New VCE4Dumps KCSA Exam Questions| Real KCSA Dumps Updated on Mar 06, 2026
KCSA Braindumps – KCSA Questions to Get Better Grades
Linux Foundation KCSA Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
NEW QUESTION # 31
Which other controllers are part of the kube-controller-manager inside the Kubernetes cluster?
- A. Namespace controller, ConfigMap controller, and Secret controller
- B. Replication controller, Endpoints controller, Namespace controller, and ServiceAccounts controller
- C. Pod, Service, and Ingress controller
- D. Job controller, CronJob controller, and DaemonSet controller
Answer: B
Explanation:
* kube-controller-managerruns a set of controllers that regulate the cluster's state.
* Exact extract (Kubernetes Docs):"The kube-controller-manager runs controllers that are core to Kubernetes. Examples of controllers are: Node controller, Replication controller, Endpoints controller, Namespace controller, and ServiceAccounts controller."
* Why D is correct:All listed are actual controllers within kube-controller-manager.
* Why others are wrong:
* A:Job and CronJob controllers are managed by kube-controller-manager, but DaemonSet controller is managed by the kube-scheduler/deployment logic.
* B:Pod, Service, Ingress controllers are not part of kube-controller-manager.
* C:ConfigMap and Secret do not have dedicated controllers.
References:
Kubernetes Docs - kube-controller-manager: https://kubernetes.io/docs/reference/command-line-tools- reference/kube-controller-manager/
NEW QUESTION # 32
A container running in a Kubernetes cluster has permission to modify host processes on the underlying node.
What combination of privileges and capabilities is most likely to have led to this privilege escalation?
- A. hostPath and AUDIT_WRITE
- B. There is no combination of privileges and capabilities that permits this.
- C. hostPID and SYS_PTRACE
- D. hostNetwork and NET_RAW
Answer: C
Explanation:
* hostPID:When enabled, the container shares the host's process namespace # container can see and potentially interact with host processes.
* SYS_PTRACE capability:Grants the container the ability to trace, inspect, and modify other processes (e.g., via ptrace).
* Combination of hostPID + SYS_PTRACE allows a container toattach to and modify host processes, which is a direct privilege escalation.
* Other options explained:
* hostPath + AUDIT_WRITE:hostPath exposes filesystem paths but does not inherently allow process modification.
* hostNetwork + NET_RAW:grants raw socket access but only for networking, not host process modification.
* A:Incorrect - such combinationsdo exist(like B).
References:
Kubernetes Docs - Configure a Pod to use hostPID: https://kubernetes.io/docs/tasks/configure-pod-container
/share-process-namespace/
Linux Capabilities man page: https://man7.org/linux/man-pages/man7/capabilities.7.html
NEW QUESTION # 33
Which of the following statements correctly describes a container breakout?
- A. A container breakout is the process of escaping the container and gaining access to the host operating system.
- B. A container breakout is the process of escaping the container and gaining access to the cloud provider's infrastructure.
- C. A container breakout is the process of escaping the container and gaining access to the Pod's network traffic.
- D. A container breakout is the process of escaping a container when it reaches its resource limits.
Answer: A
Explanation:
* Container breakoutrefers to an attacker escaping container isolation and reaching thehost OS.
* Once the host is compromised, the attacker can accessother containers, Kubernetes nodes, or escalate further.
* Exact extract (Kubernetes Security Docs):
* "If an attacker gains access to a container, they may attempt a container breakout to gain access to the host system."
* Other options clarified:
* A: Network access inside a Pod # breakout.
* B: Resource exhaustion is aDoS, not a breakout.
* C: Cloud infrastructure compromise is possibleafterhost compromise, but not the definition of breakout.
References:
Kubernetes Security Concepts: https://kubernetes.io/docs/concepts/security/ CNCF Security Whitepaper (Threats section):https://github.com/cncf/tag-security
NEW QUESTION # 34
Why mightNetworkPolicyresources have no effect in a Kubernetes cluster?
- A. NetworkPolicy resources are only enforced if the user has the right RBAC permissions.
- B. NetworkPolicy resources are only enforced for unprivileged Pods.
- C. NetworkPolicy resources are only enforced if the Kubernetes scheduler supports them.
