{"id":21314,"date":"2026-09-24T12:03:53","date_gmt":"2026-09-24T12:03:53","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=21314"},"modified":"2026-09-24T12:03:53","modified_gmt":"2026-09-24T12:03:53","slug":"linux-foundation-kcsa-practice-test-questions-and-exam-dumps-part10-q181-200","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/linux-foundation-kcsa-practice-test-questions-and-exam-dumps-part10-q181-200\/","title":{"rendered":"Linux Foundation KCSA Practice Test Questions and Exam Dumps Part10 Q181-200"},"content":{"rendered":"

View Full <\/b>Linux Foundation KCSA Exam Dumps<\/b><\/a> and Practice Test Dumps<\/b><\/h2>\n

 <\/p>\n

Question 181.<\/b><\/p>\n

A security team wants to reduce the impact if a Kubernetes service account token is stolen from a compromised pod. Which control provides the BEST protection?<\/b><\/p>\n

    \n
  1. <\/b> Assign the service account only the minimum RBAC permissions required by the workload<\/span><\/li>\n
  2. <\/b> Place the pod in a namespace with a high ResourceQuota<\/span><\/li>\n
  3. <\/b> Configure the pod with multiple readiness probes<\/span><\/li>\n
  4. <\/b> Use a ClusterIP Service rather than a NodePort Service<\/span><\/li>\n<\/ol>\n

    Correct Answer: 1. Assign the service account only the minimum RBAC permissions required by the workload<\/b><\/p>\n

    Explanation:<\/b><\/p>\n

    A stolen service account token can be used only within the permissions granted to that service account, so least-privilege RBAC directly limits the potential blast radius. A workload that only needs to read one ConfigMap should not be able to create pods, read Secrets, modify Deployments, or administer cluster-wide resources. Dedicated service accounts are preferable to broad shared identities, and automatic token mounting should be disabled when a workload does not need Kubernetes API access. Short-lived projected credentials and audit monitoring can provide additional protection. Resource quotas control consumption, readiness probes assess workload health, and Service types affect network exposure. None of those measures directly limit what an attacker can do with a stolen Kubernetes API credential.<\/span><\/p>\n

    Question 182.<\/b><\/p>\n

    An application needs Kubernetes API access only within its own namespace. Which authorization design BEST follows least privilege?<\/b><\/p>\n

      \n
    1. <\/b> Use a ClusterRoleBinding granting read access across all namespaces<\/span><\/li>\n
    2. <\/b> Grant the application temporary cluster-admin access during startup<\/span><\/li>\n
    3. <\/b> Use a namespace-scoped Role and RoleBinding containing only the required permissions<\/span><\/li>\n
    4. <\/b> Share the namespace administrator’s kubeconfig with the application<\/span><\/li>\n<\/ol>\n

      Correct Answer: 3. Use a namespace-scoped Role and RoleBinding containing only the required permissions<\/b><\/p>\n

      Explanation:<\/b><\/p>\n

      A Role defines permissions within a namespace, and a RoleBinding grants those permissions to a user, group, or service account in that namespace. This makes the combination well suited to an application that needs limited Kubernetes API access only within its own namespace. A ClusterRoleBinding could unnecessarily extend access across the cluster, depending on the referenced permissions, while cluster-admin is far broader than required. Sharing a human administrator’s kubeconfig also weakens identity separation, credential lifecycle management, and auditability. Kubernetes authorization should reflect the workload’s actual responsibilities as precisely as possible. Narrow permissions reduce the impact of compromise and make the security model easier to review, understand, and maintain.<\/span><\/p>\n

      Question 183.<\/b><\/p>\n

      A security administrator wants to prevent ordinary application teams from creating ClusterRoleBindings that grant administrative privileges. Which control is MOST appropriate?<\/b><\/p>\n

        \n
      1. <\/b> Require all applications to use read-only root filesystems<\/span><\/li>\n
      2. <\/b> Restrict RBAC permissions to create or modify ClusterRoleBindings to trusted administrators<\/span><\/li>\n
      3. <\/b> Configure default-deny egress NetworkPolicies<\/span><\/li>\n
      4. <\/b> Use immutable image tags in the container registry<\/span><\/li>\n<\/ol>\n

