I85PREP
⌘ K
KCSA study materials
KCSA study resources

KCSA practice questions

One question at a time. Build your KCSA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Overview of Cloud Native Security

In the four-layer model of cloud native security, which layer sits directly inside the container layer and is where runtime isolation between containers is enforced?

  1. The cluster layer
  2. The code layer Correct answer.
  3. The node layer
  4. The pod/workload layer

Explanation

The commonly used four-layer model runs from the outer infrastructure inward: cluster, container, pod/workload, and code. The innermost code layer is where application logic and its dependencies actually execute, so it is the layer directly inside the container layer in that ordering.

Question 2Overview of Cloud Native Security

A security team wants to reduce the attack surface of the container layer itself. Which practice most directly addresses that layer?

  1. Enabling audit logging on the API server
  2. Requiring signed commits on the application repository
  3. Enforcing network policies between namespaces
  4. Using minimal base images and running as non-root Correct answer.

Explanation

The container layer concerns the image contents and the runtime identity of the process. Minimal base images remove unused packages and running as non-root limits what a compromised process can do, both hardening that layer directly.

Question 3Overview of Cloud Native Security

Which statement best describes the principle of least privilege as applied to cloud native identities?

  1. Each identity receives only the permissions required for its specific task Correct answer.
  2. Each identity shares a common role to simplify administration
  3. Each identity is rotated on a fixed schedule regardless of need
  4. Each identity receives full cluster access but is audited

Explanation

Least privilege means granting an identity the minimum permissions needed to perform its function and nothing more. This limits the blast radius if credentials are stolen or a workload is compromised.

Question 4Overview of Cloud Native Security

In a shared responsibility model for a managed Kubernetes service, which item typically remains the customer's responsibility?

  1. Maintaining the provider's control plane availability
  2. Patching the physical hypervisor
  3. Securing the workloads and their configurations Correct answer.
  4. Physical security of the data center

Explanation

The provider secures the underlying infrastructure and the managed control plane, while the customer remains responsible for what runs on top. Workload configuration, images, RBAC policies, and secrets handling stay with the customer.

Question 5Overview of Cloud Native Security

Why is the cluster layer often described as the most complex layer to secure in the four-layer model?

  1. It only concerns application source code
  2. It contains no configurable components
  3. It exposes many interacting control plane components and APIs Correct answer.
  4. It is fully controlled by the cloud provider

Explanation

The cluster layer includes the API server, scheduler, controller manager, etcd, and the many policies that connect them. The large number of interacting components and configuration surfaces makes it the most complex layer to secure.

Question 6Overview of Cloud Native Security

A team wants to prevent a compromised pod from reaching the cloud metadata endpoint. Which control most directly mitigates that risk?

  1. A liveness probe on the container
  2. A pod disruption budget on the workload
  3. A network policy that blocks egress to the metadata IP Correct answer.
  4. A resource quota on the namespace

Explanation

The cloud metadata endpoint is reachable over the network, so restricting egress traffic to its address prevents a compromised pod from querying it. Network policies are the native mechanism for controlling that traffic.

Question 7Overview of Cloud Native Security

Which Kubernetes feature lets you restrict which API operations a service account can perform?

  1. Role-based access control Correct answer.
  2. NetworkPolicy
  3. ResourceQuota
  4. PodSecurity admission

Explanation

RBAC binds roles, which list allowed verbs and resources, to subjects such as service accounts. It is the primary mechanism for controlling what API operations an identity may perform.

Question 8Overview of Cloud Native Security

What is the main security benefit of running workloads in separate namespaces with distinct service accounts?

  1. It eliminates the need for network policies
  2. It automatically encrypts secrets at rest
  3. It isolates resources and limits the scope of credentials Correct answer.
  4. It removes the need for image scanning

Explanation

Namespaces provide a boundary for resource grouping, and per-namespace service accounts limit the scope of credentials if one is compromised. Combined with RBAC, this reduces blast radius across the cluster.

