[Jun-2026] Verified KCSA dumps Q&As - KCSA dumps with Correct Answers
The Best Kubernetes and Cloud Native Study Guide for the KCSA Exam
Linux Foundation KCSA Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
NEW QUESTION # 32
Which of the following statements best describes the role of the Scheduler in Kubernetes?
- A. The Scheduler is responsible for ensuring the security of the Kubernetes cluster and its components.
- B. The Scheduler is responsible for assigning Pods to nodes based on resource availability and other constraints.
- C. The Scheduler is responsible for managing the deployment and scaling of applications in the Kubernetes cluster.
- D. The Scheduler is responsible for monitoring and managing the health of the Kubernetes cluster.
Answer: B
Explanation:
* TheKubernetes Schedulerassigns Pods to nodes based on:
* Resource requests & availability (CPU, memory, GPU, etc.)
* Constraints (affinity, taints, tolerations, topology, policies)
* Exact extract (Kubernetes Docs - Scheduler):
* "The scheduler is a control plane process that assigns Pods to Nodes. Scheduling decisions take into account resource requirements, affinity/anti-affinity, constraints, and policies."
* Other options clarified:
* A: Monitoring cluster health is theController Manager's/kubelet's job.
* B: Security is enforced throughRBAC, admission controllers, PSP/PSA, not the scheduler.
* C: Deployment scaling is handled by theController Manager(Deployment/ReplicaSet controller).
References:
Kubernetes Docs - Scheduler: https://kubernetes.io/docs/concepts/scheduling-eviction/kube-scheduler/
NEW QUESTION # 33
Which of the following statements best describe container image signing and verification in the cloud environment?
- A. Container image signatures affect the performance of containerized applications, as they increase the size of images with additional metadata.
- B. Container image signatures are concerned with defining developer ownership of applications within multi-tenant environments.
- C. Container image signatures are mandatory in cloud environments, as cloud providers would deny the execution of unsigned container images.
- D. Container image signatures and their verification ensure their authenticity and integrity against tampering.
Answer: D
Explanation:
* Image signing (withNotary, cosign, or similar tools) ensures that images are from a trusted source and have not been modified.
* Exact extract (Sigstore cosign docs):"Cosign allows you to sign and verify container images to ensure authenticity and integrity."
* Why others are wrong:
* B:Ownership can be inferred but it's aboutauthenticity & integritynot tenancy.
* C:Not mandatory; enforcement requiresadmission controllers.
* D:Metadata size is negligible and has no runtime performance impact.
References:
Sigstore Project: https://docs.sigstore.dev/cosign/overview
CNCF Security Whitepaper
NEW QUESTION # 34
What was the name of the precursor to Pod Security Standards?
- A. Container Runtime Security
- B. Container Security Standards
- C. Pod Security Policy
- D. Kubernetes Security Context
Answer: C
Explanation:
* Kubernetes originally had a feature calledPodSecurityPolicy (PSP), which provided controls to restrict pod behavior.
* Official docs:
* "PodSecurityPolicy was deprecated in Kubernetes v1.21 and removed in v1.25."
* "Pod Security Standards (PSS) replace PodSecurityPolicy (PSP) with a simpler, policy- driven approach."
* PSP was often complex and hard to manage, so it was replaced by Pod Security Admission (PSA) which enforcesPod Security Standards.
References:
Kubernetes Docs - PodSecurityPolicy (deprecated): https://kubernetes.io/docs/concepts/security/pod- security-policy/ Kubernetes Blog - PodSecurityPolicy Deprecation: https://kubernetes.io/blog/2021/04/06/podsecuritypolicy- deprecation-past-present-and-future/
NEW QUESTION # 35
Which of the following statements on static Pods is true?
- A. The kubelet only deploys static Pods when the kube-scheduler is unresponsive.
- B. The kubelet can run a maximum of 5 static Pods on each node.
- C. The kubelet can run static Pods that span multiple nodes, provided that it has the necessary privileges from the API server.
- D. The kubelet schedules static Pods local to its node without going through the kube-scheduler, making tracking and managing them difficult.
Answer: D
Explanation:
* Static Podsare managed directly by thekubeleton each node.
* They arenot scheduled by the kube-schedulerand always remain bound to the node where they are defined.
* Exact extract (Kubernetes Docs - Static Pods):
* "Static Pods are managed directly by the kubelet daemon on a specific node, without the API server. They do not go through the Kubernetes scheduler."
