{"id":21306,"date":"2026-09-24T12:02:44","date_gmt":"2026-09-24T12:02:44","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=21306"},"modified":"2026-09-24T12:02:44","modified_gmt":"2026-09-24T12:02:44","slug":"linux-foundation-kcsa-practice-test-questions-and-exam-dumps-part6-q101-120","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/linux-foundation-kcsa-practice-test-questions-and-exam-dumps-part6-q101-120\/","title":{"rendered":"Linux Foundation KCSA Practice Test Questions and Exam Dumps Part6 Q101-120"},"content":{"rendered":"

View Full <\/b>Linux Foundation KCSA Exam Dumps<\/b><\/a> and Practice Test Dumps<\/b><\/h2>\n

 <\/p>\n

Question 101.<\/b><\/p>\n

A security team wants to ensure that only authorized administrators can change Kubernetes RBAC policies in production. Which control is MOST appropriate?<\/b><\/p>\n

    \n
  1. <\/b> Restrict permissions to create or modify Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings<\/span><\/li>\n
  2. <\/b> Increase pod replicas<\/span><\/li>\n
  3. <\/b> Use a larger container image<\/span><\/li>\n
  4. <\/b> Disable API audit logging<\/span><\/li>\n<\/ol>\n

    Correct Answer: 1. Restrict permissions to create or modify Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings<\/b><\/p>\n

    Explanation:<\/b><\/p>\n

    RBAC configuration determines who can perform actions throughout a Kubernetes cluster, so the ability to change roles and bindings is itself highly sensitive. Only trusted administrative identities should be able to create or modify these resources, particularly ClusterRoleBindings that can grant cluster-wide privileges. Access should follow least privilege, and sensitive RBAC changes should be captured in audit logs and monitored for unexpected activity. Organizations can also use approval workflows or policy controls for high-risk changes. Increasing replicas or changing container image size does not protect authorization configuration. Disabling audit logging would make privilege changes harder to detect and investigate, reducing accountability rather than improving security.<\/span><\/p>\n

    Question 102.<\/b><\/p>\n

    A developer needs permission to view pods and logs in one namespace but must not be able to modify deployments. Which RBAC design BEST follows least privilege?<\/b><\/p>\n

      \n
    1. <\/b> Grant cluster-admin<\/span><\/li>\n
    2. <\/b> Create a namespaced Role with read permissions only for the required resources<\/span><\/li>\n
    3. <\/b> Use a ClusterRoleBinding to grant full write access<\/span><\/li>\n
    4. <\/b> Share an administrator kubeconfig<\/span><\/li>\n<\/ol>\n

      Correct Answer: 2. Create a namespaced Role with read permissions only for the required resources<\/b><\/p>\n

      Explanation:<\/b><\/p>\n

      A namespaced Role can grant only the exact verbs and resource types needed for the developer’s responsibilities. If the user only needs to view pods and retrieve logs, the Role can provide narrowly scoped read access without permitting updates to Deployments or other resources. A RoleBinding can then associate those permissions with the developer in the appropriate namespace. Granting cluster-admin or full write access would violate least privilege and significantly increase the impact of credential compromise. Shared administrator credentials also weaken accountability because actions cannot be reliably attributed to individual users. Fine-grained RBAC design should reflect job responsibilities and should be reviewed periodically as those responsibilities change.<\/span><\/p>\n

      Question 103.<\/b><\/p>\n

      Which Kubernetes RBAC resource grants permissions defined in a ClusterRole to a subject across the entire cluster?<\/b><\/p>\n

        \n
      1. <\/b> ConfigMap<\/span><\/li>\n
      2. <\/b> Role<\/span><\/li>\n
      3. <\/b> ClusterRoleBinding<\/span><\/li>\n
      4. <\/b> Service<\/span><\/li>\n<\/ol>\n

        Correct Answer: 3. ClusterRoleBinding<\/b><\/p>\n

        Explanation:<\/b><\/p>\n

        A ClusterRoleBinding associates a ClusterRole with one or more users, groups, or service accounts at cluster scope. Because it can grant broad permissions across namespaces and cluster-scoped resources, it should be used carefully. A RoleBinding can also reference a ClusterRole, but the resulting permissions apply only within the RoleBinding’s namespace. ClusterRoleBindings should be monitored closely because an attacker who can create or modify one may be able to grant powerful privileges. Organizations should restrict this capability to trusted administrators, review bindings regularly, and alert on unexpected changes to highly privileged roles such as cluster-admin. ConfigMaps and Services do not participate in RBAC authorization.<\/span><\/p>\n