- D. NetworkPolicy resources are only enforced if the networking plugin supports them.
Answer: D
Explanation:
* NetworkPolicies define how Pods can communicate with each other and external endpoints.
* However, Kubernetes itselfdoes not enforce NetworkPolicy. Enforcement depends on theCNI plugin used (e.g., Calico, Cilium, Kube-Router, Weave Net).
* If a cluster is using a network plugin that does not support NetworkPolicies, then creating NetworkPolicy objects hasno effect.
References:
Kubernetes Documentation - Network Policies
CNCF Security Whitepaper - Platform security section: notes that security enforcement relies on CNI capabilities.
NEW QUESTION # 35
Which of the following is a valid security risk caused by having no egress controls in a Kubernetes cluster?
- A. Unauthorized access to external resources
- B. Denial of Service
- C. Increased attack surface
- D. Data exfiltration
Answer: D
Explanation:
* Egress NetworkPoliciesrestrict outbound traffic from Pods.
* Without egress restrictions, a compromised Pod could exfiltrate sensitive data (secrets, logs, customer data) to an attacker-controlled server.
* Exact extract (Kubernetes Docs - Network Policies):
* "Egress rules control outbound connections from Pods. Without such restrictions, compromised workloads can connect freely to external endpoints."
* Other options clarified:
* A: DoS is more about flooding, not egress absence.
* C: "Increased attack surface" is vague but not the main risk.
* D: True in a sense, but the precise and most common risk isdata exfiltration.
References:
Kubernetes Docs - Network Policies: https://kubernetes.io/docs/concepts/services-networking/network- policies/
NEW QUESTION # 36
What is the purpose of an egress NetworkPolicy?
- A. To control the incoming network traffic to a Kubernetes cluster.
- B. To control the outgoing network traffic from one or more Kubernetes Pods.
- C. To control the outbound network traffic from a Kubernetes cluster.
- D. To secure the Kubernetes cluster against unauthorized access.
Answer: B
Explanation:
* NetworkPolicycontrols network trafficat the Pod level.
* Ingress rules:controlincomingconnections to Pods.
* Egress rules:controloutgoingconnectionsfrom Pods.
* Exact extract (Kubernetes Docs - Network Policies):
* "An egress rule controls outgoing connections from Pods that match the policy."
* Clarifying wrong answers:
* A/B: Too broad (cluster-level); policies apply per Pod/Namespace.
* C: Security against unauthorized access is broader than egress policies.
References:
Kubernetes Docs - Network Policies: https://kubernetes.io/docs/concepts/services-networking/network- policies/
NEW QUESTION # 37
What mechanism can I use to block unsigned images from running in my cluster?
- A. Enabling Admission Controllers to validate image signatures.
- B. Configuring Container Runtime Interface (CRI) to enforce image signing and validation.
- C. Using Pod Security Standards (PSS) to enforce validation of signatures.
- D. Using PodSecurityPolicy (PSP) to enforce image signing and validation.
Answer: A
Explanation:
* KubernetesAdmission Controllers(particularlyValidatingAdmissionWebhooks) can be used to enforce policies that validate image signatures.
* This is commonly implemented withtools like Sigstore/cosign, Kyverno, or OPA Gatekeeper.
* PodSecurityPolicy (PSP):deprecated and never supported image signature validation.
* Pod Security Standards (PSS):only apply to pod security fields (privilege, users, host access), not image signatures.
* CRI:while runtimes (containerd, CRI-O) may integrate with signature verification tools, enforcement in Kubernetes is generally done viaAdmission Controllersat the API layer.
Exact extract (Admission Controllers docs):
* "Admission webhooks can be used to enforce custom policies on the objects being admitted." (e.g., validating signatures).
References:
Kubernetes Docs - Admission Controllers: https://kubernetes.io/docs/reference/access-authn-authz
/admission-controllers/
Sigstore Project (cosign): https://sigstore.dev/
Kyverno ImageVerify Policy: https://kyverno.io/policies/pod-security/require-image-verification/
NEW QUESTION # 38
Which of the following statements on static Pods is true?
- A. The kubelet only deploys static Pods when the kube-scheduler is unresponsive.
