Linux Foundation KCSA - Kubernetes and Cloud Native Security Associate Exam
Page: 3 / 12
Total 60 questions
Question #11 (Topic: Exam A)
Which of the following represents a malicious action that may lead to Denial of Service on a Kubernetes cluster?
A. Execute malicious code in the workload
B. Bring the scheduler Pods down
C. Establish a foothold on a worker node
D. Exfiltrate data from a datastore accessible from Pod
Answer: B
Question #12 (Topic: Exam A)
Which of these is a true statement about a security benefit of using containers to isolate application workloads from each other?
A. Even if an attacker obtains a user’s security credentials. RBAC policies can prevent the attacker from accessing all the workloads in the cluster
B. If an attacker compromises an application, all the other applications in the same Kubernetes namespace are also compromised.
C. If a vulnerability is found in one application, a user can fix it and redeploy that application without having to affect other running workloads.
D. If an attacker gains access to any container, they can easily get root access to all the other containers on the same host.
Answer: C
Question #13 (Topic: Exam A)
In Kubernetes, which of the following conditions must be met for a user to be able to create or update a Role?
A. The user is granted explicit permission to perform the 'escalate verb on its own User resource in the authentication.k8s.io API group
B. The user is granted explicit permission to perform the bind' verb on the roles or ClusterRoles resource in the rbac.authorization.k8s.io API group
C. The user is granted a role to create/update RoleBinding or ClusterRoleBinding objects
D. The user already has all the permissions contained in the role at the same scope as the object being modified.
Answer: D
Question #14 (Topic: Exam A)
To restrict the kubelet's rights to the Kubernetes API, what authorization mode should be set on the Kubernetes API server?
A. Node
B. kubelet
C. Webhook
D. AlwaysAllow
Answer: A
Question #15 (Topic: Exam A)
At which stage does the Kubernetes admission control happen with respect to request authentication and authorization?
A. Before authentication and authorization
B. After authentication and authorization.
C. After authentication and before authorization.
D. After authorization and before authentication.
Answer: B