        Question 104.<\/b><\/p>\n

        A security administrator notices that an application service account has permission to create pods in its namespace even though the application only needs to read ConfigMaps. What should be done?<\/b><\/p>\n

          \n
        1. <\/b> Add more permissions for consistency<\/span><\/li>\n
        2. <\/b> Move the application to a larger node<\/span><\/li>\n
        3. <\/b> Keep the permissions because they are namespace-scoped<\/span><\/li>\n
        4. <\/b> Remove unnecessary pod-creation permission and retain only required access<\/span><\/li>\n<\/ol>\n

          Correct Answer: 4. Remove unnecessary pod-creation permission and retain only required access<\/b><\/p>\n

          Explanation:<\/b><\/p>\n

          Namespace-scoped permissions can still be dangerous if they are broader than necessary. Permission to create pods may allow a compromised service account to launch workloads that mount accessible Secrets, use different security settings, or interact with namespace resources in unintended ways. If the application only needs to read ConfigMaps, its RBAC permissions should be limited accordingly. Least privilege is not simply about avoiding cluster-wide permissions; it also means reducing unnecessary capabilities within a namespace. Administrators should routinely review service account roles, remove obsolete permissions, and consider indirect privilege paths created by combinations of permissions. Leaving excessive access in place increases the blast radius of a workload compromise.<\/span><\/p>\n

          Question 105.<\/b><\/p>\n

          Which practice BEST reduces the risk that a compromised application can impersonate unrelated workloads in the cluster?<\/b><\/p>\n

            \n
          1. <\/b> Use separate service accounts for applications with different security requirements<\/span><\/li>\n
          2. <\/b> Use one default service account for every workload<\/span><\/li>\n
          3. <\/b> Give all service accounts identical permissions<\/span><\/li>\n
          4. <\/b> Share service account tokens across namespaces<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1. Use separate service accounts for applications with different security requirements<\/b><\/p>\n

            Explanation:<\/b><\/p>\n

            Dedicated service accounts create clearer workload identities and allow RBAC permissions to be tailored to each application. If unrelated workloads share the same service account, compromise of one workload may provide access intended for another. Separate identities make it easier to enforce least privilege, audit activity, and revoke access without affecting unrelated applications. Service account tokens should not be copied or shared unnecessarily, especially across namespaces. Administrators should also disable automatic token mounting for workloads that do not require Kubernetes API access. A strong workload identity model limits the blast radius of credential theft and supports more precise authorization, monitoring, and incident response across cloud-native environments.<\/span><\/p>\n

            Question 106.<\/b><\/p>\n

            A Kubernetes workload has no need to communicate with the Kubernetes API. Which configuration can reduce credential exposure?<\/b><\/p>\n

              \n
            1. <\/b> Enable host networking<\/span><\/li>\n
            2. <\/b> Disable automatic mounting of the service account token<\/span><\/li>\n
            3. <\/b> Mount the node filesystem<\/span><\/li>\n
            4. <\/b> Run the container as privileged<\/span><\/li>\n<\/ol>\n

              Correct Answer: 2. Disable automatic mounting of the service account token<\/b><\/p>\n

              Explanation:<\/b><\/p>\n

              If an application does not need Kubernetes API access, mounting a service account token provides no operational benefit and creates an unnecessary credential that could be stolen after compromise. Disabling automatic token mounting removes that exposure. Workloads that need API access should use dedicated service accounts with narrowly scoped RBAC permissions rather than broad shared identities. This practice supports least privilege and reduces the number of credentials present inside containers. Host networking, privileged execution, and host filesystem mounts all increase the workload’s access to sensitive resources and would make a compromise more dangerous. Credential minimization is an important component of container and Kubernetes workload hardening.<\/span><\/p>\n

              Question 107.<\/b><\/p>\n

              Which statement BEST describes the security value of short-lived workload credentials?<\/b><\/p>\n

                \n
              1. <\/b> They increase the number of administrator accounts<\/span><\/li>\n
              2. <\/b> They remove the need for authorization<\/span><\/li>\n
              3. <\/b> They reduce the time window in which stolen credentials may remain useful<\/span><\/li>\n
              4. <\/b> They automatically encrypt all cluster traffic<\/span><\/li>\n<\/ol>\n