Question 9Overview of Cloud Native Security

Why should long-lived cluster-admin kubeconfig files be avoided for day-to-day operations?

  1. They expire every hour automatically
  2. They cannot authenticate to the API server
  3. They only work on the control plane node
  4. They grant excessive standing privileges if leaked Correct answer.

Explanation

A kubeconfig bound to cluster-admin gives anyone who obtains it full control of the cluster for as long as it remains valid. Preferring short-lived, scoped credentials limits the damage from a leak.

Question 10Overview of Cloud Native Security

Which supply chain control most directly verifies that a container image was built by a trusted pipeline before it is admitted?

  1. A namespace resource quota
  2. A horizontal pod autoscaler
  3. A readiness probe on the deployment
  4. Admission control that checks image signatures Correct answer.

Explanation

Signature verification at admission time confirms that an image was produced by a trusted builder before the cluster runs it. This ties the running workload back to a verified supply chain.

Question 11Overview of Cloud Native Security

A cluster stores secrets as plaintext in etcd. Which change most directly addresses confidentiality of those secrets at rest?

  1. Enabling verbose API audit logging
  2. Enabling encryption at rest for secrets in the API server Correct answer.
  3. Adding more etcd replicas
  4. Increasing the etcd heartbeat interval

Explanation

Encryption at rest is configured on the API server so that secret objects are encrypted before being written to etcd. This protects the data if the backing store is compromised or its disk is stolen.

Question 12Overview of Cloud Native Security

Which practice best reduces the risk of credential leakage from a container image?

  1. Storing secrets in environment variables in the Dockerfile
  2. Injecting secrets at runtime from a secrets manager Correct answer.
  3. Baking build-time secrets into image layers
  4. Committing secrets to the repository for traceability

Explanation

Injecting secrets at runtime keeps them out of image layers and build history. Image layers are easily inspected, so secrets baked into them should be treated as permanently exposed.

Question 13Overview of Cloud Native Security

What does the code layer of the four-layer model primarily encompass?

  1. The container runtime and its isolation primitives
  2. The physical hosts running the workloads
  3. The application source, dependencies, and runtime configuration Correct answer.
  4. The control plane API and its authorizers

Explanation

The code layer covers the application itself: its source, third-party dependencies, and the runtime configuration it reads. Securing it means managing vulnerabilities and integrity in that software.

Question 14Overview of Cloud Native Security

An organization wants to enforce that pods cannot run as root. Which mechanism is designed for this in current Kubernetes versions?

  1. NetworkPolicy with a deny-all rule
  2. ResourceQuota with a compute limit
  3. PriorityClass with a high value
  4. PodSecurity admission with the restricted profile Correct answer.

Explanation

PodSecurity admission enforces pod security standards at the namespace level, and the restricted profile blocks running as root among other hardening requirements. It is the built-in successor to the deprecated pod security policy.

Question 15Overview of Cloud Native Security

Why is the principle of defense in depth important when securing a Kubernetes cluster?

  1. It removes the need for monitoring and detection
  2. It guarantees that no vulnerability will ever be exploited
  3. Layered controls ensure a failure in one does not expose everything Correct answer.
  4. A single perimeter control is sufficient if it is strong enough

Explanation

Defense in depth assumes that any single control can fail, so multiple independent layers are used to contain the impact. If one layer is bypassed, the remaining layers still constrain an attacker.

Question 16Overview of Cloud Native Security

Which control most directly limits the impact of a compromised node on the rest of the cluster?

  1. Enabling the horizontal pod autoscaler
  2. Using larger node instance types
  3. Segmenting node and pod traffic with network policies Correct answer.
  4. Increasing the kubelet log verbosity

Explanation

Network segmentation restricts which workloads can talk to each other, so a compromised node cannot freely reach every service. This contains lateral movement across the cluster.

Question 17Overview of Cloud Native Security

What is the primary purpose of an admission controller in a Kubernetes security strategy?

