CertArea
All Linux Foundation / CNCF exams

Free KCSA practice test: 30 questions with answers

30 original questions for Kubernetes and Cloud Native Security Associate, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions

KCSA exam guide: topics, cost and format

All 30 KCSA questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Cluster Hardening (5 questions)

  1. Question 1

    Which Kubernetes component is the central point through which all cluster API requests pass, and which therefore must be protected carefully?

    1. Akubelet on a single node
    2. BCoreDNS only
    3. Ckube-proxy only
    4. Dkube-apiserver
    Show answer and explanation
    Correct answer: D

    The API server is the front door for all cluster requests, so its authentication, authorization, and admission controls are critical. The other components are important but do not act as the central request gateway.

  2. Question 2

    Which Kubernetes feature decides whether an authenticated user is allowed to perform a specific action on a resource?

    1. AHorizontal Pod Autoscaler v2
    2. BRole-Based Access Control (RBAC)
    3. CLiveness and startup probes for pods
    4. DContainer image pull policy
    Show answer and explanation
    Correct answer: B

    RBAC defines which subjects can perform which verbs on which resources. Probes, image pull policies, and autoscalers do not decide authorization.

  3. Question 3

    A cluster administrator wants to remove default service account permissions from workloads that do not need to call the API. Which setting helps?

    1. AGrant the cluster-admin ClusterRole to the default service account in each namespace for convenience
    2. BShare one token across the namespaces in the cluster for convenience
    3. CDisable automatic mounting of the service account token for pods that do not need it
    4. DMount the token into the containers of each pod for centralised logging
    Show answer and explanation
    Correct answer: C

    Disabling automatic token mounting removes unnecessary API credentials from pods. Granting cluster-admin and sharing tokens increase exposure.

  4. Question 4

    Why should anonymous access to the Kubernetes API be restricted?

    1. AAnonymous access removes the need for RBAC because unauthenticated requests are treated as trusted system components
    2. BAnonymous requests could reach the API without an identity, so access must be explicitly limited
    3. CAnonymous access is required by the kube-scheduler to bind pods to nodes during scheduling
    4. DAnonymous access makes the API server faster by skipping token validation on requests
    Show answer and explanation
    Correct answer: B

    Anonymous requests have no identity and must be restricted to avoid unauthorised access. The other statements are incorrect.

  5. Question 5

    Which practice limits what a compromised pod can do to the rest of the cluster?

    1. AAllowing open pod-to-pod traffic across namespaces by default
    2. BDisabling network isolation between namespaces for debugging
    3. CRunning pods as root with a privileged security context enabled
    4. DNetwork policies that restrict pod-to-pod traffic to what is needed
    Show answer and explanation
    Correct answer: D

    Network policies restrict traffic between pods, limiting lateral movement after a compromise. Open communication, root pods, and removing namespaces increase the blast radius.

Monitoring, Logging and Runtime Security (5 questions)

  1. Question 6

    Which tool is designed to detect suspicious runtime behaviour in containers, such as an unexpected shell being spawned?

    1. AA calendar application that schedules reminders for team meetings and deadlines
    2. BA text editor that formats documents and saves files to local storage with spellcheck
    3. CA runtime security tool that monitors system calls and container activity
    4. DA word processor that formats documents, checks grammar, exports to PDF and DOCX
    Show answer and explanation
    Correct answer: C

    Runtime security tools monitor system calls and behaviour to detect threats in running containers. Editors, calendars, and word processors do not monitor runtime activity.

  2. Question 7

    Which Kubernetes audit information helps determine who created a privileged pod and when?

    1. ANode labels
    2. BAPI server audit logs
    3. CImage layers
    4. DLiveness probe results
    Show answer and explanation
    Correct answer: B

    API server audit logs record requests with identity, time, and resource details. Probes, node labels, and image layers do not record who created a pod.