                Correct Answer: 3. They reduce the time window in which stolen credentials may remain useful<\/b><\/p>\n

                Explanation:<\/b><\/p>\n

                Long-lived credentials can remain usable for extended periods after theft, giving an attacker more time to exploit them. Short-lived credentials reduce this exposure window because they expire and must be refreshed through an authorized identity mechanism. They do not eliminate the need for least-privilege authorization or strong authentication, but they improve credential lifecycle security. Workload and administrative identities should also be monitored for unusual activity, and credentials should be revocable when compromise is suspected. Organizations should avoid embedding long-lived tokens in container images, source repositories, or deployment manifests. Shorter credential lifetimes work best as part of a broader identity strategy that includes controlled issuance, rotation, RBAC, and auditability.<\/span><\/p>\n

                Question 108.<\/b><\/p>\n

                A security team wants to restrict which container images can be deployed based on trusted signatures. Which Kubernetes security stage is BEST suited for this enforcement?<\/b><\/p>\n

                  \n
                1. <\/b> DNS resolution<\/span><\/li>\n
                2. <\/b> Runtime autoscaling<\/span><\/li>\n
                3. <\/b> Storage provisioning<\/span><\/li>\n
                4. <\/b> Admission control**<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 4. Admission control<\/b><\/p>\n

                  Explanation:<\/b><\/p>\n

                  Admission is an ideal enforcement point for image trust policies because Kubernetes can inspect the workload request before it is persisted and scheduled. An admission policy can require images to come from approved registries, verify digital signatures or provenance, and reject workloads that do not satisfy organizational supply chain requirements. This provides a preventive layer between the CI\/CD system and runtime. Runtime monitoring remains useful for detecting malicious behavior after deployment, but it is preferable to block untrusted artifacts before execution. Image trust policies should be combined with protected build pipelines, trusted registries, immutable references, vulnerability scanning, and strong access controls around signing keys and release processes.<\/span><\/p>\n

                  Question 109.<\/b><\/p>\n

                  What is the primary benefit of verifying container image signatures before deployment?<\/b><\/p>\n

                    \n
                  1. <\/b> It helps establish that the image came from a trusted source and was not altered unexpectedly<\/span><\/li>\n
                  2. <\/b> It guarantees that the application contains no vulnerabilities<\/span><\/li>\n
                  3. <\/b> It automatically creates NetworkPolicies<\/span><\/li>\n
                  4. <\/b> It increases application availability<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1. It helps establish that the image came from a trusted source and was not altered unexpectedly<\/b><\/p>\n

                    Explanation:<\/b><\/p>\n

                    A valid digital signature can provide evidence of artifact authenticity and integrity. If an organization trusts a particular signing identity, signature verification can help confirm that an image came from an approved build or release process and was not modified after signing. This is valuable in defending against supply chain attacks in which unauthorized or tampered images are introduced into a registry. A signature does not prove that the image is vulnerability-free or that the application itself is secure, so image scanning, dependency management, provenance, secure builds, and runtime protections remain necessary. Signature verification is one important layer in a broader software supply chain security strategy.<\/span><\/p>\n

                    Question 110.<\/b><\/p>\n

                    A company wants to know exactly which container image is running in production even if an image tag is later changed. Which deployment practice should it use?<\/b><\/p>\n

                      \n
                    1. <\/b> Use the <\/span>latest<\/span> tag<\/span><\/li>\n
                    2. <\/b> Reference the image by immutable digest<\/span><\/li>\n
                    3. <\/b> Disable registry logging<\/span><\/li>\n
                    4. <\/b> Rebuild images directly on production nodes<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 2. Reference the image by immutable digest<\/b><\/p>\n

                      Explanation:<\/b><\/p>\n

                      An image digest identifies a specific artifact based on its content, making the reference effectively immutable. Tags can be reassigned to different images, which can create ambiguity about what actually ran at a particular point in time. Digest-based deployment improves reproducibility, auditing, rollback confidence, and forensic investigation. It also makes it easier to connect a running workload to vulnerability scan results, signatures, provenance, and SBOM data for the exact artifact. Digests do not establish trust by themselves, so they should be used alongside signed images, approved registries, secure CI\/CD pipelines, and admission controls. Building images directly on production nodes would weaken supply chain traceability and control.<\/span><\/p>\n