        Correct Answer: 2. Restrict RBAC permissions to create or modify ClusterRoleBindings to trusted administrators<\/b><\/p>\n

        Explanation:<\/b><\/p>\n

        ClusterRoleBindings can grant permissions across the cluster and may provide a direct path to privilege escalation when associated with powerful ClusterRoles such as cluster-admin. The ability to create or modify these bindings should therefore be restricted to a very small set of trusted administrative identities. Kubernetes audit logs should also be monitored for attempts to create privileged bindings or unexpected changes to authorization resources. Read-only filesystems, egress controls, and immutable image references are valuable security measures, but they solve different problems involving workload hardening, network containment, and software supply chain integrity. Preventing unauthorized RBAC modification is fundamentally an authorization problem and should be addressed through carefully scoped administrative permissions and monitoring.<\/span><\/p>\n

        Question 184.<\/b><\/p>\n

        Which configuration MOST directly reduces the risk of a compromised application container modifying binaries and configuration files in its image filesystem?<\/b><\/p>\n

          \n
        1. <\/b> Increase the pod’s memory limit<\/span><\/li>\n
        2. <\/b> Use a dedicated ServiceAccount<\/span><\/li>\n
        3. <\/b> Enable topology spread constraints<\/span><\/li>\n
        4. <\/b> Configure <\/span>readOnlyRootFilesystem: true<\/span> and provide narrowly scoped writable volumes where needed<\/span><\/li>\n<\/ol>\n

          Correct Answer: 4. Configure <\/b>readOnlyRootFilesystem: true<\/b> and provide narrowly scoped writable volumes where needed<\/b><\/p>\n

          Explanation:<\/b><\/p>\n

          A read-only root filesystem prevents a process from modifying files that are part of the container image, reducing opportunities for persistence, executable replacement, and unauthorized configuration changes after compromise. Applications that legitimately require writable locations can use narrowly scoped volumes for temporary files, caches, or application data. This applies least privilege to filesystem access by making only necessary paths writable. The control should be combined with non-root execution, reduced Linux capabilities, seccomp, and prevention of privilege escalation. Memory limits and topology constraints address resource usage and scheduling rather than filesystem integrity. A dedicated ServiceAccount improves identity isolation but does not prevent an attacker with code execution from modifying writable files inside the container.<\/span><\/p>\n

          Question 185.<\/b><\/p>\n

          A containerized web application does not need any special Linux privileges. Which capability configuration BEST follows secure container hardening practices?<\/b><\/p>\n

            \n
          1. <\/b> Drop unnecessary capabilities, ideally starting with <\/span>ALL<\/span> and adding back only those proven necessary<\/span><\/li>\n
          2. <\/b> Add <\/span>SYS_ADMIN<\/span> because it provides broad compatibility<\/span><\/li>\n
          3. <\/b> Run the container in privileged mode but use a NetworkPolicy<\/span><\/li>\n
          4. <\/b> Enable hostPID while keeping the application non-root<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1. Drop unnecessary capabilities, ideally starting with <\/b>ALL<\/b> and adding back only those proven necessary<\/b><\/p>\n

            Explanation:<\/b><\/p>\n

            Linux capabilities divide traditional root privileges into smaller units, but several capabilities remain extremely powerful. If an application does not require special kernel privileges, the safest approach is to remove unnecessary capabilities and explicitly add back only those that are functionally required. This reduces the range of actions available to an attacker who compromises the application. Capabilities should be considered alongside non-root execution, <\/span>allowPrivilegeEscalation: false<\/span>, seccomp, mandatory access control, and read-only filesystems. <\/span>SYS_ADMIN<\/span> is especially broad and is sometimes described as nearly equivalent to root for many operations. Privileged mode weakens numerous container boundaries, and hostPID exposes the host process namespace. Neither should be enabled merely for convenience.<\/span><\/p>\n

            Question 186.<\/b><\/p>\n

            A platform team wants to prevent an application process from acquiring additional privileges through setuid binaries or similar mechanisms. Which pod security setting should it use?<\/b><\/p>\n

