[Mar-2026] Get 100% Real KCSA Free Online Practice Test
BEST Verified Linux Foundation KCSA Exam Questions (2026)
NEW QUESTION # 11
How can a user enforce thePod Security Standardwithout third-party tools?
- A. It is only possible to enforce the Pod Security Standard with additional tools within the cloud native ecosystem.
- B. Use the PodSecurity admission controller.
- C. Through implementing Kyverno or OPA Policies.
- D. No additional measures have to be taken to enforce the Pod Security Standard.
Answer: B
Explanation:
* ThePodSecurity admission controller(built-in as of Kubernetes v1.23+) enforces the Pod Security Standards (Privileged, Baseline, Restricted).
* Enforcement is namespace-scoped and configured throughnamespace labels.
* Incorrect options:
* (A) Kyverno/OPA are external policy tools (useful but not required).
* (C) Not true, PodSecurity admission provides native enforcement.
* (D) Enforcement requires explicit configuration, not automatic.
References:
Kubernetes Documentation - Pod Security Admission
CNCF Security Whitepaper - Policy enforcement and admission control.
NEW QUESTION # 12
Which technology can be used to apply security policy for internal cluster traffic at the application layer of the network?
- A. Service Mesh
- B. Ingress Controller
- C. Network Policy
- D. Container Runtime
Answer: A
Explanation:
* Service Mesh (e.g., Istio, Linkerd, Consul):operates atLayer 7 (application layer), enforcing policies like mTLS, authorization, and routing between services.
* NetworkPolicy:works atLayer 3/4 (IP/port), not Layer 7.
* Ingress Controller:handles external traffic ingress, not internal service-to-service traffic.
* Container Runtime:responsible for running containers, not enforcing application-layer security.
Exact extract (Istio docs):
* "Istio provides security by enforcing authentication, authorization, and encryption of service-to- service communication." References:
Kubernetes Docs - Network Policies: https://kubernetes.io/docs/concepts/services-networking/network- policies/ Istio Security Docs: https://istio.io/latest/docs/concepts/security/
NEW QUESTION # 13
Why does the defaultbase64 encodingthat Kubernetes applies to the contents of Secret resources provide inadequate protection?
- A. Base64 encoding is not supported by all Secret Stores.
- B. Base64 encoding is vulnerable to brute-force attacks.
- C. Base64 encoding does not encrypt the contents of the Secret, only obfuscates it.
- D. Base64 encoding relies on a shared key which can be easily compromised.
Answer: C
Explanation:
* Kubernetes stores Secret data asbase64-encoded stringsin etcd by default.
* Base64 is not encryption- it is a simple encoding scheme that merelyobfuscatesdata for transport and storage. Anyone with read access to etcd or the Secret manifest can easily decode the value back to plaintext.
* For actual protection, Kubernetes supportsencryption at rest(via encryption providers) and external Secret management (Vault, KMS, etc.).
References:
Kubernetes Documentation - Secrets
CNCF Security Whitepaper - Data protection section: highlights that base64 encoding does not protect data and encryption at rest is recommended.
NEW QUESTION # 14
A cluster is failing to pull more recent versions of images from k8s.gcr.io. Why may this be?
- A. There is a bug in the container runtime or the image pull process.
- B. There is a network connectivity issue between the cluster and k8s.gcr.io.
- C. The authentication credentials for accessing k8s.gcr.io are incorrectly scoped.
- D. The container image registry k8s.gcr.io has been deprecated.
Answer: D
Explanation:
* k8s.gcr.iowas the historic Kubernetes image registry.
* It has beendeprecatedand replaced withregistry.k8s.io.
* Exact extract (Kubernetes Blog):
* "The k8s.gcr.io image registry will be frozen from April 3, 2023 and fully deprecated. All Kubernetes project images are now served from registry.k8s.io."
* Pulling newer versions from k8s.gcr.io fails because the registry no longer receives updates.
References:
Kubernetes Blog - Image Registry Update: https://kubernetes.io/blog/2023/02/06/k8s-gcr-io-freeze- announcement/
NEW QUESTION # 15
A Kubernetes cluster tenant can launch privileged Pods in contravention of therestricted Pod Security Standardmandated for cluster tenants and enforced by the built-inPodSecurity admission controller.
The tenant has full CRUD permissions on the namespace object and the namespaced resources. How did the tenant achieve this?
- A. The scope of the tenant role means privilege escalation is impossible.
- B. By tampering with the namespace labels.
