misleading tags. An attacker may intentionally publish an image with a name similar to a legitimate project or compromise an existing repository. Organizations should use trusted registries, restrict image sources, verify signatures or provenance, scan images for vulnerabilities, and prefer immutable references. CI/CD pipelines should control how production images are built and promoted. Image trust is a supply chain issue: even a securely configured Kubernetes cluster can be compromised if it executes malicious software supplied through an untrusted artifact source. Registry security therefore belongs alongside workload and cluster security in a defense-in-depth model.

Question 133.

Which artifact can help a security team map a newly disclosed vulnerability to specific container images?

1. Software Bill of Materials
2. Service selector
3. NetworkPolicy
4. Namespace label

Correct Answer: 1. Software Bill of Materials

Explanation:

An SBOM records the software components and dependencies associated with an artifact. When a vulnerability is announced in a particular library, security teams can query SBOM data to identify which applications or images contain that component. This can dramatically improve incident and vulnerability response compared with manually inspecting every image. SBOMs are most useful when they are complete, trustworthy, and associated with exact image versions or digests. They do not indicate automatically whether a vulnerability is exploitable in a specific application, so risk assessment and testing remain necessary. SBOM information complements vulnerability scanners, artifact provenance, dependency management, and secure build pipelines.

Question 134.

Which practice BEST protects a container registry from unauthorized modification of production images?

1. Allow anonymous push access
2. Require authenticated access and restrict push permissions to authorized identities
3. Share registry administrator credentials with all developers
4. Disable audit logging

Correct Answer: 2. Require authenticated access and restrict push permissions to authorized identities

Explanation:

Production registries should tightly control who can publish, overwrite, delete, or administer artifacts. Authentication establishes identity, while authorization limits the operations each user or automation identity may perform. Developers may require pull access but not necessarily direct push authority to production repositories. CI/CD pipelines can publish approved artifacts through dedicated credentials with limited scope. Registries should also support immutable tags or protected repositories where appropriate, scanning, image signing, audit logging, and secure retention policies. Anonymous push access would permit arbitrary artifact replacement, while shared administrator credentials make accountability and revocation difficult. Registry security is critical because trusted deployment systems may automatically execute artifacts stored there.

Question 135.

A build system produces a signed image, but the signing key is stored on a publicly accessible server. What is the primary security concern?

1. An attacker could sign malicious images that appear trusted
2. The image will run more slowly
3. The registry will lose DNS access
4. Kubernetes will disable RBAC

Correct Answer: 1. An attacker could sign malicious images that appear trusted

Explanation:

Digital signatures are meaningful only if the signing identity and private keys remain trustworthy. If an attacker steals a signing key, they may be able to produce malicious artifacts that pass signature verification and therefore appear legitimate to admission policies or operators. Signing keys should be protected with strong access controls, secure key-management systems, hardware-backed protection where appropriate, audit logging, rotation procedures, and limited use. Organizations should also have a plan to revoke or distrust compromised keys. Supply chain security depends on protecting the systems and credentials that establish artifact trust. Merely signing images is insufficient if the signing process itself can be compromised easily.

Question 136.

Which runtime security event should be considered suspicious for a container that normally only serves HTTP traffic?

1. A configured health probe request
2. An unexpected shell spawning a network scanner process
3. A normal application log message
4. A scheduled deployment rollout

Correct Answer: 2. An unexpected shell spawning a network scanner process

Explanation:

A production web container that normally serves HTTP traffic should not typically launch an interactive shell or network scanning utility. Such behavior can indicate exploitation, unauthorized debugging, lateral movement attempts, or malware execution. Runtime security tools can detect unexpected processes, command execution, file modifications, privilege changes, and network activity. Security teams should investigate the process ancestry, image digest, network destinations, Kubernetes audit activity, and recent deployment history. The event should be interpreted in context because legitimate maintenance can occasionally look unusual, but unexplained shell and scanning behavior is a strong anomaly. Health probes and planned rollouts, by contrast, are expected operational events when configured correctly.