  1. To encrypt traffic between pods
  2. To schedule pods onto the least loaded node
  3. To rotate service account tokens automatically
  4. To intercept and validate or mutate requests before objects are persisted Correct answer.

Explanation

Admission controllers run after authentication and authorization but before an object is written to etcd. They can reject non-compliant requests or mutate them, making them a key policy enforcement point.

Question 18Overview of Cloud Native Security

A team discovers that a pod can read the service account token of another workload. Which design flaw does this most likely indicate?

  1. The pods share a single service account with broad permissions Correct answer.
  2. The pods use distinct namespaces with RBAC
  3. The pods use read-only root filesystems
  4. The pods are scheduled on different nodes

Explanation

If workloads share one service account, any pod using it inherits the same token and permissions. Giving each workload its own narrowly scoped service account prevents one pod from acting with another's identity.

Question 19Overview of Cloud Native Security

Which statement about the shared responsibility model for self-managed Kubernetes on cloud VMs is accurate?

  1. The provider manages the control plane and the customer manages only code
  2. The provider manages node patching while the customer manages etcd
  3. The customer manages everything from the OS upward, including the control plane Correct answer.
  4. Responsibility is identical to a fully managed Kubernetes service

Explanation

With self-managed Kubernetes on cloud VMs, the provider secures the physical infrastructure and hypervisor, while the customer owns the operating system, control plane, and workloads. This is a much larger customer scope than a managed service.

Question 20Overview of Cloud Native Security

An auditor finds that RBAC roles use wildcards for verbs and resources across many namespaces. What is the most significant security consequence?

  1. It prevents privilege escalation by design
  2. It improves performance of the API server
  3. It automatically enforces least privilege
  4. It increases the blast radius of any compromised identity Correct answer.

Explanation

Wildcard permissions grant far more access than a workload needs, so a single stolen credential can reach many resources. Scoping roles to specific verbs and resources limits the damage a compromised identity can cause.

Question 21Overview of Cloud Native Security

Which approach best protects the integrity of the software supply chain from source to running container?

  1. Disabling image pull policies
  2. Scanning images only once at build time
  3. Signing artifacts and verifying signatures at admission Correct answer.
  4. Using the latest tag for all deployments

Explanation

Signing build artifacts and verifying those signatures when images are admitted ties what runs to what was built by a trusted pipeline. Combined with scanning, this protects both integrity and known-vulnerability posture.

Question 22Overview of Cloud Native Security

What is the main risk of granting the default service account in a namespace broad permissions?

  1. Network policies stop functioning in that namespace
  2. The namespace can no longer contain secrets
  3. Pods in the namespace can no longer be scheduled
  4. Every pod in the namespace inherits those permissions automatically Correct answer.

Explanation

Pods that do not specify a service account use the namespace default, so broad rights on that account apply to all such pods. Any compromised pod in the namespace then gains those permissions.

Question 23Overview of Cloud Native Security

Why should the API server's anonymous authentication be disabled in production clusters?

  1. It enables automatic certificate rotation
  2. It prevents unauthenticated requests from being evaluated as a known identity Correct answer.
  3. It speeds up etcd compaction
  4. It reduces the number of available node ports

Explanation

Anonymous authentication can map unauthenticated requests to a real identity, which may then be authorized by permissive RBAC. Disabling it ensures every request is tied to an authenticated identity.

Question 24Overview of Cloud Native Security

Which layer of the four-layer model is primarily concerned with image provenance and the runtime identity of the process?

  1. The container layer Correct answer.
  2. The cluster layer
  3. The network layer
  4. The code layer

Explanation

The container layer covers the image itself and how the process runs, including provenance and the user identity it assumes. Hardening here means trusted images and non-privileged runtime settings.

Question 25Overview of Cloud Native Security

A team wants to detect suspicious API activity such as privilege escalation attempts. Which capability is most relevant?