  3. Question 8

    A security team wants to be alerted when a pod attempts to access a host path it should not use. Which mechanism provides this detection?

    1. AA review of the cluster's name and the labels applied to each namespace
    2. BRuntime policy alerts on file and system access events
    3. CA nightly report of CPU and memory usage per node pool
    4. DA printed inventory of pods and their container image tags
    Show answer and explanation
    Correct answer: B

    Runtime policy alerts detect unauthorised file and system access as it happens. CPU reports, printed inventories, and cluster names do not detect host path access.

  4. Question 9

    Why should security logs be sent off the node to a central location?

    1. AOff-node logs are usually faster to read since the index is local
    2. BCentral logs are unnecessary because each node already keeps a complete copy of its audit history
    3. CLogs stored locally are encrypted by default with keys managed by the node's kubelet and runtime
    4. DAn attacker who compromises a node could delete logs stored only on that node
    Show answer and explanation
    Correct answer: D

    Central storage preserves evidence if a node is compromised. Speed claims, unnecessary central logs, and assumed local encryption are not the reason.

  5. Question 10

    A team wants to detect anomalous network connections from a pod to an unknown external address. Which capability helps most?

    1. AThe pod's label colour and the shade of the badge shown on the dashboard
    2. BA printer status page showing paper levels and toner usage
    3. CA list of container names with their image digests and creation dates
    4. DNetwork flow monitoring with alerting on unexpected destinations
    Show answer and explanation
    Correct answer: D

    Flow monitoring with alerts on unexpected destinations detects suspicious outbound connections. Printer pages, container name lists, and label colours do not reveal network behaviour.

Minimize Microservice Vulnerabilities (5 questions)

  1. Question 11

    Which practice protects the secrets a microservice needs, such as database passwords?

    1. APrint them in the application logs at debug level during an incident response review
    2. BStore them in a secrets management system and mount or inject them at runtime with restricted access
    3. CHard-code them as plain-text constants in the Dockerfile and container image layers
    4. DCommit them to the shared source repository so that the whole team can review the history
    Show answer and explanation
    Correct answer: B

    A secrets management system with runtime injection and restricted access keeps secrets out of images, repositories, and logs. Hard-coding, committing, and logging expose them.

  2. Question 12

    Which Kubernetes object should be used to store sensitive values such as passwords, rather than a ConfigMap?

    1. ASecret
    2. BNamespace
    3. CDeployment
    4. DConfigMap
    Show answer and explanation
    Correct answer: A

    Secrets are the object intended for sensitive data, and they can be encrypted at rest and access-controlled. ConfigMaps are for non-sensitive configuration, and namespaces and deployments are not data stores for secrets.

  3. Question 13

    A microservice must communicate securely with other services inside the cluster. Which approach provides mutual authentication and encryption between services?

    1. APlain HTTP between services
    2. BPublic internet routing for internal traffic
    3. CShared passwords in the URL
    4. DA service mesh with mutual TLS
    Show answer and explanation
    Correct answer: D

    A service mesh with mutual TLS encrypts and authenticates service-to-service traffic. Plain HTTP, passwords in URLs, and public routing for internal traffic are insecure.

  4. Question 14

    A web microservice accepts user input that is used in a database query. Which control reduces the risk of injection?

    1. ATrusting all input from authenticated users
    2. BDisabling validation to improve speed
    3. CParameterized queries with input validation
    4. DConcatenating input directly into the query
    Show answer and explanation
    Correct answer: C

    Parameterized queries and input validation prevent injection. Concatenation, trusting authenticated input, and disabling validation enable injection.

  5. Question 15

    Which Kubernetes feature limits the damage a compromised pod can do to the host's resources, such as CPU or memory?

    1. AResource requests and limits
    2. BLiveness and readiness probe checks
    3. CNode selector labelling
    4. DContainer image labels
    Show answer and explanation
    Correct answer: A

    Resource limits cap what a pod can consume, which limits denial-of-service impact on other workloads. Node selectors place pods, probes check health, and labels describe images.