Question 137.

A Kubernetes node begins making unexpected outbound connections after a privileged pod was deployed. Which incident-response step is MOST appropriate?

1. Investigate and contain the affected node and workload while preserving evidence
2. Grant the pod additional permissions
3. Delete all logs immediately
4. Increase the pod replica count

Correct Answer: 1. Investigate and contain the affected node and workload while preserving evidence

Explanation:

Unexpected node-level network activity after deployment of a privileged pod may indicate that the workload has affected the host. Incident responders should contain the suspected workload and node according to established procedures, preserve relevant logs and forensic evidence, and investigate the pod image, processes, network connections, credentials, and Kubernetes audit trail. Depending on the environment, containment may involve isolating or cordoning the node, restricting traffic, and removing it from production service. Deleting logs destroys evidence, while scaling the workload could expand the compromise. Privileged containers are particularly sensitive because they can access host-level capabilities that ordinary containers cannot, making careful investigation and remediation essential.

Question 138.

Why should Kubernetes audit logs be forwarded to a separate protected logging platform?

1. To reduce the likelihood that an attacker controlling cluster resources can erase important evidence
2. To disable RBAC
3. To increase pod scheduling speed
4. To automatically patch vulnerabilities

Correct Answer: 1. To reduce the likelihood that an attacker controlling cluster resources can erase important evidence

Explanation:

Audit logs are valuable during security investigations because they can record API activity such as resource creation, deletion, Secret access, and RBAC changes. If those logs remain only on systems controlled by an attacker, they may be modified or deleted. Forwarding them to a separately secured logging platform improves evidence preservation and allows centralized correlation with identity, network, application, and runtime security events. The logging platform should have its own access controls, retention policies, monitoring, and integrity safeguards. Centralized logs do not automatically prevent attacks or patch systems, but they provide essential visibility for detection, compliance, troubleshooting, and incident reconstruction.

Question 139.

Which strategy BEST limits the damage if an application Secret is stolen from one namespace?

1. Use separate credentials for unrelated applications and limit what each credential can access
2. Reuse the same database password in every namespace
3. Store all credentials in one shared Secret
4. Grant the stolen credential administrator access

Correct Answer: 1. Use separate credentials for unrelated applications and limit what each credential can access

Explanation:

Credential separation reduces the blast radius of compromise. If every application uses the same database password or API token, theft from one namespace can expose many unrelated systems. Separate credentials allow access to be revoked or rotated for one workload without disrupting others and support more precise authorization. Credentials should also be scoped to the minimum resources they require, stored securely, rotated regularly, and monitored for suspicious use. Kubernetes RBAC should restrict which users and service accounts can retrieve the Secret. NetworkPolicies can provide additional containment by limiting where a compromised workload can connect. Security architecture should assume that individual credentials may eventually be exposed and design access boundaries accordingly.

Question 140.

Which approach BEST represents defense in depth for securing Kubernetes workloads and the software supply chain?

1. Depend only on container image scanning
2. Use only perimeter firewalls
3. Combine protected source control, secure builds, trusted artifacts, admission policies, least privilege, network segmentation, runtime monitoring, logging, and incident response
4. Grant broad administrator access to simplify operations

Correct Answer: 3. Combine protected source control, secure builds, trusted artifacts, admission policies, least privilege, network segmentation, runtime monitoring, logging, and incident response

Explanation:

Defense in depth assumes that any single security layer may eventually fail. Source repositories need strong authentication and controlled changes. Build systems and CI/CD credentials must be protected. Container images should come from trusted registries, be scanned, signed, and traceable through provenance and SBOMs. Admission policies can block insecure workloads before execution. At runtime, hardened containers, least-privilege identities, NetworkPolicies, encryption, and monitoring reduce the impact of compromise. Audit and centralized logs provide investigation data, while tested incident-response procedures support containment and recovery. This layered model is significantly stronger than relying only on perimeter controls or image scanning because Kubernetes threats can originate from identities, workloads, dependencies, build systems, or runtime behavior.