  1. Enabling Kubernetes audit logging with a policy that captures RBAC changes Correct answer.
  2. Setting a low CPU request on the API server
  3. Using a larger default namespace
  4. Increasing the pod restart backoff period

Explanation

Audit logging records who did what to the API server, and a policy focused on RBAC and privileged operations surfaces escalation attempts. This provides the evidence needed for detection and response.

Question 26Overview of Cloud Native Security

In the CNCF four-layer cloud native security model, which layer is primarily concerned with the configuration of the container runtime and the isolation primitives of the host operating system?

  1. The application layer
  2. The cluster layer
  3. The code layer
  4. The container layer Correct answer.

Explanation

The container layer covers the container runtime, image contents at runtime, and the host OS isolation primitives such as namespaces, cgroups, and seccomp profiles that constrain a running container. It sits between the cluster orchestration layer and the code/application layer, so runtime hardening and host configuration belong here.

Question 27Overview of Cloud Native Security

A platform team wants every new namespace to inherit a baseline set of controls, including a default deny network policy, resource quotas, and a restricted pod security profile. Which mechanism should they use to apply these automatically at namespace creation time?

  1. A validating admission webhook that rejects pods that do not declare the controls themselves
  2. A cluster autoscaler policy that schedules the controls onto new nodes
  3. A CronJob that scans for namespaces lacking the controls and patches them hourly
  4. A mutating admission webhook that watches Namespace creation events and creates the required objects Correct answer.

Explanation

A mutating admission webhook can intercept Namespace creation and create the accompanying NetworkPolicy, ResourceQuota, and Pod Security labels as part of the same request flow, so controls exist before workloads are admitted. This is the standard pattern for namespace-as-a-product templates and avoids a window where a namespace exists unprotected.

Question 28Overview of Cloud Native Security

A security review finds that a production cluster allows any authenticated user to create pods in the kube-system namespace, and several controllers there run with hostPath mounts. Which combination of controls most directly reduces the blast radius of this finding?

  1. Rotate the cluster certificate authority and require all users to re-authenticate
  2. Increase the number of control plane replicas and enable etcd encryption at rest
  3. Enable audit logging and forward events to a SIEM, then review the logs weekly
  4. Remove pod creation rights for non-system identities in kube-system and apply a restricted Pod Security Admission label to that namespace Correct answer.

Explanation

The finding combines excessive RBAC in a sensitive namespace with workloads that can mount host paths, so the direct fix is to remove the unnecessary create-pods permission and enforce a restricted Pod Security Admission level that blocks hostPath. Together these shrink both who can act in kube-system and what a pod there can do to the node.

Question 29Kubernetes Cluster Component Security

In a kubeadm-provisioned cluster, which component on a control plane node is responsible for watching the API server and evicting pods when node resources fall below configured thresholds?

  1. kube-controller-manager
  2. kubelet Correct answer.
  3. kube-scheduler
  4. kube-proxy

Explanation

The kubelet runs on every node, including control plane nodes, and performs node-pressure eviction when memory, disk, or PID thresholds are crossed. It also enforces pod resource limits and reports node status to the API server. The other components do not run on the node in this capacity.

Question 30Kubernetes Cluster Component Security

A kubelet is configured with `--anonymous-auth=false` and no webhook authentication. What is the effect on a request to the kubelet read-only port from an unauthenticated client?

  1. The request is forwarded to the API server for token review before being processed.
  2. The request is treated as anonymous system:unauthenticated and authorized by the kubelet's authorizer.
  3. The request is allowed because read-only endpoints bypass authentication.
  4. The request is rejected during authentication because anonymous access is disabled. Correct answer.

Explanation

Setting `--anonymous-auth=false` disables anonymous authentication on the kubelet, so unauthenticated requests fail at the authentication stage before authorization. In modern kubelets the read-only port is disabled by default, and even when enabled it does not bypass authentication. Webhook forwarding only occurs if webhook authentication is configured.