- B. The kubelet can run static Pods that span multiple nodes, provided that it has the necessary privileges from the API server.
- C. The kubelet schedules static Pods local to its node without going through the kube-scheduler, making tracking and managing them difficult.
- D. The kubelet can run a maximum of 5 static Pods on each node.
Answer: C
Explanation:
* Static Podsare managed directly by thekubeleton each node.
* They arenot scheduled by the kube-schedulerand always remain bound to the node where they are defined.
* Exact extract (Kubernetes Docs - Static Pods):
* "Static Pods are managed directly by the kubelet daemon on a specific node, without the API server. They do not go through the Kubernetes scheduler."
* Clarifications:
* A: Static Pods do not span multiple nodes.
* B: No hard limit of 5 Pods per node.
* D: They are not a fallback mechanism; kubelet always manages them regardless of scheduler state.
References:
Kubernetes Docs - Static Pods: https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/
NEW QUESTION # 39
Is it possible to restrict permissions so that a controller can only change the image of a deployment (without changing anything else about it, e.g., environment variables, commands, replicas, secrets)?
- A. Not with RBAC, but it is possible with an admission webhook.
- B. Yes, by granting permission to the /image subresource.
- C. No, because granting access to the spec.containers.image field always grants access to the rest of the spec object.
- D. Yes, with a 'managed fields' annotation.
Answer: A
Explanation:
* RBAC in Kubernetesis coarse-grained: it controlsverbs(get, update, patch, delete) onresources(e.g., deployments), butnot individual fieldswithin a resource.
* There isno /image subresource for deployments(there is one for pods but only for ephemeral containers).
* Therefore,RBAC cannot restrict changes only to the image field.
* Admission Webhooks(mutating/validating)canenforce fine-grained policies (e.g., deny updates that change anything other than spec.containers[*].image).
* Exact extract (Kubernetes Docs - Admission Webhooks):
* "Admission webhooks can be used to enforce custom policies on objects being admitted." References:
Kubernetes Docs - RBAC: https://kubernetes.io/docs/reference/access-authn-authz/rbac/ Kubernetes Docs - Admission Webhooks: https://kubernetes.io/docs/reference/access-authn-authz
/extensible-admission-controllers/
NEW QUESTION # 40
What is Grafana?
- A. A platform for monitoring and visualizing time-series data.
- B. A cloud-native security tool for scanning and detecting vulnerabilities in Kubernetes clusters.
- C. A cloud-native distributed tracing system for monitoring microservices architectures.
- D. A container orchestration platform for managing and scaling applications.
Answer: A
Explanation:
* Grafana:An open-source analytics and visualization platform widely used with Prometheus, Loki, etc.
* Exact extract (Grafana Docs):"Grafana is the open-source analytics and monitoring solution for every database. It allows you to query, visualize, alert on, and understand your metrics no matter where they are stored."
* A is wrong:That describesJaeger(distributed tracing).
* B is wrong:That'sKubernetesitself.
* D is wrong:That'sTrivy/Aqua/Prismatype tools.
References:
Grafana Docs: https://grafana.com/docs/grafana/latest/
NEW QUESTION # 41
In which order are thevalidating and mutating admission controllersrun while the Kubernetes API server processes a request?
- A. Validating and mutating admission controllers run simultaneously.
- B. Validating admission controllers run before mutating admission controllers.
- C. Mutating admission controllers run before validating admission controllers.
- D. The order of execution varies and is determined by the cluster configuration.
Answer: C
Explanation:
* Theadmission control flowin Kubernetes:
* Mutating admission controllersrun first and can modify incoming requests.
* Validating admission controllersrun after mutations to ensure the final object complies with policies.
* This ensures policies validate thefinal, mutated object.
References:
Kubernetes Documentation - Admission Controllers
CNCF Security Whitepaper - Admission control workflow.
NEW QUESTION # 42
An attacker has access to the network segment that the cluster is on.
What happens when a compromised Pod attempts to connect to the API server?
- A. The compromised Pod is allowed to connect to the API server without any restrictions.
- B. The compromised Pod is automatically isolated from the network to prevent any connections to the API server.
- C. The compromised Pod connects to the API server and is granted elevated privileges by default.
