Linux Foundation / CNCF KCSA: Kubernetes and Cloud Native Security Associate

Last checked October 22, 2026 against the official Linux Foundation / CNCF exam page.

1. Question 1Cluster Hardening

   Which Kubernetes component is the central point through which all cluster API requests pass, and which therefore must be protected carefully?

   1. Akubelet on a single node
   2. BCoreDNS only
   3. Ckube-proxy only
   4. Dkube-apiserver
   Show answer and explanationHide answer

   Correct answer: D

   The API server is the front door for all cluster requests, so its authentication, authorization, and admission controls are critical. The other components are important but do not act as the central request gateway.

2. Question 2Monitoring, Logging and Runtime Security

   Which tool is designed to detect suspicious runtime behaviour in containers, such as an unexpected shell being spawned?

   1. AA calendar application that schedules reminders for team meetings and deadlines
   2. BA text editor that formats documents and saves files to local storage with spellcheck
   3. CA runtime security tool that monitors system calls and container activity
   4. DA word processor that formats documents, checks grammar, exports to PDF and DOCX
   Show answer and explanationHide answer

   Correct answer: C

   Runtime security tools monitor system calls and behaviour to detect threats in running containers. Editors, calendars, and word processors do not monitor runtime activity.

3. Question 3Minimize Microservice Vulnerabilities

   Which practice protects the secrets a microservice needs, such as database passwords?

   1. APrint them in the application logs at debug level during an incident response review
   2. BStore them in a secrets management system and mount or inject them at runtime with restricted access
   3. CHard-code them as plain-text constants in the Dockerfile and container image layers
   4. DCommit them to the shared source repository so that the whole team can review the history
   Show answer and explanationHide answer

   Correct answer: B

   A secrets management system with runtime injection and restricted access keeps secrets out of images, repositories, and logs. Hard-coding, committing, and logging expose them.

4. Question 4Supply Chain Security

   A team builds a container image that includes a library with a known critical vulnerability. Which control catches this before deployment?

   1. AImage vulnerability scanning in the build pipeline with a policy that fails on critical findings
   2. BScanning after the image is already running in production, once nodes have pulled it
   3. CSkipping image scanning to speed up release cycles whenever deadlines are tight
   4. DTrusting the library because it is popular and widely adopted by many teams in production
   Show answer and explanationHide answer

   Correct answer: A

   Scanning in the pipeline with a failing policy stops vulnerable images before deployment. Trusting popularity, scanning only in production, and skipping scans let vulnerabilities reach users.

5. Question 5System Hardening

   Which Linux feature restricts the system calls a container can make, reducing kernel attack surface?

   1. Aseccomp profiles
   2. BThe swap partition
   3. CThe cron scheduler
   4. DThe Linux login banner
   Show answer and explanationHide answer

   Correct answer: A

   seccomp profiles filter system calls available to containers, limiting kernel exposure. The scheduler, banners, and swap do not restrict system calls.