- C. By using higher-level access credentials obtained reading secrets from another namespace.
- D. By deleting the PodSecurity admission controller deployment running in their namespace.
Answer: B
Explanation:
* ThePodSecurity admission controllerenforces Pod Security Standards (Baseline, Restricted, Privileged)based on namespace labels.
* If a tenant has full CRUD on the namespace object, they canmodify the namespace labelsto remove or weaken the restriction (e.g., setting pod-security.kubernetes.io/enforce=privileged).
* This allows privileged Pods to be admitted despite the security policy.
* Incorrect options:
* (A) is false - namespace-level access allows tampering.
* (C) is invalid - PodSecurity admission is not namespace-deployed, it's a cluster-wide admission controller.
* (D) is unrelated - Secrets from other namespaces wouldn't directly bypass PodSecurity enforcement.
References:
Kubernetes Documentation - Pod Security Admission
CNCF Security Whitepaper - Admission control and namespace-level policy enforcement weaknesses.
NEW QUESTION # 16
An attacker has successfully overwhelmed the Kubernetes API server in a cluster with a single control plane node by flooding it with requests.
How would implementing a high-availability mode with multiple control plane nodes mitigate this attack?
- A. By implementing network segmentation to isolate the API server from the rest of the cluster, preventing the attack from spreading.
- B. By implementing rate limiting and throttling mechanisms on the API server to restrict the number of requests allowed.
- C. By increasing the resources allocated to the API server, allowing it to handle a higher volume of requests.
- D. By distributing the workload across multiple API servers, reducing the load on each server.
Answer: D
Explanation:
* Inhigh-availability clusters, multiple API server instances run behind a load balancer.
* Thisdistributes client requests across multiple API servers, preventing a single API server from being overwhelmed.
* Exact extract (Kubernetes Docs - High Availability Clusters):
* "A highly available control plane runs multiple instances of kube-apiserver, typically fronted by a load balancer, so that if one instance fails or is overloaded, others continue serving requests."
* Other options clarified:
* A: Network segmentation does not directly mitigate API server DoS.
* C: Adding resources helps, but doesn't solve single-point-of-failure.
* D: Rate limiting is a valid mitigation but not provided by HA alone.
References:
Kubernetes Docs - Building High-Availability Clusters: https://kubernetes.io/docs/setup/production- environment/tools/kubeadm/high-availability/
NEW QUESTION # 17
Which other controllers are part of the kube-controller-manager inside the Kubernetes cluster?
- A. Job controller, CronJob controller, and DaemonSet controller
- B. Replication controller, Endpoints controller, Namespace controller, and ServiceAccounts controller
- C. Namespace controller, ConfigMap controller, and Secret controller
- D. Pod, Service, and Ingress controller
Answer: B
Explanation:
* kube-controller-managerruns a set of controllers that regulate the cluster's state.
* Exact extract (Kubernetes Docs):"The kube-controller-manager runs controllers that are core to Kubernetes. Examples of controllers are: Node controller, Replication controller, Endpoints controller, Namespace controller, and ServiceAccounts controller."
* Why D is correct:All listed are actual controllers within kube-controller-manager.
* Why others are wrong:
* A:Job and CronJob controllers are managed by kube-controller-manager, but DaemonSet controller is managed by the kube-scheduler/deployment logic.
* B:Pod, Service, Ingress controllers are not part of kube-controller-manager.
* C:ConfigMap and Secret do not have dedicated controllers.
References:
Kubernetes Docs - kube-controller-manager: https://kubernetes.io/docs/reference/command-line-tools- reference/kube-controller-manager/
NEW QUESTION # 18
A container image istrojanizedby an attacker by compromising the build server. Based on the STRIDE threat modeling framework, which threat category best defines this threat?
- A. Repudiation
- B. Tampering
- C. Denial of Service
- D. Spoofing
Answer: B
Explanation:
* In STRIDE,Tamperingis the threat category forunauthorized modification of data or code/artifacts. A trojanized container image is, by definition, an attacker'smodificationof the build output (the image) after compromising the CI/build system-i.e., tampering with the artifact in the software supply chain.
* Why not the others?
* Spoofingis about identity/authentication (e.g., pretending to be someone/something).
* Repudiationis about denying having performed an action without sufficient audit evidence.
* Denial of Servicetargets availability (exhausting resources or making a service unavailable).The scenario explicitly focuses on analtered imageresulting from a compromised build server-this squarely maps toTampering.