- D. The compromised Pod attempts to connect to the API server, but its requests may be blocked due to network policies.
Answer: D
Explanation:
* By default,Pods can connect to the API server(since ServiceAccount tokens are mounted).
* However, whether they succeed in acting depends on:
* Network Policies(may block egress).
* RBAC(controls permissions).
* Exact extract (Kubernetes Docs - API Access):
* "Pods authenticate to the API server using the service account token mounted into the Pod.
Authorization is then enforced by RBAC. NetworkPolicies may further restrict access."
* Clarifications:
* A: No default automatic isolation.
* B: Not always unrestricted; policies may apply.
* D: Pods get minimal default privileges, not automatic elevation.
References:
Kubernetes Docs - API Access to Pods: https://kubernetes.io/docs/concepts/security/service-accounts/ Kubernetes Docs - Network Policies: https://kubernetes.io/docs/concepts/services-networking/network- policies/
NEW QUESTION # 43
What information is stored in etcd?
- A. Pod data contained in Persistent Volume Claims (e.g. hostPath).
- B. Application logs and monitoring data for auditing and troubleshooting purposes.
- C. Sensitive user data such as usernames and passwords.
- D. Etcd manages the configuration data, state data, and metadata for Kubernetes.
Answer: D
Explanation:
* etcdis Kubernetes'key-value storeforcluster state.
* Stores: ConfigMaps, Secrets, Pod definitions, Deployments, RBAC policies, and metadata.
* Exact extract (Kubernetes Docs - etcd):
* "etcd is a consistent and highly-available key-value store used as Kubernetes' backing store for all cluster data."
* Clarifications:
* B: Logs/metrics are handled by logging/monitoring solutions, not etcd.
* C: Secrets may be stored here but encoded in base64, not specifically "usernames/passwords" as primary use.
* D: Persistent Volumes are external storage, not stored in etcd.
References:
Kubernetes Docs - etcd: https://kubernetes.io/docs/concepts/overview/components/#etcd
NEW QUESTION # 44
Which technology can be used to apply security policy for internal cluster traffic at the application layer of the network?
- A. Network Policy
- B. Service Mesh
- C. Container Runtime
- D. Ingress Controller
Answer: B
Explanation:
* Service Mesh (e.g., Istio, Linkerd, Consul):operates atLayer 7 (application layer), enforcing policies like mTLS, authorization, and routing between services.
* NetworkPolicy:works atLayer 3/4 (IP/port), not Layer 7.
* Ingress Controller:handles external traffic ingress, not internal service-to-service traffic.
* Container Runtime:responsible for running containers, not enforcing application-layer security.
Exact extract (Istio docs):
* "Istio provides security by enforcing authentication, authorization, and encryption of service-to- service communication." References:
Kubernetes Docs - Network Policies: https://kubernetes.io/docs/concepts/services-networking/network- policies/ Istio Security Docs: https://istio.io/latest/docs/concepts/security/
NEW QUESTION # 45
Which of the following statements regarding a container run with privileged: true is correct?
- A. A container run with privileged: true has no additional access to Secrets than if it were run with privileged: false.
- B. A container run with privileged: true within a Namespace can access all Secrets used within that Namespace.
- C. A container run with privileged: true within a cluster can access all Secrets used within that cluster.
- D. A container run with privileged: true on a node can access all Secrets used on that node.
Answer: A
Explanation:
* Setting privileged: true grants a containerelevated access to the host node, including access to host devices, kernel capabilities, and the ability to modify the host.
* However, Secrets in Kubernetes are not automatically exposedto privileged containers. Secrets are mounted into Pods only if explicitly referenced.
* Thus, being privilegeddoes not grant additional access to Kubernetes Secretscompared to a non- privileged Pod.
* The risk lies in node compromise: if a privileged container can take over the node, it could then indirectly gain access to Secrets (e.g., by reading kubelet credentials).
References:
Kubernetes Documentation - Security Context
CNCF Security Whitepaper - Pod security context and privileged container risks.
NEW QUESTION # 46
......
KCSA Exam Dumps - Try Best KCSA Exam Questions: https://certkingdom.vce4dumps.com/KCSA-latest-dumps.html