              \n
            1. <\/b> hostIPC: false<\/span><\/li>\n
            2. <\/b> readOnlyRootFilesystem: true<\/span><\/li>\n
            3. <\/b> allowPrivilegeEscalation: false<\/span><\/li>\n
            4. <\/b> automountServiceAccountToken: false<\/span><\/li>\n<\/ol>\n

              Correct Answer: 3. <\/b>allowPrivilegeEscalation: false<\/b><\/p>\n

              Explanation:<\/b><\/p>\n

              allowPrivilegeEscalation: false<\/span> is intended to prevent a container process from gaining more privileges than its parent process. This is particularly relevant to mechanisms such as setuid binaries and file capabilities that might otherwise allow privilege increases. The setting is best used alongside non-root execution and capability reduction rather than as a standalone control. A read-only filesystem can prevent some modification or persistence activity, but it does not specifically prohibit privilege escalation. Disabling service account token mounting protects Kubernetes API credentials, while hostIPC controls access to the host’s inter-process communication namespace. These are useful hardening measures, but they address different attack paths. Container security is strongest when multiple complementary restrictions are enforced together.<\/span><\/p>\n

              Question 187.<\/b><\/p>\n

              Which Linux security control allows Kubernetes workloads to restrict the set of system calls available to container processes?<\/b><\/p>\n

                \n
              1. <\/b> AppArmor profiles<\/span><\/li>\n
              2. <\/b> seccomp profiles<\/span><\/li>\n
              3. <\/b> NetworkPolicies<\/span><\/li>\n
              4. <\/b> RoleBindings<\/span><\/li>\n<\/ol>\n

                Correct Answer: 2. seccomp profiles<\/b><\/p>\n

                Explanation:<\/b><\/p>\n

                seccomp filters Linux system calls and can prevent containerized applications from invoking kernel operations they do not legitimately require. Because many exploits rely on particular system calls, reducing the available syscall surface can make certain attacks more difficult or impossible. Kubernetes workloads can use built-in or custom seccomp profiles depending on the environment and requirements. AppArmor is also a useful Linux security mechanism, but it primarily applies mandatory access control policies around resources such as files and process behavior rather than functioning as a syscall filter. NetworkPolicies govern network communication, while RoleBindings grant Kubernetes API permissions. seccomp is therefore the most direct answer when the goal is specifically to restrict system calls at runtime.<\/span><\/p>\n

                Question 188.<\/b><\/p>\n

                A company wants to apply mandatory access control rules that limit which files a containerized application can access on supported Linux nodes. Which technology is MOST appropriate?<\/b><\/p>\n

                  \n
                1. <\/b> Horizontal Pod Autoscaler<\/span><\/li>\n
                2. <\/b> NetworkPolicy<\/span><\/li>\n
                3. <\/b> Role-Based Access Control<\/span><\/li>\n
                4. <\/b> AppArmor or SELinux**<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 4. AppArmor or SELinux<\/b><\/p>\n

                  Explanation:<\/b><\/p>\n

                  AppArmor and SELinux provide mandatory access control at the operating system level. They can restrict how processes interact with files, devices, and other system resources even when ordinary Unix permissions might otherwise permit access. In a containerized environment, these controls provide an additional layer of containment if an application is compromised. Policies should be carefully tested because overly restrictive rules can interfere with legitimate behavior. They complement seccomp, non-root execution, capability reduction, and Kubernetes admission policies. NetworkPolicy governs network paths, Kubernetes RBAC controls access to API resources, and autoscaling adjusts workload capacity. None of those controls provides the same host-level file access restrictions as mandatory access control mechanisms.<\/span><\/p>\n

                  Question 189.<\/b><\/p>\n

                  A production container image includes compilers, package managers, and troubleshooting utilities used only during the build stage. Which improvement BEST reduces its runtime attack surface?<\/b><\/p>\n

