Practice Exam KCSA: Kubernetes and Cloud Native Security Associate

Question bank: 109 · timed mock exam: 90 min

Official exam page on the vendor's site (opens in a new tab) Official exam guide (opens in a new tab)

Compare: KCNA vs KCSA

  • Kubernetes Cluster Component Security 24 questions
  • Kubernetes Security Fundamentals 20 questions
  • Kubernetes Threat Model 20 questions
  • Platform Security 19 questions
  • Overview of Cloud Native Security 13 questions
  • Compliance and Security Frameworks 13 questions
Study mode (free) Exam mode (subscribers)

Free: 25 questions in study mode, all domains, no account.

Subscription: the 109 questions of this certification, the timed exam mode, and all other certifications too.

Subscribe · €9.99 / month

Secure card payment (Stripe) · No commitment · Cancel online

How to prepare for Kubernetes and Cloud Native Security Associate with InfraPrep

The 109 questions cover 6 domains: Kubernetes Cluster Component Security, Kubernetes Security Fundamentals, Kubernetes Threat Model, Platform Security, Overview of Cloud Native Security, Compliance and Security Frameworks. 25 of them are free, without an account.

Study mode

Answer at your pace: each answer is corrected straight away, with an explanation and the link to the documentation it relies on.

Exam mode

A timed exam of 90 minutes, with a question map to flag and come back to questions before you submit.

Results by domain

Your score is broken down by domain, so you know what to review first.

Original questions

Every question is written from the public documentation, never copied from the exam. You can contest an answer from study mode.

10 free sample questions

Question 1 Overview of Cloud Native Security

A security architect presents the CNCF Cloud Native Security Whitepaper (v2) to a new team. The whitepaper organises its guidance around lifecycle phases, but a footnote names another layered model, with a link to the Kubernetes documentation, that the team can also use to structure its controls. Which four layers make up that other model?

  1. IaaS, PaaS, CaaS and FaaS
  2. Develop, Distribute, Deploy and Runtime
  3. Cloud, Clusters, Containers and Code
  4. Foundational layer, application lifecycle, runtime environment and network
Show the answer and the explanation

Correct answer: C

The whitepaper explicitly names the other model to consider as Cloud, Clusters, Containers, and Code.

Source: official documentation

Question 2 Kubernetes Cluster Component Security

A user runs kubectl get secrets -n payments against the API server. The TLS connection succeeds and the user's client certificate is valid, but this read request fails with HTTP status code 403. At which stage of API request processing was the request rejected?

  1. Transport security, because the API server certificate is signed by a private CA
  2. Authorization, because every configured authorization module denied the request
  3. Admission control, because a validating admission controller rejected the request
  4. Authentication, because the certificate was not accepted by any authenticator
Show the answer and the explanation

Correct answer: B

When all configured authorization modules deny a request, it is denied with HTTP status code 403.

Source: official documentation

Question 3 Kubernetes Security Fundamentals

A namespace moves from the Privileged to the Baseline Pod Security Standard. Which of the following Pods is disallowed by the Baseline policy?

  1. A Pod that mounts a hostPath volume
  2. A Pod with no seccomp profile set
  3. A Pod whose container adds the NET_BIND_SERVICE capability
  4. A Pod whose container image runs as the root user, with no securityContext set
Show the answer and the explanation

Correct answer: A

The Baseline policy states that HostPath volumes must be forbidden.

Source: official documentation

Question 4 Overview of Cloud Native Security

A company runs Kubernetes on virtual machines from a public cloud provider. A penetration test shows that a pod can query the provider's instance metadata service and read the node's cloud credentials. The provisioning scripts also pass a database password through the instance provisioning data. Which set of measures follows the Kubernetes guidance for this situation?

  1. Enable encryption at rest for Secrets in etcd, which prevents pods from reading the node credentials exposed by the metadata service
  2. Limit the permissions given to the instance credentials, use network policies to restrict pod access to the metadata API, and stop using provisioning data to deliver secrets
  3. Rely on RBAC: remove the get permission on Secrets from all service accounts, which also blocks the metadata service
  4. Keep the metadata service reachable, but move the database password into the instance provisioning data of every node so that pods no longer need a Secret
Show the answer and the explanation

Correct answer: B

The metadata service is reachable by pods by default and can expose node credentials; the documented response is to limit instance credential permissions, restrict pod access to the metadata API with network policies and avoid delivering secrets through provisioning data.

Source: official documentation

Question 5 Kubernetes Cluster Component Security

To protect the Secrets of a namespace, an administrator deploys a validating admission controller that rejects any request involving Secrets from users outside the security team. After deployment, other users can no longer create or modify Secrets, but they can still list and read them with kubectl get. What explains this behaviour?

  1. Admission controllers do not act on requests that merely read objects, so reads must be restricted with authorization, for example RBAC
  2. The admission controller only applies to requests sent through the kubelet API
  3. Another admission controller allowed the request, and a request passes admission as soon as one controller accepts it
  4. Admission control runs before authentication, so the controller cannot know which user sent a read request
Show the answer and the explanation

Correct answer: A

Admission controllers act on requests that create, modify, delete or proxy to an object, and not on requests that merely read objects; read access must be controlled at the authorization stage.

