Free KCSA Sample Questions

Correct. The kubelet read-only port (default 10255) serves metrics and pod information without authentication, allowing any network-accessible client to gather intelligence about running pods and nodes.

Incorrect. The read-only port does not affect etcd encryption settings.

Incorrect. The read-only port allows authorized reading, but the security issue is lack of authentication.

Incorrect. The read-only port does not directly relate to log encryption.

Incorrect. Both RBAC and ABAC operate after authentication.

Incorrect. RBAC is the standard; ABAC is rarely used in production due to complexity.

Correct. RBAC abstracts permissions into reusable roles (ClusterRole, Role) and bindings, making policies easier to understand and maintain at scale compared to ABAC's attribute-based matching.

Incorrect. Performance differences between RBAC and ABAC are negligible; RBAC is favored for manageability.

Incorrect. Certificate authentication for kubelets does not sign container images.

Incorrect. Kubelet client certificates do not encrypt etcd storage.

Incorrect. Kubelet certificates authenticate components to each other, not end users.

Correct. Kubelet client certificate authentication ensures that only authorized components (like the API server) can communicate with the kubelet, preventing spoofed requests.

Incorrect. Secrets are not automatically deleted due to communication encryption issues.

Correct. Without mutual TLS between etcd peers, attackers on the network can intercept cluster state data, potentially leading to compromise of all cluster resources.

Incorrect. While etcd unavailability would stop the cluster, unencrypted communication doesn't make the API server read-only.

Incorrect. Etcd peer communication issues would affect the entire cluster, not pod scheduling individually.

Incorrect. kube-proxy does not encrypt pod-to-pod communication; that requires a service mesh or NetworkPolicies.

Correct. kube-proxy creates and maintains network rules (via iptables, IPVS, or other mechanisms) to route traffic to Services, making it critical for proper network isolation and traffic control.

Incorrect. Authentication and authorization are the API server's responsibility.

Incorrect. While kube-proxy is involved in routing, it is not specifically an HTTP proxy.

Incorrect. Container runtime communication is configured separately from TLS bootstrapping.

Correct. TLS bootstrapping allows new nodes to join the cluster securely by using a bootstrap token to request a client certificate from the CA, eliminating the need to pre-distribute credentials.

Incorrect. Cluster autoscaling uses different mechanisms than TLS bootstrapping.

Incorrect. SSH authentication is a separate concern from kubelet certificate provisioning.

Incorrect. Container runtime access does not prevent API server authentication.

Incorrect. Secrets exposure in logs is a separate concern from container runtime access.

Correct. The container runtime is a critical security boundary. Unrestricted access allows bypassing Kubernetes security controls to run arbitrary containers with escalated privileges.

Incorrect. Container runtime access does not affect etcd encryption.

Correct. An unauthenticated kubelet API allows remote code execution, container escape, and data exfiltration from pods.

Incorrect. Token management is the responsibility of the API server, not the kubelet.

Incorrect. Admission webhooks are configured in the API server, not the kubelet.

Incorrect. The control plane configuration is protected by the API server, not the kubelet.

Incorrect. Kubelet authorization does not control image registry access.

Incorrect. Kubelet authorization does not handle Secret encryption.

Incorrect. Kubelet authorization does not control pod networking.

Correct. Kubelet authorization enforces which API operations (like pod creation, log access, exec) are allowed, preventing privilege escalation and lateral movement.

Incorrect. The read-only port does not affect network policy enforcement.

Incorrect. The read-only port does not permit modifications; it is read-only.

Incorrect. While reconnaissance can lead to privilege escalation, the port itself does not directly enable it.

Correct. The unauthenticated read-only port exposes sensitive information like running pods, their configuration, and node details, which attackers can use for reconnaissance.