Free KCSA Mock Exam Sample Questions

Correct. The kubelet read-only port (default 10255) serves metrics and pod information without authentication, allowing any network-accessible client to gather intelligence about running pods and nodes.

Incorrect. The read-only port does not affect etcd encryption settings.

Incorrect. The read-only port allows authorized reading, but the security issue is lack of authentication.

Incorrect. The read-only port does not directly relate to log encryption.

Incorrect. Both RBAC and ABAC operate after authentication.

Incorrect. RBAC is the standard; ABAC is rarely used in production due to complexity.

Correct. RBAC abstracts permissions into reusable roles (ClusterRole, Role) and bindings, making policies easier to understand and maintain at scale compared to ABAC's attribute-based matching.

Incorrect. Performance differences between RBAC and ABAC are negligible; RBAC is favored for manageability.

Incorrect. Image signing is handled by supply-chain tooling such as Cosign at build/registry time; certificate-based authentication between the API server and kubelet never signs the images the kubelet pulls.

Incorrect. Encrypting data at rest in etcd is configured via an EncryptionConfiguration on the API server, not by certificate authentication on the kubelet endpoint.

Incorrect. End-user authentication to the API server relies on mechanisms like OIDC, bearer tokens, or user client certificates, which are unrelated to the API-server-to-kubelet trust relationship.

Correct. The API server presents a client certificate (configured via `--kubelet-client-certificate`) so the kubelet, with its `--authentication` settings, can verify that incoming requests originate from the legitimate API server and reject spoofed callers.

Incorrect. Secrets are not automatically deleted due to communication encryption issues.

Correct. Without mutual TLS between etcd peers, attackers on the network can intercept cluster state data, potentially leading to compromise of all cluster resources.

Incorrect. While etcd unavailability would stop the cluster, unencrypted communication doesn't make the API server read-only.

Incorrect. Etcd peer communication issues would affect the entire cluster, not pod scheduling individually.

Incorrect. kube-proxy does not encrypt pod-to-pod communication; that requires a service mesh or NetworkPolicies.

Correct. kube-proxy creates and maintains network rules (via iptables, IPVS, or other mechanisms) to route traffic to Services, making it critical for proper network isolation and traffic control.

Incorrect. Authentication and authorization are the API server's responsibility.

Incorrect. While kube-proxy is involved in routing, it is not specifically an HTTP proxy.

Incorrect. Container runtime communication is configured separately from TLS bootstrapping.

Correct. TLS bootstrapping allows new nodes to join the cluster securely by using a bootstrap token to request a client certificate from the CA, eliminating the need to pre-distribute credentials.

Incorrect. Cluster autoscaling uses different mechanisms than TLS bootstrapping.

Incorrect. SSH authentication is a separate concern from kubelet certificate provisioning.

Incorrect. Container runtime access does not prevent API server authentication.

Incorrect. Secrets exposure in logs is a separate concern from container runtime access.

Correct. The container runtime is a critical security boundary. Unrestricted access allows bypassing Kubernetes security controls to run arbitrary containers with escalated privileges.

Incorrect. Container runtime access does not affect etcd encryption.

Correct. An unauthenticated kubelet API (port 10250) exposes /exec, /run, /attach, and /logs, enabling remote command execution inside running pods, log access, and data exfiltration; this escalates to host compromise (container escape) only if a targeted pod is already privileged or mounts host paths.

Incorrect. Token issuance and revocation are handled by the API server and its authentication layer, not by the kubelet on port 10250.

Incorrect. ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects live in the API server's configuration, so they cannot be altered through the kubelet API.

Incorrect. Control plane configuration is owned by the API server and etcd, which are not reachable through the kubelet endpoint on port 10250.

Incorrect. Kubelet authorization does not control image registry access.

Incorrect. Kubelet authorization does not handle Secret encryption.

Incorrect. Kubelet authorization does not control pod networking.

Correct. Kubelet authorization enforces which API operations (like pod creation, log access, exec) are allowed, preventing privilege escalation and lateral movement.

Incorrect. The read-only port does not affect network policy enforcement.

Incorrect. The read-only port does not permit modifications; it is read-only.

Incorrect. While reconnaissance can lead to privilege escalation, the port itself does not directly enable it.

Correct. The unauthenticated read-only port exposes sensitive information like running pods, their configuration, and node details, which attackers can use for reconnaissance.