* Clarifications:
* A: Static Pods do not span multiple nodes.
* B: No hard limit of 5 Pods per node.
* D: They are not a fallback mechanism; kubelet always manages them regardless of scheduler state.
References:
Kubernetes Docs - Static Pods: https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/
NEW QUESTION # 36
You are responsible for securing thekubeletcomponent in a Kubernetes cluster.
Which of the following statements about kubelet security is correct?
- A. Kubelet supports TLS authentication and encryption for secure communication with the API server.
- B. Kubelet does not have any built-in security features.
- C. Kubelet runs as a privileged container by default.
- D. Kubelet requires root access to interact with the host system.
Answer: A
Explanation:
* Thekubeletis the primary agent that runs on each node in a Kubernetes cluster and communicates with the control plane.
* Kubeletsupports TLS (Transport Layer Security)for both authentication and encryption when interacting with the API server. This is a core security feature that ensures secure node-to-control-plane communication.
* Incorrect options:
* (A) Kubelet does not run as a privileged container by default; it runs as a system process (typically systemd-managed) on the host.
* (B) Kubelet does include built-in security features such asTLS authentication, authorization modes, and read-only vs secured ports.
* (D) While kubelet interacts with the host system (e.g., cgroups, container runtimes), it does not inherently require root access for communication security; RBAC and TLS handle authentication.
References:
Kubernetes Documentation - Kubelet authentication/authorization
CNCF Security Whitepaper - Cluster Component Security (discusses TLS and mutual authentication between kubelet and API server).
NEW QUESTION # 37
To restrict the kubelet's rights to the Kubernetes API, whatauthorization modeshould be set on the Kubernetes API server?
- A. AlwaysAllow
- B. Node
- C. Webhook
- D. kubelet
Answer: B
Explanation:
* TheNode authorization modeis designed to specifically limit what kubelets can do when they connect to the Kubernetes API server.
* It authorizes requests from kubelets based on the Pods scheduled to run on their nodes, ensuring kubelets cannot interact with resources beyond their scope.
* Incorrect options:
* (B)AlwaysAllowallows unrestricted access (insecure).
* (C) No kubelet authorization mode exists.
* (D)Webhookmode delegates authorization decisions to an external service, not specifically for kubelets.
References:
Kubernetes Documentation - Node Authorization
CNCF Security Whitepaper - Access control: kubelet authorization and Node authorizer.
NEW QUESTION # 38
A cluster administrator wants to enforce the use of a different container runtime depending on the application a workload belongs to.
- A. By modifying the kube-apiserver configuration file to specify the desired container runtime for each application.
- B. By configuring avalidating admission controllerwebhook that verifies the container runtime based on the application label and rejects requests that do not comply.
- C. By configuring amutating admission controllerwebhook that intercepts new workload creation requests and modifies the container runtime based on the application label.
- D. By manually modifying the container runtime for each workload after it has been created.
Answer: C
Explanation:
* Kubernetes supports workload-specific runtimes viaRuntimeClass.
* Amutating admission controllercan enforce this automatically by:
* Intercepting workload creation requests.
* Modifying the Pod spec to set runtimeClassName based on labels or policies.
* Incorrect options:
* (A) Manual modification is not scalable or secure.
* (B) kube-apiserver cannot enforce per-application runtime policies.
* (C) A validating webhook can onlyreject, not modify, the runtime.
References:
Kubernetes Documentation - RuntimeClass
CNCF Security Whitepaper - Admission controllers for enforcing runtime policies.
NEW QUESTION # 39
What is the reasoning behind considering the Cloud as the trusted computing base of a Kubernetes cluster?
- A. A Kubernetes cluster can only be as secure as the security posture of its Cloud hosting.
- B. The Cloud enforces security controls at the Kubernetes cluster level, so application developers can focus on applications only.
- C. A Kubernetes cluster can only be trusted if the underlying Cloud provider is certified against international standards.
- D. A vulnerability in the Cloud layer has a negligible impact on containers due to Linux isolation mechanisms.
Answer: A
Explanation:
* The4C's of Cloud Native Security(Cloud, Cluster, Container, Code) model starts withCloudas the base layer.
* If the Cloud (infrastructure layer) is compromised, every higher layer (Cluster, Container, Code) inherits that compromise.
* Exact extract (Kubernetes Security Overview):
* "The 4C's of Cloud Native security are Cloud, Clusters, Containers, and Code. You can think of the 4C's as a layered approach. A Kubernetes cluster can only be as secure as the cloud infrastructure it is deployed on."