                    \n
                  1. <\/b> Use a multi-stage build so only required runtime files are copied into the final image<\/span><\/li>\n
                  2. <\/b> Keep the tools but remove execute permission from <\/span>\/bin\/sh<\/span><\/li>\n
                  3. <\/b> Mount the build directory as a persistent volume<\/span><\/li>\n
                  4. <\/b> Restrict registry pull access to the operations team<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1. Use a multi-stage build so only required runtime files are copied into the final image<\/b><\/p>\n

                    Explanation:<\/b><\/p>\n

                    Multi-stage builds separate compilation and packaging tools from the final runtime image. One stage may include source code, package managers, compilers, and debugging tools, while a later stage contains only the application and runtime dependencies required in production. This reduces image size, vulnerability exposure, and the number of useful utilities available to an attacker after compromise. Registry access controls remain important for supply chain security, but they do not reduce the software included inside the image. Persisting build directories can introduce additional sensitive material and unnecessary complexity. Simply removing shell execution permissions is also incomplete because other utilities and libraries remain present. Minimal runtime images are a foundational container-hardening practice.<\/span><\/p>\n

                    Question 190.<\/b><\/p>\n

                    A security team wants to know exactly which open-source packages are included in a container image so it can respond quickly to future vulnerability disclosures. Which artifact is MOST useful?<\/b><\/p>\n

                      \n
                    1. <\/b> Kubernetes audit policy<\/span><\/li>\n
                    2. <\/b> Software Bill of Materials<\/span><\/li>\n
                    3. <\/b> NetworkPolicy manifest<\/span><\/li>\n
                    4. <\/b> ServiceAccount token<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 2. Software Bill of Materials<\/b><\/p>\n

                      Explanation:<\/b><\/p>\n

                      A Software Bill of Materials, or SBOM, provides an inventory of packages, libraries, and other components included in a software artifact. When a new vulnerability is disclosed, security teams can compare the affected component and version against SBOM data to determine which images may require investigation or remediation. SBOMs are especially useful when they are generated through trusted pipelines and associated with exact image digests. They do not automatically determine exploitability or patch vulnerable software, so vulnerability scanning, risk assessment, and remediation remain necessary. Kubernetes audit policies track API activity, NetworkPolicies control traffic, and service account tokens provide workload identity. None of those artifacts describes the software composition of a container image.<\/span><\/p>\n

                      Question 191.<\/b><\/p>\n

                      A company wants to prevent an attacker from replacing an approved image tag with malicious content while keeping the same tag name. Which practice provides the STRONGEST protection?<\/b><\/p>\n

                        \n
                      1. <\/b> Deploy by immutable digest and restrict registry write permissions<\/span><\/li>\n
                      2. <\/b> Use a private registry but allow all developers to overwrite tags<\/span><\/li>\n
                      3. <\/b> Scan the image only after it starts running<\/span><\/li>\n
                      4. <\/b> Require the application to run as non-root<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1. Deploy by immutable digest and restrict registry write permissions<\/b><\/p>\n

                        Explanation:<\/b><\/p>\n

                        An image digest uniquely identifies the exact image contents, unlike a mutable tag that may later be reassigned. Restricting registry write permissions further reduces the chance that unauthorized users can replace approved content. Image signing and signature verification can add another strong layer by establishing artifact authenticity and integrity. A private registry is useful but does not prevent trusted users or compromised credentials from overwriting tags if write permissions are broad. Running as non-root hardens runtime execution but does not protect artifact identity. Post-deployment scanning can identify some vulnerabilities but cannot guarantee that the artifact was the one originally approved. Supply chain security requires precise artifact identification and strong controls over who can publish or modify production images.<\/span><\/p>\n

                        Question 192.<\/b><\/p>\n

                        Which supply chain control BEST helps establish that a production image was generated by an approved CI pipeline from an expected source revision?<\/b><\/p>\n

                          \n
                        1. <\/b> A default-deny NetworkPolicy<\/span><\/li>\n
                        2. <\/b> Encryption at rest for Kubernetes Secrets<\/span><\/li>\n
                        3. <\/b> Trusted build provenance associated with the image<\/span><\/li>\n
                        4. <\/b> Resource quotas on production namespaces<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 3. Trusted build provenance associated with the image<\/b><\/p>\n