Supply Chain Security (5 questions)

  1. Question 16

    A team builds a container image that includes a library with a known critical vulnerability. Which control catches this before deployment?

    1. AImage vulnerability scanning in the build pipeline with a policy that fails on critical findings
    2. BScanning after the image is already running in production, once nodes have pulled it
    3. CSkipping image scanning to speed up release cycles whenever deadlines are tight
    4. DTrusting the library because it is popular and widely adopted by many teams in production
    Show answer and explanation
    Correct answer: A

    Scanning in the pipeline with a failing policy stops vulnerable images before deployment. Trusting popularity, scanning only in production, and skipping scans let vulnerabilities reach users.

  2. Question 17

    Which practice helps ensure that a container image deployed to the cluster is the one that was built and approved?

    1. ARename the image before deployment to a new repository name
    2. BUse the latest tag and skip checking its origin
    3. CRebuild the image on each worker node from the same source files
    4. DSign images and verify signatures at deployment time
    Show answer and explanation
    Correct answer: D

    Image signing and verification at deployment confirm provenance and integrity. Unchecked latest tags, per-node rebuilds, and renaming do not prove the image is the approved one.

  3. Question 18

    An organisation wants to know which open-source components are in its container images so that it can respond to new vulnerabilities. Which artifact provides this?

    1. AA printed photo of the server
    2. BA seating list of employee names
    3. CA software bill of materials (SBOM)
    4. DA floor plan of the main office
    Show answer and explanation
    Correct answer: C

    An SBOM lists the components and their versions, which supports vulnerability response. Photos, employee lists, and office diagrams do not list software components.

  4. Question 19

    A registry is used to store images for production. Which control reduces the risk of tampered images being pulled?

    1. APublic write access for developer teams and contractors
    2. BAccess control on the registry with immutable tags and signed images
    3. CUsing mutable tags such as latest for production deployments
    4. DNo authentication for pulls from the internal registry
    Show answer and explanation
    Correct answer: B

    Access control, immutable tags, and signatures protect image integrity in the registry. Public write access, mutable-only tags, and no authentication allow tampering.

  5. Question 20

    Which practice helps avoid pulling an image from a source that the organisation has not approved?

    1. AAsk developers to choose image sources carefully and check each registry name before they deploy
    2. BDisable image pull policies on nodes so cached images are reused without rechecking their origin
    3. CRestrict image sources with an admission policy that allows only approved registries
    4. DAllow pulls from any registry on the internet with default kubelet pull settings
    Show answer and explanation
    Correct answer: C

    An admission policy that restricts sources enforces the rule technically. Unrestricted pulls, developer discretion, and disabled policies do not enforce it.

System Hardening (5 questions)

  1. Question 21

    Which Linux feature restricts the system calls a container can make, reducing kernel attack surface?

    1. Aseccomp profiles
    2. BThe swap partition
    3. CThe cron scheduler
    4. DThe Linux login banner
    Show answer and explanation
    Correct answer: A

    seccomp profiles filter system calls available to containers, limiting kernel exposure. The scheduler, banners, and swap do not restrict system calls.

  2. Question 22

    Which Linux mechanism provides mandatory access control for containers by restricting file and process access through labels or profiles?

    1. AAppArmor or SELinux profiles
    2. BA longer password for root
    3. CPrinting audit logs daily
    4. DDisabling the host firewall rules
    Show answer and explanation
    Correct answer: A

    AppArmor and SELinux enforce mandatory access control through profiles or labels. Passwords, firewall settings, and printed logs do not enforce process and file restrictions.

  3. Question 23

    Why should containers avoid running as the root user?

