300+ exam grade questions across every domain, powered by AI assisted learning that gives you instant feedback and a clear explanation on every question.
The cloud native security model is often described using the 4Cs. Which of the following is the correct list of these four layers?
Pick an answer to reveal the explanation.
The 4Cs of cloud native security are Code, Container, Cluster, and Cloud. Each layer builds on the security of the layer below: Code is the innermost layer (application security), surrounded by Container, then Cluster, with Cloud (or corporate datacenter) as the outermost layer.
A team wants to ensure that only signed container images from a trusted registry can be deployed to its Kubernetes cluster. Which approach is most appropriate?
Pick an answer to reveal the explanation.
Signing images (with tools such as Sigstore or Cosign) and configuring an admission controller (like Kyverno, OPA Gatekeeper, or the Connaisseur webhook) to verify signatures before scheduling provides strong supply chain assurance. Public registries without verification, renaming, and verbose logging do not provide cryptographic proof of image origin.
Which artifact in a cloud native build pipeline lists every software component, version, and license used by an application, enabling vulnerability tracking across the supply chain?
Pick an answer to reveal the explanation.
A Software Bill of Materials (SBOM) is a machine readable inventory of every software component, version, and license shipped with an artifact. SBOMs (in formats like SPDX or CycloneDX) are the foundation of modern supply chain security and vulnerability management workflows.
What is the recommended approach for authenticating end users to the Kubernetes API server in a production cluster?
Pick an answer to reveal the explanation.
Production Kubernetes clusters should federate identity with an external provider via OIDC (or a vendor-managed equivalent) so user identities are centrally managed, MFA can be enforced, and RBAC roles can be bound to enterprise groups. Sharing kubeconfigs, using static passwords, and disabling authentication are all serious anti-patterns.
Why is securing access to etcd critical for Kubernetes cluster security?
Pick an answer to reveal the explanation.
etcd is the key value store that contains the entire Kubernetes cluster state, including Secrets. Without encryption at rest configured, secret data is stored unencrypted. Anyone with read access to etcd effectively has cluster admin privileges. Container images live in registries, networking is handled by the CNI, and scheduling is done by kube-scheduler.
A security review finds that the kubelet on a worker node is exposing its API on port 10250 with anonymous authentication enabled. What is the most appropriate remediation?
Pick an answer to reveal the explanation.
Anonymous access to the kubelet API allows attackers to execute commands inside Pods and exfiltrate data. The correct hardening is to set --anonymous-auth=false, require authenticated access (TLS client certificates or webhook tokens), and limit authorization with --authorization-mode=Webhook. Blocking the node breaks legitimate traffic, port changes are not a security control, and deleting the node is not a remediation.
Which Kubernetes API server flag should be enabled to record API requests and responses for security and compliance auditing?
Pick an answer to reveal the explanation.
Enabling --audit-log-path together with an audit policy file via --audit-policy-file turns on Kubernetes audit logging, recording requests made to the API server. This is a foundational compliance and security control. The other flags configure unrelated cluster behaviors.
Which container runtime supports stronger workload isolation by running each container in a lightweight micro-VM, providing a security boundary at the hypervisor level?
Pick an answer to reveal the explanation.
Kata Containers runs each container in a lightweight VM (using QEMU or Firecracker) so workloads are isolated by a hypervisor boundary rather than only the Linux kernel. runc and CRI-O rely on the shared host kernel, and containerd is a higher level CRI runtime that typically uses runc by default.
Which Kubernetes object grants a set of permissions to a user, group, or service account within a single namespace?
Pick an answer to reveal the explanation.
A Role grants a set of permissions within a single namespace. A ClusterRole grants permissions cluster wide. RoleBindings and ClusterRoleBindings tie roles to subjects (users, groups, or service accounts). PodSecurityPolicy is deprecated, and NetworkPolicy controls Pod traffic, not API access.
A workload running in a Pod needs to call the Kubernetes API. What identity does the workload use by default to authenticate?
Pick an answer to reveal the explanation.
Pods authenticate to the Kubernetes API using a ServiceAccount. A projected ServiceAccount token is automatically mounted at /var/run/secrets/kubernetes.io/serviceaccount/token by default, and the API server validates that token. Node IAM applies to cloud provider APIs, cluster admin should never be used by workloads, and the API server always authenticates requests.
What is the default Pod-to-Pod network behavior in a brand new Kubernetes cluster with no NetworkPolicies applied?
Pick an answer to reveal the explanation.
By default, Kubernetes implements a flat, fully-open Pod network. Any Pod can reach any other Pod, regardless of namespace. NetworkPolicies (enforced by a CNI plugin like Calico or Cilium) are required to restrict that traffic. RBAC controls API access, not Pod-to-Pod traffic.
A platform team wants to block the deployment of privileged containers and host network mounts across all namespaces. Which Kubernetes feature enforces this natively in modern clusters?
Pick an answer to reveal the explanation.
Pod Security Admission (PSA) replaced the deprecated PodSecurityPolicy in Kubernetes 1.25. PSA enforces one of three built-in profiles (privileged, baseline, restricted) per namespace via labels. The "restricted" profile blocks privileged containers, host networking, host paths, and other dangerous Pod fields. NetworkPolicy controls traffic, ResourceQuota controls resource consumption.
A developer commits a Kubernetes Secret manifest to a public Git repository. The manifest contains a database password in the "data" field, base64 encoded. What is the security risk?
Pick an answer to reveal the explanation.
base64 encoding is reversible and provides no confidentiality. Anything stored in a Kubernetes Secret manifest is effectively clear text once base64 decoded. Production patterns include sealed-secrets, external secret managers (AWS Secrets Manager, HashiCorp Vault), or Kubernetes Secret encryption at rest combined with strict RBAC and Git scanning.