                          Explanation:<\/b><\/p>\n

                          Build provenance records information about how an artifact was created, potentially including its source repository, source revision, build system, workflow, and other relevant details. When produced by trusted infrastructure and associated with an exact image digest, provenance helps an organization verify that a production artifact came from an approved build path rather than an unmanaged developer workstation or unauthorized process. Provenance works best with signatures, trusted registries, SBOMs, vulnerability scanning, and admission verification. NetworkPolicies protect runtime communication, encryption at rest protects stored API data, and quotas control resource consumption. Those controls are valuable but do not establish the origin and build history of a container artifact.<\/span><\/p>\n

                          Question 193.<\/b><\/p>\n

                          A CI\/CD system can deploy applications but does not need permission to modify Kubernetes RBAC. Which configuration BEST reduces supply chain risk?<\/b><\/p>\n

                            \n
                          1. <\/b> Remove RBAC administration permissions from the pipeline identity<\/span><\/li>\n
                          2. <\/b> Allow RBAC changes only when deployments fail<\/span><\/li>\n
                          3. <\/b> Grant cluster-admin and monitor the token carefully<\/span><\/li>\n
                          4. <\/b> Use one token shared by build and deployment stages<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1. Remove RBAC administration permissions from the pipeline identity<\/b><\/p>\n

                            Explanation:<\/b><\/p>\n

                            A deployment identity should have only the permissions required to deploy approved resources. If modifying Roles, ClusterRoles, RoleBindings, or ClusterRoleBindings is unnecessary, those permissions should not be granted. A compromised pipeline with RBAC administration rights may be able to grant itself or other malicious identities broader access, making the pipeline a powerful privilege-escalation path. Granting cluster-admin and relying only on monitoring leaves an unnecessarily large blast radius. Shared credentials also reduce separation of duties and make revocation more disruptive. CI\/CD permissions should be reviewed by environment and resource type, and short-lived credentials should be preferred where practical. Least privilege is one of the strongest defenses against supply chain compromise.<\/span><\/p>\n

                            Question 194.<\/b><\/p>\n

                            A developer accidentally prints a production database password into a CI job log. What is the MOST appropriate response?<\/b><\/p>\n

                              \n
                            1. <\/b> Delete the visible log line and continue using the password<\/span><\/li>\n
                            2. <\/b> Rotate the exposed password and investigate who or what could access the log<\/span><\/li>\n
                            3. <\/b> Move the log to a different folder without changing the password<\/span><\/li>\n
                            4. <\/b> Rebuild the application image but keep the same credential<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 2. Rotate the exposed password and investigate who or what could access the log<\/b><\/p>\n

                              Explanation:<\/b><\/p>\n

                              Once a secret appears in a CI log, it should be treated as potentially compromised because logs may be retained, replicated, cached, downloaded, or accessible to users beyond those authorized for the underlying secret store. Rotating the exposed password invalidates copies that may already have been obtained. The organization should review log access, downstream systems, and authentication activity to determine whether the credential was misused. The logging problem should also be corrected through secret masking and safer credential injection. Deleting one visible line or moving the log does not guarantee that copies are gone. Rebuilding the application image is unrelated unless the credential was also embedded in the artifact itself.<\/span><\/p>\n

                              Question 195.<\/b><\/p>\n

                              A security engineer observes that a service account normally used only to read ConfigMaps has begun listing Secrets across multiple namespaces. What is the BEST interpretation?<\/b><\/p>\n

                                \n
                              1. <\/b> It may indicate credential misuse or an unexpected privilege change and should be investigated<\/span><\/li>\n
                              2. <\/b> It is expected behavior whenever pods restart<\/span><\/li>\n
                              3. <\/b> It indicates that NetworkPolicy enforcement is working correctly<\/span><\/li>\n
                              4. <\/b> It proves the application’s image is signed<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1. It may indicate credential misuse or an unexpected privilege change and should be investigated<\/b><\/p>\n