    1. ARoot inside a container makes host compromise easier if an escape occurs
    2. BRoot is required by most applications that bind privileged ports below 1024
    3. CRoot makes containers start faster because the runtime skips image layer verification
    4. DRoot removes the need for resource limits and quotas set by the cluster administrator
    Show answer and explanation
    Correct answer: A

    Running as root increases the impact of a container escape or misconfiguration. Root is not required for most applications, does not speed up starts, and does not remove the need for limits.

  4. Question 24

    Which two practices reduce the attack surface of a container image? (Choose two.)

    1. AUse minimal base images with only required packages
    2. BInclude build tools in the final runtime image
    3. CRun the application as a non-root user
    4. DInstall an SSH server in every container
    5. EStore secrets in image layers
    Show answer and explanation
    Correct answer: A, C

    Minimal base images and non-root execution reduce attack surface. Build tools in runtime images, SSH servers in containers, and secrets in layers all add risk.

  5. Question 25

    A node's operating system is updated to fix a kernel vulnerability. What is the best approach for the Kubernetes workloads on the node?

    1. ADefer the kernel patch indefinitely to avoid disruption to running workloads during business hours
    2. BDelete the node object directly and reprovision it without draining its running pods first
    3. CCordon and drain the node, apply the update, and return it to service after validation
    4. DUpdate the node in place during peak traffic hours without draining or cordoning its running workloads
    Show answer and explanation
    Correct answer: C

    Cordoning, draining, updating, and validating keeps workloads safe during the patch. Peak updates, ignoring patches, and deleting nodes without draining cause disruption or leave gaps.

Overview of Cloud Native Security (5 questions)

  1. Question 26

    In the 4C model of cloud native security, which layer is the outermost and forms the foundation for the others?

    1. AKubernetes cluster components
    2. BCloud (or infrastructure)
    3. CApplication source code
    4. DContainer workloads
    Show answer and explanation
    Correct answer: B

    The 4C model layers are Cloud, Cluster, Container, and Code, with Cloud as the outermost foundation. Each inner layer depends on the security of the layers beneath it.

  2. Question 27

    Which principle asks that each component run with only the access and privileges it needs?

    1. AOpen-by-default networking
    2. BMaximum privilege for flexibility
    3. CLeast privilege
    4. DShared root access
    Show answer and explanation
    Correct answer: C

    Least privilege limits each component to the minimum access required, which reduces blast radius. Maximum privilege, shared root, and open defaults contradict it.

  3. Question 28

    A team wants security checks to happen early in development instead of only before release. Which practice is this?

    1. AShift right only
    2. BWaterfall testing at the end
    3. CShift left
    4. DNo security testing
    Show answer and explanation
    Correct answer: C

    Shifting left moves security checks earlier in the lifecycle, when defects are cheaper to fix. Shifting right focuses on production, and late or absent testing increases risk.

  4. Question 29

    What does defence in depth mean in a Kubernetes environment?

    1. ARemoving the admission, network, and audit controls to lower operational complexity and simplify administration
    2. BMultiple overlapping security controls at different layers so one failure does not compromise everything
    3. CJust encrypting the etcd database and Secrets at rest, while leaving the API server, kubelet, and pod network traffic unencrypted
    4. DA single, very strong perimeter firewall protecting the cluster edge, with no segmentation between workloads
    Show answer and explanation
    Correct answer: B

    Defence in depth uses multiple layers so that no single failure exposes the whole system. A single firewall, database-only encryption, and removing controls are not defence in depth.

  5. Question 30

    Which two statements about the shared responsibility model in cloud native environments are correct? (Choose two.)

    1. AThe provider secures the underlying infrastructure of the managed service
    2. BThe customer remains responsible for securing its workloads and configuration
    3. CThe provider is responsible for all application code written by the customer
    4. DThe customer has no responsibility for identity or access
    5. EThe model applies only to on-premises systems
    Show answer and explanation
    Correct answer: A, B

    The provider secures underlying infrastructure, while customers secure their workloads, configuration, and access. Customers remain responsible for their application code and identities, and the model applies to cloud environments.