                      Question 111.<\/b><\/p>\n

                      Which artifact provides an inventory of libraries, packages, and other software components included in an application or container image?<\/b><\/p>\n

                        \n
                      1. <\/b> Software Bill of Materials<\/span><\/li>\n
                      2. <\/b> ServiceAccount<\/span><\/li>\n
                      3. <\/b> Ingress<\/span><\/li>\n
                      4. <\/b> ReplicaSet<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1. Software Bill of Materials<\/b><\/p>\n

                        Explanation:<\/b><\/p>\n

                        A Software Bill of Materials, or SBOM, lists software components and dependencies associated with an artifact. This information can help security teams determine whether applications are affected when a new vulnerability is disclosed in a commonly used library. An SBOM also improves supply chain transparency and can support compliance and incident response. Its usefulness depends on accuracy, completeness, and reliable association with the exact deployed artifact. SBOMs do not automatically detect vulnerabilities or patch software, so they should be combined with vulnerability scanners, dependency management, artifact provenance, and secure build processes. ServiceAccounts, Ingress resources, and ReplicaSets serve Kubernetes identity, networking, and workload-management purposes rather than software composition tracking.<\/span><\/p>\n

                        Question 112.<\/b><\/p>\n

                        A newly published vulnerability affects a library used by several production services. What should the security team do FIRST?<\/b><\/p>\n

                          \n
                        1. <\/b> Assume containers are unaffected<\/span><\/li>\n
                        2. <\/b> Use inventory and SBOM data to identify potentially affected workloads and assess exposure<\/span><\/li>\n
                        3. <\/b> Disable all logging<\/span><\/li>\n
                        4. <\/b> Increase replica counts<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 2. Use inventory and SBOM data to identify potentially affected workloads and assess exposure<\/b><\/p>\n

                          Explanation:<\/b><\/p>\n

                          The first challenge in responding to a new vulnerability is determining where the affected component is present. Accurate asset inventories and SBOM data can quickly identify applications and images containing the vulnerable library. The team should then evaluate whether the vulnerable code path is reachable, how exposed the service is, and what business impact exploitation could have. Remediation may include updating dependencies, rebuilding images, applying temporary mitigations, or restricting access while patches are prepared. Containers do not inherently neutralize vulnerable software. Increasing replicas may actually increase exposure, while disabling logs removes useful evidence. Effective vulnerability management combines inventory, risk assessment, remediation, validation, and ongoing monitoring.<\/span><\/p>\n

                          Question 113.<\/b><\/p>\n

                          Which practice BEST reduces the attack surface of a production container image?<\/b><\/p>\n

                            \n
                          1. <\/b> Include compilers and debugging utilities for convenience<\/span><\/li>\n
                          2. <\/b> Install every optional package<\/span><\/li>\n
                          3. <\/b> Use a minimal runtime image containing only required components<\/span><\/li>\n
                          4. <\/b> Run the container with host filesystem access<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 3. Use a minimal runtime image containing only required components<\/b><\/p>\n

                            Explanation:<\/b><\/p>\n

                            A minimal runtime image contains fewer packages, binaries, libraries, and utilities that could contain vulnerabilities or be abused by an attacker. Build-time tools such as compilers and package managers should generally be excluded from the final production image when they are not needed at runtime. Multi-stage builds are a common method for separating build dependencies from runtime components. Minimal images are not automatically secure, because the remaining application and libraries may still have vulnerabilities. They should therefore be scanned, patched, signed, and deployed through controlled pipelines. Runtime hardening such as non-root execution, reduced capabilities, and read-only filesystems further limits what a compromised process can do.<\/span><\/p>\n

                            Question 114.<\/b><\/p>\n

                            Which Dockerfile or container-build technique can keep compilers and package managers out of the final production image?<\/b><\/p>\n

                              \n
                            1. <\/b> Privileged execution<\/span><\/li>\n
                            2. <\/b> Multi-stage builds<\/span><\/li>\n
                            3. <\/b> Host networking<\/span><\/li>\n
                            4. <\/b> HostPath mounts<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 2. Multi-stage builds<\/b><\/p>\n