                                Explanation:<\/b><\/p>\n

                                A major deviation from an identity’s normal resource access pattern can indicate compromised credentials, unauthorized changes to RBAC, or unexpected application behavior. Security teams should inspect Kubernetes audit logs to determine when the access began, which API requests were made, and whether authorization policies were recently changed. They should also review workload processes, deployments, and network activity for signs of compromise. Ideally, least-privilege RBAC would prevent the service account from listing Secrets at all if that access is not required. Pod restarts do not inherently justify broader Secret access. NetworkPolicy governs network communication rather than Kubernetes API authorization, and image signing says nothing about how a service account is behaving at runtime.<\/span><\/p>\n

                                Question 196.<\/b><\/p>\n

                                A production application suddenly launches a shell, downloads an executable from an unfamiliar host, and starts it. Which response is MOST appropriate?<\/b><\/p>\n

                                  \n
                                1. <\/b> Increase the pod’s resource limits to prevent application instability<\/span><\/li>\n
                                2. <\/b> Add the external host to the application’s allowlist<\/span><\/li>\n
                                3. <\/b> Restart the pod and discard all existing logs<\/span><\/li>\n
                                4. <\/b> Treat the behavior as a potential compromise, contain the workload, and preserve evidence**<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 4. Treat the behavior as a potential compromise, contain the workload, and preserve evidence<\/b><\/p>\n

                                  Explanation:<\/b><\/p>\n

                                  Unexpected shell execution followed by downloading and running an unknown binary is a high-value runtime security signal. It can indicate exploitation, malware installation, credential theft, or preparation for lateral movement. The organization should follow its incident-response procedure, which may involve isolating the workload, restricting network access, capturing relevant process and network telemetry, preserving audit and application logs, and identifying the exact image and credentials involved. Simply restarting the pod can destroy useful evidence while failing to address the root cause, especially if the attacker can exploit the application again. Increasing resources or allowlisting the destination would make malicious activity easier. Prepared containment and evidence-preservation procedures are essential in cloud-native incident response.<\/span><\/p>\n

                                  Question 197.<\/b><\/p>\n

                                  Which control BEST reduces the ability of a compromised front-end pod to connect directly to a sensitive database that it never needs to access?<\/b><\/p>\n

                                    \n
                                  1. <\/b> A NetworkPolicy that permits database ingress only from the authorized backend tier<\/span><\/li>\n
                                  2. <\/b> A PodDisruptionBudget protecting database availability<\/span><\/li>\n
                                  3. <\/b> A ResourceQuota on the front-end namespace<\/span><\/li>\n
                                  4. <\/b> A readiness probe on the database pod<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1. A NetworkPolicy that permits database ingress only from the authorized backend tier<\/b><\/p>\n

                                    Explanation:<\/b><\/p>\n

                                    NetworkPolicy can explicitly restrict which workloads are allowed to connect to the database. If the front-end should communicate only with an API backend, there is no reason to permit direct database access. Limiting that path reduces lateral movement opportunities after front-end compromise. Database authentication, authorization, and encryption should still be enforced because network location alone should not establish trust. A PodDisruptionBudget helps maintain availability during disruptions, ResourceQuota limits resource consumption, and readiness probes determine whether pods should receive traffic. These controls are operationally important but do not restrict unauthorized east-west network communication. Segmentation is strongest when combined with dedicated workload identities, separate credentials, and runtime monitoring.<\/span><\/p>\n

                                    Question 198.<\/b><\/p>\n

                                    A security team wants to limit the destinations to which a payment-processing pod can send outbound traffic. Which control should it use?<\/b><\/p>\n

                                      \n
                                    1. <\/b> A ClusterRole restricting pod creation<\/span><\/li>\n
                                    2. <\/b> An egress NetworkPolicy supported by the cluster networking implementation<\/span><\/li>\n
                                    3. <\/b> A PodSecurityContext with <\/span>runAsNonRoot<\/span><\/li>\n
                                    4. <\/b> An encrypted etcd datastore<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 2. An egress NetworkPolicy supported by the cluster networking implementation<\/b><\/p>\n