Question 31Kubernetes Cluster Component Security

Which etcd setting is most important for protecting the confidentiality of data at rest on the control plane node's disk?

  1. Setting `--peer-client-cert-auth=true`
  2. Configuring `--cipher-suites` for TLS handshakes
  3. Enabling `--auto-tls` for peer communication
  4. Enabling encryption at rest through the API server's EncryptionConfiguration Correct answer.

Explanation

etcd stores Kubernetes objects in plaintext on disk unless the API server encrypts them before writing. EncryptionConfiguration with aescbc or a KMS provider ensures Secret values are not readable from the etcd data directory. TLS settings protect data in transit, not data at rest.

Question 32Kubernetes Cluster Component Security

Which flag on kube-apiserver is required to enable audit logging for a cluster?

  1. `--enable-admission-plugins=Audit`
  2. `--authorization-mode=Audit`
  3. `--audit-policy-file` Correct answer.
  4. `--audit-log-path`

Explanation

Audit logging requires a policy file supplied via `--audit-policy-file`, which defines what events are recorded and at which level. The `--audit-log-path` flag is only meaningful once a policy is configured. There is no Audit admission plugin or Audit authorization mode.

Question 33Kubernetes Cluster Component Security

An operator wants to restrict which API server endpoints a service account can call, including the ability to list Secrets in a specific namespace. Which authorization mechanism should be used?

  1. Node authorization
  2. RBAC authorization Correct answer.
  3. Webhook authorization
  4. AlwaysAllow authorization

Explanation

RBAC lets administrators define Roles and RoleBindings that grant specific verbs on specific resources within namespaces, which is exactly what restricting list access to Secrets requires. Node authorization is scoped to kubelet identity, and AlwaysAllow grants everything. Webhook authorization delegates decisions to an external service.

Question 34Kubernetes Cluster Component Security

Which kube-controller-manager configuration is required for automated certificate rotation of kubelet client certificates?

  1. Configuring `--cluster-signing-cert-file` to the CA certificate
  2. Enabling the `csrsigning` and `csrapproving` controllers and configuring the kubelet with `--rotate-certificates` Correct answer.
  3. Setting `--use-service-account-credentials=true`
  4. Setting `--terminated-pod-gc-threshold` to a nonzero value

Explanation

Certificate rotation requires the kubelet to request new certificates with `--rotate-certificates`, and the control plane must sign and approve those CSRs. The csrsigning and csrapproving controllers in kube-controller-manager provide those capabilities. The signing certificate file must also be configured, but that alone is not sufficient.

Question 35Kubernetes Cluster Component Security

Which component in a control plane node is responsible for the default service account token signing and validation?

  1. kubelet
  2. kube-apiserver Correct answer.
  3. kube-scheduler
  4. kube-proxy

Explanation

The kube-apiserver issues and validates service account tokens, including projected tokens, using the configured service account key or OIDC issuer settings. It also hosts the TokenRequest API. The kubelet and kube-proxy consume tokens but do not sign them.

Question 36Kubernetes Cluster Component Security

A cluster's kube-apiserver is started with `--authorization-mode=Node,RBAC`. What is the practical effect of listing Node before RBAC?

  1. The API server refuses to start because the modes conflict.
  2. RBAC is ignored and only Node authorization is evaluated.
  3. Requests are evaluated by RBAC first, then Node authorization.
  4. Requests are evaluated by Node authorization first, then by RBAC if Node does not decide. Correct answer.

Explanation

Authorization modes are evaluated in the order listed, and the first mode that explicitly allows or denies a request determines the outcome. Listing Node before RBAC means kubelet requests are handled by Node authorization first, and other requests fall through to RBAC. This is the recommended ordering for clusters using Node authorization.

Question 37Kubernetes Cluster Component Security

Which admission controller should be enabled to prevent pods from being scheduled into namespaces without a Pod Security Admission label?