Authoritative references (for verification and deeper reading):
* Kubernetes (official docs)- Supply Chain Security (discusses risks such as compromised CI/CD pipelines leading to modified/poisoned images and emphasizes verifying image integrity/signatures).
* Kubernetes Docs#Security#Supply chain securityandSecuring a cluster(sections on image provenance, signing, and verifying artifacts).
* CNCF TAG Security - Cloud Native Security Whitepaper (v2)- Threat modeling in cloud-native and software supply chain risks; describes attackers modifying build outputs (images/artifacts) via CI
/CD compromise as a form oftamperingand prescribes controls (signing, provenance, policy).
* CNCF TAG Security - Software Supply Chain Security Best Practices- Explicitly covers CI/CD compromise leading tomaliciously modified imagesand recommends SLSA, provenance attestation, and signature verification (policy enforcement via admission controls).
* Microsoft STRIDE (canonical reference)- DefinesTamperingasmodifying data or code, which directly fits a trojanized image produced by a compromised build system.
NEW QUESTION # 19
What is Grafana?
- A. A cloud-native distributed tracing system for monitoring microservices architectures.
- B. A platform for monitoring and visualizing time-series data.
- C. A cloud-native security tool for scanning and detecting vulnerabilities in Kubernetes clusters.
- D. A container orchestration platform for managing and scaling applications.
Answer: B
Explanation:
* Grafana:An open-source analytics and visualization platform widely used with Prometheus, Loki, etc.
* Exact extract (Grafana Docs):"Grafana is the open-source analytics and monitoring solution for every database. It allows you to query, visualize, alert on, and understand your metrics no matter where they are stored."
* A is wrong:That describesJaeger(distributed tracing).
* B is wrong:That'sKubernetesitself.
* D is wrong:That'sTrivy/Aqua/Prismatype tools.
References:
Grafana Docs: https://grafana.com/docs/grafana/latest/
NEW QUESTION # 20
In a cluster that contains Nodes withmultiple container runtimesinstalled, how can a Pod be configured to be created on a specific runtime?
- A. By modifying the Docker daemon configuration.
- B. By setting the container runtime as an environment variable in the Pod.
- C. By specifying the container runtime in the Pod's YAML file.
- D. By using a command-line flag when creating the Pod.
Answer: C
Explanation:
* Kubernetes supportsmultiple container runtimeson a node via theRuntimeClassresource.
* To select a runtime, you specify the runtimeClassName field in thePod's YAML manifest. Example:
* apiVersion: v1
* kind: Pod
* metadata:
* name: example
* spec:
* runtimeClassName: gvisor
* containers:
* - name: app
* image: nginx
* Incorrect options:
* (A) You cannot specify container runtime through a kubectl command-line flag.
* (B) Modifying the Docker daemon config does not direct Kubernetes Pods to a runtime.
* (C) Environment variables inside a Pod spec do not control container runtimes.
References:
Kubernetes Documentation - RuntimeClass
CNCF Security Whitepaper - Workload isolation via different runtimes (e.g., gVisor, Kata) for enhanced security.
NEW QUESTION # 21
Which of the following statements best describes the role of the Scheduler in Kubernetes?
- A. The Scheduler is responsible for assigning Pods to nodes based on resource availability and other constraints.
- B. The Scheduler is responsible for monitoring and managing the health of the Kubernetes cluster.
- C. The Scheduler is responsible for ensuring the security of the Kubernetes cluster and its components.
- D. The Scheduler is responsible for managing the deployment and scaling of applications in the Kubernetes cluster.
Answer: A
Explanation:
* TheKubernetes Schedulerassigns Pods to nodes based on:
* Resource requests & availability (CPU, memory, GPU, etc.)
* Constraints (affinity, taints, tolerations, topology, policies)
* Exact extract (Kubernetes Docs - Scheduler):
* "The scheduler is a control plane process that assigns Pods to Nodes. Scheduling decisions take into account resource requirements, affinity/anti-affinity, constraints, and policies."
* Other options clarified:
* A: Monitoring cluster health is theController Manager's/kubelet's job.
* B: Security is enforced throughRBAC, admission controllers, PSP/PSA, not the scheduler.
* C: Deployment scaling is handled by theController Manager(Deployment/ReplicaSet controller).
References:
Kubernetes Docs - Scheduler: https://kubernetes.io/docs/concepts/scheduling-eviction/kube-scheduler/
NEW QUESTION # 22
When using a cloud provider's managed Kubernetes service, who is responsible for maintaining the etcd cluster?