Source: official documentation

Question 6 Kubernetes Security Fundamentals

A Linux Pod is rejected in a namespace that enforces the Restricted Pod Security Standard. Its container sets runAsNonRoot: true, allowPrivilegeEscalation: false and drops ALL capabilities. No seccomp profile is set anywhere in the Pod. Which change makes the Pod compliant?

  1. Add the NET_BIND_SERVICE capability back to the container
  2. Nothing: the Restricted policy does not check seccomp on Linux
  3. Explicitly set the seccomp profile type to RuntimeDefault (or Localhost)
  4. Explicitly set the seccomp profile type to Unconfined
Show the answer and the explanation

Correct answer: C

The Restricted policy requires the seccomp profile to be explicitly set to an allowed value; both Unconfined and the absence of a profile are prohibited, and RuntimeDefault or Localhost are allowed.

Source: official documentation

Question 7 Overview of Cloud Native Security

A platform team maps its security controls to the four cloud native lifecycle phases described in the Kubernetes documentation. Its CI pipeline already signs every container image when the image is published. The team now wants to make sure that only images whose cryptographic identity has been verified can be deployed to production. In which lifecycle phase does this verification control belong?

  1. Distribute, because the verification must happen at the same time as the signing
  2. Runtime, whose access area covers verifying image signatures before containers start
  3. Deploy, which restricts what can be deployed, who can deploy it and where, and can enforce measures from the distribute phase
  4. Develop, because image signing is part of writing the application code
Show the answer and the explanation

Correct answer: C

The Deploy phase ensures appropriate restrictions on what can be deployed, and it is where measures from the distribute phase, such as verifying the cryptographic identity of image artifacts, are enforced.

Source: official documentation

Question 8 Kubernetes Cluster Component Security

A security review of a self-managed control plane finds that kube-controller-manager runs all of its control loops with a single credential, which therefore holds every permission needed by every controller. The team wants each built-in controller to use its own identity with its own RBAC role. Which kube-controller-manager setting achieves this?

  1. --service-account-private-key-file, pointing to a new signing key
  2. --root-ca-file, pointing to the cluster CA bundle
  3. --controllers=-*, to disable all built-in controllers
  4. --use-service-account-credentials
Show the answer and the explanation

Correct answer: D

With --use-service-account-credentials, kube-controller-manager starts each controller using a separate service account, and matching system:controller: roles exist for each built-in controller.

Source: official documentation

Question 9 Kubernetes Security Fundamentals

A namespace carries the label pod-security.kubernetes.io/enforce: restricted and no other Pod Security label. A developer applies a Deployment whose Pod template runs a privileged container. The Deployment object is created successfully, but no Pod ever starts. What explains this behaviour?

  1. The enforce label is ignored until the matching enforce-version label is also set
  2. Enforce mode is not applied to workload resources, only to the resulting Pod objects, so the Pods created from the template are rejected
  3. Pod Security Admission only evaluates Pods when they are updated, not when they are created
  4. The Deployment was exempted because its controller service account is exempt by default
Show the answer and the explanation

Correct answer: B

Enforce mode applies only to the Pod objects that the workload controller creates, not to the Deployment itself; the controller's Pod creation requests are rejected, so no Pod starts.

Source: official documentation

Question 10 Overview of Cloud Native Security

A SaaS vendor hosts a content management system for many customers on one shared Kubernetes cluster. Customers can upload and run their own scripts, so the vendor must assume that some workloads are malicious and wants to protect the host against container escapes. Which isolation technique does the Kubernetes multi-tenancy guidance recommend for this case?

  1. A single hardened seccomp, AppArmor and SELinux rule set applied identically to every customer workload
  2. Sandboxing, which runs each pod in a separate execution environment such as a virtual machine or a userspace kernel
  3. A per-tenant virtual control plane, which isolates the worker nodes of each tenant
  4. One namespace per customer with a default-deny NetworkPolicy, which gives each customer its own kernel
Show the answer and the explanation

Correct answer: B

Sandboxing is often recommended when running untrusted code that is assumed to be malicious, because containers share the host kernel; a sandbox helps insulate the host from container escapes.

Source: official documentation

Frequently asked questions

Are there free questions, and do I need an account?

Yes. 25 questions of this certification are free in study mode, across all its domains, without a subscription and without registration. The account is created when you subscribe, at checkout.

How does the subscription work, and can I cancel?

One monthly subscription covers all certifications and the timed practice exams. There is no minimum period. You cancel online, at any time, with the "Cancel your contract" function in My account; cancellation takes effect at the end of the month already paid, and no further payment is taken.

Where do the questions come from?

Every question is original, written from the vendor's public documentation. Each answer comes with an explanation and a link to the documentation page it relies on. InfraPrep is not affiliated with the vendors, and certification names belong to their owners.

In which language are the questions?

The questions are written in English, also on the French version of the site.

Is the catalog updated?

Yes, the catalog changes over time: new certifications and new questions are added.