                              Explanation:<\/b><\/p>\n

                              Multi-stage builds allow one stage to contain compilers, source code, package managers, and other build dependencies while a later stage contains only the application artifacts and runtime dependencies required in production. This reduces image size and attack surface. It also limits the number of tools available to an attacker who compromises the running container. Build pipelines should still pin dependencies where appropriate, verify trusted sources, scan the final image, and generate provenance or SBOM information. Multi-stage builds do not replace runtime security, but they are an effective supply chain and image-hardening practice. Privileged mode, host networking, and hostPath mounts expose additional host resources and therefore increase rather than reduce security risk.<\/span><\/p>\n

                              Question 115.<\/b><\/p>\n

                              A runtime security tool detects an unexpected package manager being launched inside an immutable production container. How should this event be treated?<\/b><\/p>\n

                                \n
                              1. <\/b> As a potential anomaly that requires investigation<\/span><\/li>\n
                              2. <\/b> As proof that Kubernetes autoscaling is working<\/span><\/li>\n
                              3. <\/b> As a normal DNS event<\/span><\/li>\n
                              4. <\/b> As a storage expansion request<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1. As a potential anomaly that requires investigation<\/b><\/p>\n

                                Explanation:<\/b><\/p>\n

                                An unexpected package manager running inside a production container may indicate exploitation, unauthorized administration, or an attempt to download additional tools after compromise. In an environment where container images are intended to be immutable, such behavior should be unusual and therefore worthy of investigation. Security teams should examine the process tree, image identity, recent deployments, network activity, Kubernetes audit records, and associated credentials. The event may ultimately have a legitimate explanation, but it should not be dismissed automatically. Runtime monitoring is valuable precisely because it can detect suspicious behavior that was not present in the image when it was scanned or admitted to the cluster.<\/span><\/p>\n

                                Question 116.<\/b><\/p>\n

                                Which practice BEST helps ensure that important Kubernetes security evidence remains available even if an attacker deletes or replaces a pod?<\/b><\/p>\n

                                  \n
                                1. <\/b> Store all logs only inside the pod<\/span><\/li>\n
                                2. <\/b> Forward audit, application, and security logs to protected centralized storage<\/span><\/li>\n
                                3. <\/b> Disable event collection<\/span><\/li>\n
                                4. <\/b> Restart nodes frequently without retaining logs<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 2. Forward audit, application, and security logs to protected centralized storage<\/b><\/p>\n

                                  Explanation:<\/b><\/p>\n

                                  Pods are ephemeral and can be deleted, restarted, or rescheduled at any time. If logs exist only inside the workload, important evidence may disappear before investigators can collect it. Centralized logging preserves telemetry outside the individual pod and allows security teams to correlate events across applications, nodes, the Kubernetes API, and runtime detection systems. Central log platforms should themselves be protected with strong access controls, appropriate retention, integrity safeguards, and monitoring because they may contain sensitive information. Organizations should define which logs are necessary for detection and investigation without collecting excessive sensitive data. Centralized logging supports incident response but does not replace preventive controls such as RBAC, admission policies, network segmentation, and container hardening.<\/span><\/p>\n

                                  Question 117.<\/b><\/p>\n

                                  Which Kubernetes data source is MOST useful for determining who deleted a Deployment through the API server?<\/b><\/p>\n

                                    \n
                                  1. <\/b> Kubernetes audit logs<\/span><\/li>\n
                                  2. <\/b> Container image manifest only<\/span><\/li>\n
                                  3. <\/b> DNS cache<\/span><\/li>\n
                                  4. <\/b> PersistentVolume metadata<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1. Kubernetes audit logs<\/b><\/p>\n

                                    Explanation:<\/b><\/p>\n

                                    Kubernetes audit logs can record API requests, including the authenticated identity, requested operation, target resource, timestamp, and result. If a Deployment is deleted through the API server, properly configured audit logging can help determine who performed the action and from where. This information is valuable for operational troubleshooting, compliance, and security investigations. Audit policies should be designed to capture important events without creating excessive volume or exposing sensitive content unnecessarily. Logs should be forwarded to protected storage so they remain available even if an attacker gains control over cluster resources. DNS information and image manifests do not provide the identity and API-action history required to investigate administrative deletion events.<\/span><\/p>\n

                                    Question 118.<\/b><\/p>\n

                                    A security team discovers a pod making repeated outbound connections to an unfamiliar Internet address. Which control would BEST help contain this behavior while the incident is investigated?<\/b><\/p>\n