                                      Explanation:<\/b><\/p>\n

                                      Egress NetworkPolicies can restrict the outbound destinations that selected pods may contact. A payment-processing workload might need access only to DNS, a database, and a specific external payment service. Blocking unnecessary destinations reduces the opportunity for a compromised workload to download tools, communicate with command-and-control infrastructure, or exfiltrate sensitive data. NetworkPolicy enforcement depends on the cluster’s networking implementation, and external services with dynamic addressing may require additional design. Non-root execution improves process privilege, encrypted etcd protects data at rest, and RBAC controls Kubernetes API actions. None of those mechanisms directly limits outbound network destinations, making egress policy the most appropriate control for this requirement.<\/span><\/p>\n

                                      Question 199.<\/b><\/p>\n

                                      Which practice BEST supports reliable Kubernetes forensic investigation when compromised pods may be deleted or automatically replaced?<\/b><\/p>\n

                                        \n
                                      1. <\/b> Forward Kubernetes audit, application, node, and runtime logs to protected centralized storage<\/span><\/li>\n
                                      2. <\/b> Keep logs only in each pod to preserve context<\/span><\/li>\n
                                      3. <\/b> Rely exclusively on Kubernetes Events<\/span><\/li>\n
                                      4. <\/b> Disable log forwarding to reduce the risk of exposing sensitive data<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 1. Forward Kubernetes audit, application, node, and runtime logs to protected centralized storage<\/b><\/p>\n

                                        Explanation:<\/b><\/p>\n

                                        Pods are ephemeral and may disappear through restarts, autoscaling, rescheduling, incident containment, or attacker activity. Logs stored only within the workload may therefore be lost before an investigation begins. Centralized storage preserves evidence independently of the pod lifecycle and allows analysts to correlate API activity, application behavior, node events, and runtime security alerts. The centralized logging platform must itself have strong access controls, retention policies, integrity protection, and careful handling of sensitive data. Kubernetes Events provide useful operational context but generally lack the depth required for full forensic analysis. Reliable incident readiness depends on collecting and protecting relevant telemetry before an incident occurs, because evidence that was never retained cannot be reconstructed later.<\/span><\/p>\n

                                        Question 200.<\/b><\/p>\n

                                        Which approach BEST represents a mature Kubernetes security program for production workloads?<\/b><\/p>\n

                                          \n
                                        1. <\/b> Prioritize perimeter firewalls and assume internal workloads are trusted<\/span><\/li>\n
                                        2. <\/b> Focus on image scanning and address runtime security only after an incident<\/span><\/li>\n
                                        3. <\/b> Use RBAC and NetworkPolicies but allow developers to bypass admission policies when necessary<\/span><\/li>\n
                                        4. <\/b> Continuously integrate identity security, least privilege, workload hardening, supply chain controls, network segmentation, policy enforcement, monitoring, logging, and incident response**<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 4. Continuously integrate identity security, least privilege, workload hardening, supply chain controls, network segmentation, policy enforcement, monitoring, logging, and incident response<\/b><\/p>\n

                                          Explanation:<\/b><\/p>\n

                                          A mature Kubernetes security program uses multiple layers throughout the full software and workload lifecycle. Identity controls and RBAC protect API access. Container hardening reduces privileges and writable attack surface. Supply chain protections establish trust in source code, dependencies, build systems, registries, and images. Admission policies enforce security requirements before workloads run, while NetworkPolicies limit unnecessary communication. Runtime monitoring and centralized logs help detect threats that preventive controls miss, and tested incident-response procedures support containment, evidence preservation, credential rotation, and recovery. The program must be continuous because clusters, software dependencies, personnel, and attack techniques change over time. No single control\u2014including perimeter security, vulnerability scanning, or RBAC\u2014can adequately address the full cloud-native threat landscape.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Linux Foundation KCSA Exam Dumps and Practice Test Dumps   Question 181. A security team wants to reduce the impact if a Kubernetes service account token is stolen from a compromised pod. Which control provides the BEST protection? Assign the service account only the minimum RBAC permissions required by the workload Place the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/21314"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=21314"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/21314\/revisions"}],"predecessor-version":[{"id":21315,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/21314\/revisions\/21315"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=21314"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=21314"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=21314"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}