An attacker compromises a Pod and wants to maintain persistent access to the cluster even if the Pod is restarted. Which Kubernetes object would the attacker most likely abuse?
Pick an answer to reveal the explanation.
A CronJob runs on a recurring schedule and can launch new Pods automatically, making it a classic persistence mechanism. Other persistence techniques include malicious admission webhooks, controllers that recreate compromised workloads, and bound service account tokens with long lifetimes. ConfigMaps, Services, and PriorityClasses are not directly used for persistence.
Which Linux capability, if granted to a container, most directly increases the risk of a container escape to the host?
Pick an answer to reveal the explanation.
SYS_ADMIN is the most powerful Linux capability and effectively grants root-like privileges, enabling many container escape techniques (mounting host filesystems, manipulating namespaces, loading kernel modules). Production workloads should never run with SYS_ADMIN unless absolutely required. The other capabilities are more narrowly scoped.
A workload is repeatedly evicted because other Pods on the Node consume all available memory. Which Kubernetes feature would best prevent this denial-of-service condition?
Pick an answer to reveal the explanation.
ResourceQuota at the namespace level caps total resource consumption, LimitRange enforces sensible defaults, and individual Pod requests and limits guarantee minimums and cap maximums. Together they prevent a single workload from exhausting Node memory and causing eviction of others. PodDisruptionBudget protects voluntary disruptions, NetworkPolicy is unrelated, and HPA scales replicas (which can make the problem worse if limits are missing).
Which open source project provides workload identity, mutual TLS (mTLS), and authorization policies between services in a Kubernetes cluster through transparent sidecar proxies?
Pick an answer to reveal the explanation.
Istio is a service mesh that injects Envoy sidecar proxies next to application containers to provide mTLS between services, workload identity, traffic management, and authorization policies. Prometheus collects metrics, Helm packages applications, and CoreDNS serves cluster DNS.
A company runs Kubernetes clusters in multiple cloud regions and needs to enforce identity-aware service-to-service authorization, even when traffic crosses region boundaries. Which approach is most aligned with zero-trust principles?
Pick an answer to reveal the explanation.
Zero trust assumes there is no implicit internal trust zone. Workload identity frameworks like SPIFFE/SPIRE issue cryptographic identities to services, and service meshes (Istio, Linkerd) or sidecars enforce mTLS plus identity-aware authorization on every request, regardless of network location. The other options either rely on perimeter trust or remove a security control.
Which industry-standard benchmark provides prescriptive guidance for hardening a Kubernetes cluster and is commonly checked using tools like kube-bench?
Pick an answer to reveal the explanation.
The CIS Kubernetes Benchmark, published by the Center for Internet Security, provides prescriptive configuration checks for the API server, controller-manager, scheduler, kubelet, etcd, and other components. kube-bench is the popular open source tool that automates these checks. NIST SP 800-53 and ISO 27001 are broader frameworks, and SOC 2 is an audit framework that does not provide Kubernetes-specific configuration guidance.
A platform team needs to detect known vulnerabilities in container images before they are deployed to the cluster. Which open source tool is most commonly used for this in cloud native workflows?
Pick an answer to reveal the explanation.
Trivy is a widely used open source vulnerability scanner from Aqua Security that scans container images, filesystems, and infrastructure as code for known CVEs and misconfigurations. cert-manager handles TLS certificate lifecycle, Argo CD is a GitOps continuous delivery tool, and KubeVirt runs VMs inside Kubernetes.
The KCSA is a Linux Foundation associate-level certification administered by the Cloud Native Computing Foundation (CNCF) that validates foundational knowledge of Kubernetes and cloud native security. It is designed for security engineers, platform engineers, and DevOps practitioners who want to demonstrate a baseline understanding of attack surfaces, hardening practices, and security tooling across the cloud native stack.
The KCSA exam consists of 60 multiple choice questions delivered over 90 minutes through an online proctored environment. Unlike the hands-on Certified Kubernetes Security Specialist (CKS) exam, KCSA is fully knowledge based, which makes it accessible to candidates who want to validate security understanding before attempting performance-based exams.
The KCSA exam requires a score of 75% or higher to pass. The score is calculated automatically based on the percentage of correct answers, and the result is delivered within 24 hours of completing the exam. KCSA shares this 75% threshold with the other Linux Foundation associate certifications.
The exam is organized into six domains: Overview of Cloud Native Security (14%), Kubernetes Cluster Component Security (22%), Kubernetes Security Fundamentals (22%), Kubernetes Threat Model (16%), Platform Security (16%), and Compliance and Security Frameworks (10%). Core concepts include the 4Cs of cloud native security, Pod Security Admission, RBAC, NetworkPolicy, supply chain security, the CIS Kubernetes Benchmark, and service mesh patterns.
Yes. KCSA is positioned as the entry-level Kubernetes security certification and is a sensible stepping stone before attempting the hands-on Certified Kubernetes Security Specialist (CKS) exam. Candidates with a few months of Kubernetes exposure typically pass with three to four weeks of focused study using realistic mock exams and the official Cloud Native Security Whitepaper.
The KCSA exam costs USD 250 and includes one free retake within twelve months of the initial purchase. The Linux Foundation regularly runs discount campaigns around KubeCon and Cyber Monday that significantly reduce the cost.
Start by reading the official KCSA curriculum on the Linux Foundation site and the CNCF Cloud Native Security Whitepaper. Work through the free CNCF "Introduction to Kubernetes" (LFS158) course on edX, then drill the six domains using realistic mock exams that mirror the real test interface. Pay particular attention to the 4Cs framework, RBAC, Pod Security Admission, NetworkPolicy, and the CIS Kubernetes Benchmark.