                                      \n
                                    1. <\/b> Increase the pod’s CPU limit<\/span><\/li>\n
                                    2. <\/b> Apply restrictive egress controls or isolate the workload<\/span><\/li>\n
                                    3. <\/b> Grant the pod additional RBAC permissions<\/span><\/li>\n
                                    4. <\/b> Add more replicas<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 2. Apply restrictive egress controls or isolate the workload<\/b><\/p>\n

                                      Explanation:<\/b><\/p>\n

                                      Unexpected outbound connections may indicate command-and-control communication, data exfiltration, or unauthorized software behavior. Containment should reduce the workload’s ability to communicate with potentially malicious destinations while preserving evidence for investigation. Depending on the environment, this may involve restrictive NetworkPolicies, workload isolation, traffic blocking at another network layer, or removal from service. The team should also examine runtime telemetry, process activity, image provenance, recent changes, credentials, and audit logs. Increasing CPU or replica counts could worsen the situation by giving malicious code more resources or additional instances. Granting additional permissions would increase the blast radius. Incident response procedures should define containment actions in advance.<\/span><\/p>\n

                                      Question 119.<\/b><\/p>\n

                                      Which strategy BEST reduces lateral movement between application tiers such as front end, API, and database?<\/b><\/p>\n

                                        \n
                                      1. <\/b> Permit only required communication paths using NetworkPolicies and strong application authentication<\/span><\/li>\n
                                      2. <\/b> Allow every pod to communicate with every other pod<\/span><\/li>\n
                                      3. <\/b> Use a shared cluster-admin service account<\/span><\/li>\n
                                      4. <\/b> Store all credentials in one shared Secret<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 1. Permit only required communication paths using NetworkPolicies and strong application authentication<\/b><\/p>\n

                                        Explanation:<\/b><\/p>\n

                                        A tiered application typically requires only specific communication paths. For example, a front end may need access to an API but not direct access to a database. NetworkPolicies can enforce these expected flows and reduce the attacker’s ability to move laterally after compromising one component. Application-level authentication and authorization remain important because network location alone should not establish trust. Dedicated service accounts, separate Secrets, and least-privilege RBAC provide additional containment. A default-deny strategy can be useful when implemented carefully. Allowing unrestricted communication or sharing powerful identities and credentials creates unnecessary trust relationships and dramatically increases the potential impact of a single compromised workload.<\/span><\/p>\n

                                        Question 120.<\/b><\/p>\n

                                        Which approach BEST reflects continuous Kubernetes security management in a production environment?<\/b><\/p>\n

                                          \n
                                        1. <\/b> Harden the cluster once and make no further security changes<\/span><\/li>\n
                                        2. <\/b> Review only perimeter firewall rules<\/span><\/li>\n
                                        3. <\/b> Continuously manage vulnerabilities, identities, RBAC, policies, software supply chain controls, runtime behavior, logging, and incident readiness<\/span><\/li>\n
                                        4. <\/b> Depend entirely on container isolation<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 3. Continuously manage vulnerabilities, identities, RBAC, policies, software supply chain controls, runtime behavior, logging, and incident readiness<\/b><\/p>\n

                                          Explanation:<\/b><\/p>\n

                                          Production Kubernetes environments change constantly. New applications are deployed, dependencies are updated, users change responsibilities, vulnerabilities are disclosed, and attackers develop new techniques. Security therefore requires continuous management rather than a one-time hardening exercise. Organizations should regularly review access and RBAC, rotate or remove credentials, scan and rebuild vulnerable images, validate admission and network policies, verify artifact provenance, monitor runtime behavior, analyze audit logs, and test incident-response procedures. Configuration drift should also be identified so security protections do not weaken over time. Container isolation and perimeter controls remain useful layers, but neither can address every threat. A mature security program combines preventive, detective, and responsive controls across the full cloud-native lifecycle.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Linux Foundation KCSA Exam Dumps and Practice Test Dumps   Question 101. A security team wants to ensure that only authorized administrators can change Kubernetes RBAC policies in production. Which control is MOST appropriate? Restrict permissions to create or modify Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings Increase pod replicas Use a larger container image […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/21306"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=21306"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/21306\/revisions"}],"predecessor-version":[{"id":21307,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/21306\/revisions\/21307"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=21306"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=21306"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=21306"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}