  1. NodeRestriction
  2. LimitRanger
  3. ServiceAccount
  4. PodSecurity Correct answer.

Explanation

The PodSecurity admission controller enforces Pod Security Standards based on namespace labels such as pod-security.kubernetes.io/enforce. Without such a label, namespaces are treated as privileged by default unless cluster-level defaults are configured. The other controllers address unrelated concerns.

Question 38Kubernetes Cluster Component Security

Which flag on kube-apiserver restricts which nodes can modify pods and node objects through the API?

  1. `--authorization-mode=Node`
  2. `--admission-control-config-file`
  3. `--enable-admission-plugins=NodeRestriction` Correct answer.
  4. `--service-account-issuer`

Explanation

The NodeRestriction admission plugin limits a kubelet's ability to modify Node and Pod objects to those associated with its own node. It complements Node authorization and is strongly recommended in any cluster using kubelets. The other flags address different concerns.

Question 39Kubernetes Cluster Component Security

Which etcd security control ensures that only the correct peer can join the cluster during member addition?

  1. Setting `--enable-v2=true`
  2. Setting `--peer-client-cert-auth=true` Correct answer.
  3. Setting `--client-cert-auth=true`
  4. Configuring `--listen-client-urls` to localhost only

Explanation

Peer client certificate authentication requires every peer connection to present a valid certificate signed by the trusted CA. This prevents unauthorized nodes from joining the cluster and reading replicated data. Client certificate auth protects client connections, not peer connections.

Question 40Kubernetes Cluster Component Security

Which of the following best describes the role of the kube-controller-manager's service account controller?

  1. It approves certificate signing requests from kubelets.
  2. It signs service account tokens for all namespaces.
  3. It creates a default service account in each new namespace. Correct answer.
  4. It rotates the CA certificate used to sign kubelet certificates.

Explanation

The service account controller ensures that a default service account exists in every namespace so pods can be created even when no service account is specified. It does not issue tokens; the API server does that. Certificate signing and CSR approval are handled by other controllers.

Question 41Kubernetes Cluster Component Security

A cluster uses kubeadm with the default configuration, and the kubelet is started without the `--config` file but with `--anonymous-auth=true` and `--authorization-mode=AlwaysAllow`. What is the primary security risk?

  1. Any client that can reach the kubelet can execute commands in pods and read logs. Correct answer.
  2. Service account tokens will be rejected by the API server.
  3. Pods will be scheduled without resource limits.
  4. etcd will accept unauthenticated client connections.

Explanation

Anonymous authentication combined with AlwaysAllow means any client with network access to the kubelet can use its API, including exec and log endpoints. This is a critical exposure and is why modern kubeadm configurations default to webhook authentication and authorization. The other options describe unrelated effects.

Question 42Kubernetes Cluster Component Security

Which of the following is a security consequence of leaving the kube-apiserver's `--insecure-port` (deprecated and removed in modern versions) enabled in older clusters?

  1. Requests to that port are authenticated but not authorized.
  2. Requests to that port are encrypted but not authenticated.
  3. Requests to that port are authenticated using client certificates.
  4. Requests to that port are unauthenticated and unencrypted. Correct answer.

Explanation

The insecure port served plain HTTP without authentication, so any client with network access could issue API requests. It was removed in Kubernetes 1.20 and should never be enabled. The secure port requires TLS and authentication.

Question 43Kubernetes Cluster Component Security

Which flag should be set on the kube-apiserver to ensure that it connects to etcd using a client certificate and trusted CA?

  1. `--client-ca-file`
  2. `--etcd-certfile`, `--etcd-keyfile`, and `--etcd-cafile` Correct answer.
  3. `--tls-cert-file` and `--tls-private-key-file`
  4. `--etcd-servers` only

Explanation

The `--etcd-certfile`, `--etcd-keyfile`, and `--etcd-cafile` flags configure the client certificate and trusted CA the API server uses to authenticate to etcd. Without them, the connection may be unauthenticated or fail if etcd requires client certificates. The other flags configure API server identity or client trust for its own clients.