- A. Kubernetes administrator
- B. Cloud provider
- C. Application developer
- D. Namespace administrator
Answer: B
Explanation:
* Inmanaged Kubernetes services(EKS, GKE, AKS), the control plane is operated by thecloud provider
.
* This includesetcd, API server, controller manager, scheduler.
* Users manageworker nodes(in some models) and workloads, but not the control plane.
* Exact extract (GKE Docs):
* "The control plane, including the API server and etcd database, is managed and maintained by Google."
* Similarly forEKSandAKS, etcd is fully managed by the provider.
References:
GKE Architecture: https://cloud.google.com/kubernetes-engine/docs/concepts/cluster-architecture EKS Architecture: https://docs.aws.amazon.com/eks/latest/userguide/eks-architecture.html AKS Docs: https://learn.microsoft.com/en-us/azure/aks/concepts-clusters-workloads
NEW QUESTION # 23
In Kubernetes, what isPublic Key Infrastructure (PKI)used for?
- A. To manage certificates and ensure secure communication in a Kubernetes cluster.
- B. To automate the scaling of containers in a Kubernetes cluster.
- C. To monitor and analyze performance metrics of a Kubernetes cluster.
- D. To manage networking in a Kubernetes cluster.
Answer: A
Explanation:
* Kubernetes usesPKI certificatesextensively to secure communication between control plane components (API server, etcd, kube-scheduler, kube-controller-manager) and with kubelets.
* Certificates enablemutual TLS authentication and encryptionacross components.
* PKI does not handle scaling, networking, or monitoring.
References:
Kubernetes Documentation - Certificates
CNCF Security Whitepaper - Cluster communication security and the role of PKI.
NEW QUESTION # 24
What information is stored in etcd?
- A. Pod data contained in Persistent Volume Claims (e.g. hostPath).
- B. Sensitive user data such as usernames and passwords.
- C. Etcd manages the configuration data, state data, and metadata for Kubernetes.
- D. Application logs and monitoring data for auditing and troubleshooting purposes.
Answer: C
Explanation:
* etcdis Kubernetes'key-value storeforcluster state.
* Stores: ConfigMaps, Secrets, Pod definitions, Deployments, RBAC policies, and metadata.
* Exact extract (Kubernetes Docs - etcd):
* "etcd is a consistent and highly-available key-value store used as Kubernetes' backing store for all cluster data."
* Clarifications:
* B: Logs/metrics are handled by logging/monitoring solutions, not etcd.
* C: Secrets may be stored here but encoded in base64, not specifically "usernames/passwords" as primary use.
* D: Persistent Volumes are external storage, not stored in etcd.
References:
Kubernetes Docs - etcd: https://kubernetes.io/docs/concepts/overview/components/#etcd
NEW QUESTION # 25
What kind of organization would need to be compliant with PCI DSS?
- A. Non-profit organizations that handle sensitive customer data.
- B. Retail stores that only accept cash payments.
- C. Merchants that process credit card payments.
- D. Government agencies that collect personally identifiable information.
Answer: C
Explanation:
* PCI DSS (Payment Card Industry Data Security Standard):applies to any entity thatstores, processes, or transmits cardholder data.
* Exact extract (PCI DSS official summary):
* "PCI DSS applies to all entities that store, process or transmit cardholder data (CHD) and
/or sensitive authentication data (SAD)."
* Therefore,merchants who process credit card paymentsmust comply.
* Why others are wrong:
* A: No card payments, so no PCI scope.
* B: This falls underFISMA / NIST 800-53, not PCI DSS.
* C: Non-profits may handle sensitive data, but PCI only applies if they processcredit cards.
References:
PCI Security Standards Council - PCI DSS Summary: https://www.pcisecuritystandards.org/pci_security/
NEW QUESTION # 26
What is the main reason an organization would use a Cloud Workload Protection Platform (CWPP) solution?
- A. To protect containerized workloads from known vulnerabilities and malware threats.
- B. To manage networking between containerized workloads in the Kubernetes cluster.
- C. To optimize resource utilization and scalability of containerized workloads.
- D. To automate the deployment and management of containerized workloads.
Answer: A
Explanation:
* CWPP (Cloud Workload Protection Platform):As defined by Gartner and adopted across cloud security practices, CWPPs are designed tosecure workloads(VMs, containers, serverless functions) in hybrid and cloud environments.
* They providevulnerability scanning, runtime protection, compliance checks, and malware detection.
* Exact extract (Gartner CWPP definition):"Cloud workload protection platforms protect workloads regardless of location, including physical machines, VMs, containers, and serverless workloads. They provide vulnerability management, system integrity protection, intrusion detection and prevention, and malware protection." References:
Gartner: Cloud Workload Protection Platforms Market Guide (summary): https://www.gartner.com/reviews
/market/cloud-workload-protection-platforms
CNCF Security Whitepaper:https://github.com/cncf/tag-security
NEW QUESTION # 27
In a Kubernetes cluster, what are the security risks associated with using ConfigMaps for storing secrets?
- A. ConfigMaps store sensitive information in etcd encoded in base64 format automatically, which does not ensure confidentiality of data.
- B. Using ConfigMaps for storing secrets might make applications incompatible with the Kubernetes cluster.
- C. Storing secrets in ConfigMaps can expose sensitive information as they are stored in plaintext and can be accessed by unauthorized users.
- D. Storing secrets in ConfigMaps does not allow for fine-grained access control via RBAC.
Answer: C
Explanation:
* ConfigMaps are explicitly not for confidential data.
* Exact extract (ConfigMap concept):"A ConfigMap is an API object used to store non- confidential data in key-value pairs."
* Exact extract (ConfigMap concept):"ConfigMaps are not intended to hold confidential data. Use a Secret for confidential data."
* Why this is risky:data placed into a ConfigMap is stored as regular (plaintext) string values in the API and etcd (unless you deliberately use binaryData for base64 content you supply). That means if someone has read access to the namespace or to etcd/APIServer storage, they can view the values.
* Secrets vs ConfigMaps (to clarify distractor D):
* Exact extract (Secret concept):"By default, secret data is stored as unencrypted base64- encoded strings.You canenable encryption at restto protect Secrets stored in etcd."
* This base64 behavior applies toSecrets, not to ConfigMap data. Thus optionDis incorrect for ConfigMaps.
* About RBAC (to clarify distractor A):Kubernetesdoessupport fine-grained RBAC forboth ConfigMaps and Secrets; the issue isn't lack of RBAC but that ConfigMaps arenotdesigned for confidential material.
* About compatibility (to clarify distractor C):Using ConfigMaps for secrets doesn't make apps
"incompatible"; it's simplyinsecureand against guidance.
References:
Kubernetes Docs -ConfigMaps: https://kubernetes.io/docs/concepts/configuration/configmap/ Kubernetes Docs -Secrets: https://kubernetes.io/docs/concepts/configuration/secret/ Kubernetes Docs -Encrypting Secret Data at Rest: https://kubernetes.io/docs/tasks/administer-cluster
/encrypt-data/
Note: The citations above are from the official Kubernetes documentation and reflect the stated guidance that ConfigMaps are fornon-confidentialdata, while Secrets (with encryption at rest enabled) are forconfidential data, and that the 4C's map todefense in depth.
NEW QUESTION # 28
By default, in a Kubeadm cluster, which authentication methods are enabled?
- A. OIDC, Bootstrap tokens, and Service Account Tokens
- B. X509 Client Certs, Webhook Authentication, and Service Account Tokens
- C. X509 Client Certs, OIDC, and Service Account Tokens
- D. X509 Client Certs, Bootstrap Tokens, and Service Account Tokens
Answer: D
Explanation:
* In akubeadm cluster, by default the API server enables several authentication mechanisms:
* X509 Client Certs: Used for authenticating kubelets, admins, and control-plane components.
* Bootstrap Tokens: Temporary credentials used for node bootstrap/joining clusters.
* Service Account Tokens: Used by workloads in pods to authenticate with the API server.
* Exact extract (Kubernetes Docs - Authentication):
* "Kubernetes uses client certificates, bearer tokens, an authenticating proxy, or HTTP basic auth to authenticate API requests."
* "Bootstrap tokens are a simple bearer token that is meant to be used when creating new clusters or joining new nodes to an existing cluster."
* "Service accounts are special accounts that provide an identity for processes that run in a Pod." References:
Kubernetes Docs - Authentication: https://kubernetes.io/docs/reference/access-authn-authz/authentication/ Kubeadm - TLS Bootstrapping: https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/
NEW QUESTION # 29
......
KCSA Exam Dumps, Practice Test Questions BUNDLE PACK: https://examsboost.actualpdf.com/KCSA-real-questions.html