Question 44Kubernetes Cluster Component Security

Which of the following is the strongest reason to disable the kubelet's read-only port in a production cluster?

  1. It prevents the kubelet from registering with the API server.
  2. It exposes pod metadata and health information without authentication. Correct answer.
  3. It prevents the scheduler from binding pods to the node.
  4. It blocks the kubelet from mounting secrets into pods.

Explanation

The read-only port historically served endpoints such as `/pods` and `/healthz` without authentication, leaking pod metadata and configuration. Disabling it removes an unauthenticated attack surface. The other options describe kubelet functions unrelated to that port.

Question 45Kubernetes Cluster Component Security

Which admission controller must be enabled to enforce that pods reference an existing service account and to inject the projected token volume?

  1. ServiceAccount Correct answer.
  2. NodeRestriction
  3. ResourceQuota
  4. PodSecurity

Explanation

The ServiceAccount admission controller sets the pod's service account to default when unspecified and injects the projected service account token volume. It also rejects pods that reference nonexistent service accounts. The other controllers perform unrelated admission checks.

Question 46Kubernetes Cluster Component Security

An operator wants to ensure the kube-apiserver only accepts TLS connections using strong cipher suites. Which flag controls this?

  1. `--secure-port`
  2. `--cipher-suites` Correct answer.
  3. `--tls-min-version`
  4. `--kubelet-client-certificate`

Explanation

The `--cipher-suites` flag lists the TLS cipher suites the API server will accept, allowing administrators to remove weak suites. `--tls-min-version` sets the minimum protocol version and complements this control. The other flags configure client credentials or the listening port.

Question 47Kubernetes Cluster Component Security

Which of the following is a valid reason that a kubelet might fail to start after a cluster upgrade?

  1. The etcd cluster lost quorum.
  2. The scheduler was restarted before the kubelet.
  3. The kube-proxy Service CIDR was changed.
  4. The kubelet configuration file uses a removed or renamed field. Correct answer.

Explanation

KubeletConfiguration has versioned fields that may be deprecated or removed across releases, so an outdated config file can cause the kubelet to fail validation and exit. Upgrades require reviewing the config against the target version. The other scenarios affect other components or cause broader failures.

Question 48Kubernetes Cluster Component Security

Which etcd security control prevents an attacker who has obtained the etcd data directory from reading Secret values?

  1. Setting `--client-cert-auth=true`
  2. Configuring API server encryption at rest Correct answer.
  3. Enabling the v2 API
  4. Enabling peer TLS

Explanation

API server encryption at rest encrypts Secret values before they are written to etcd, so copies of the data directory do not reveal plaintext. TLS settings protect network traffic but not stored data. The v2 API toggle is unrelated to confidentiality.

Question 49Kubernetes Cluster Component Security

Which flag on kube-controller-manager enables the use of distinct service account credentials for each controller loop?

  1. `--root-ca-file`
  2. `--use-service-account-credentials=true` Correct answer.
  3. `--cluster-signing-duration`
  4. `--service-account-private-key-file`

Explanation

Setting `--use-service-account-credentials=true` makes each controller use its own service account and RBAC permissions instead of the shared controller-manager credentials. This reduces the blast radius of a compromised controller. The other flags configure trust or signing material.

Question 50Kubernetes Cluster Component Security

Which of the following is the recommended way to bind a workload to a specific service account with minimal permissions?

  1. Use the default service account and grant it cluster-admin.
  2. Use the kubelet's client certificate as the pod's credential.
  3. Create a ClusterRoleBinding to system:authenticated.
  4. Create a dedicated service account and bind a Role with only the required verbs. Correct answer.

Explanation

Least privilege requires a dedicated service account bound to a Role that grants only the verbs and resources the workload needs. The default service account with elevated permissions or broad bindings such as system:authenticated violate least privilege. Pods should never use kubelet credentials.