* This means the cloud is part of thetrusted computing baseof a Kubernetes cluster.
References:
Kubernetes Docs - Security Overview (4C's): https://kubernetes.io/docs/concepts/security/overview/#the-
4cs-of-cloud-native-security
NEW QUESTION # 40
An attacker has access to the network segment that the cluster is on.
What happens when a compromised Pod attempts to connect to the API server?
- A. The compromised Pod connects to the API server and is granted elevated privileges by default.
- B. The compromised Pod attempts to connect to the API server, but its requests may be blocked due to network policies.
- C. The compromised Pod is allowed to connect to the API server without any restrictions.
- D. The compromised Pod is automatically isolated from the network to prevent any connections to the API server.
Answer: B
Explanation:
* By default,Pods can connect to the API server(since ServiceAccount tokens are mounted).
* However, whether they succeed in acting depends on:
* Network Policies(may block egress).
* RBAC(controls permissions).
* Exact extract (Kubernetes Docs - API Access):
* "Pods authenticate to the API server using the service account token mounted into the Pod.
Authorization is then enforced by RBAC. NetworkPolicies may further restrict access."
* Clarifications:
* A: No default automatic isolation.
* B: Not always unrestricted; policies may apply.
* D: Pods get minimal default privileges, not automatic elevation.
References:
Kubernetes Docs - API Access to Pods: https://kubernetes.io/docs/concepts/security/service-accounts/ Kubernetes Docs - Network Policies: https://kubernetes.io/docs/concepts/services-networking/network- policies/
NEW QUESTION # 41
Which technology can be used to apply security policy for internal cluster traffic at the application layer of the network?
- A. Network Policy
- B. Container Runtime
- C. Service Mesh
- D. Ingress Controller
Answer: C
Explanation:
* Service Mesh (e.g., Istio, Linkerd, Consul):operates atLayer 7 (application layer), enforcing policies like mTLS, authorization, and routing between services.
* NetworkPolicy:works atLayer 3/4 (IP/port), not Layer 7.
* Ingress Controller:handles external traffic ingress, not internal service-to-service traffic.
* Container Runtime:responsible for running containers, not enforcing application-layer security.
Exact extract (Istio docs):
* "Istio provides security by enforcing authentication, authorization, and encryption of service-to- service communication." References:
Kubernetes Docs - Network Policies: https://kubernetes.io/docs/concepts/services-networking/network- policies/ Istio Security Docs: https://istio.io/latest/docs/concepts/security/
NEW QUESTION # 42
Which label should be added to the Namespace to block any privileged Pods from being created in that Namespace?
- A. pod.security.kubernetes.io/privileged: false
- B. privileged: false
- C. privileged: true
- D. pod-security.kubernetes.io/enforce: baseline
Answer: D
Explanation:
* KubernetesPod Security Admission (PSA)enforcesPod Security Standardsby applying labels on Namespaces.
* Exact extract (Kubernetes Docs - Pod Security Admission):
* "You can label a namespace with pod-security.kubernetes.io/enforce: baseline to enforce the Baseline policy."
* Thebaselineprofile explicitly disallowsprivileged podsand other unsafe features.
* Why others are wrong:
* A & D: These labels do not exist in Kubernetes.
* B: Setting privileged: true would allow privileged pods, not block them.
References:
Kubernetes Docs - Pod Security Admission: https://kubernetes.io/docs/concepts/security/pod-security- admission/ Kubernetes Docs - Pod Security Standards: https://kubernetes.io/docs/concepts/security/pod-security- standards/
NEW QUESTION # 43
A user runs a command with kubectl to apply a change to a deployment. What is the first Kubernetes component that the request reaches?
- A. Kubernetes Controller Manager
- B. Kubernetes API Server
- C. kubelet
- D. Kubernetes Scheduler
Answer: B
Explanation:
* Allkubectl requestsgo to theKubernetes API Server.
* The API server is thefront-end of the control planeand validates/authenticates requests before other components act.
* Exact extract (Kubernetes Docs - Components):
* "The API server is a component of the Kubernetes control plane that exposes the Kubernetes API. It is the front end for the Kubernetes control plane."
* Other options clarified:
* Controller Manager: reconciles state after API Server processes the request.
* Scheduler: assigns Pods to nodes after API Server accepts workload objects.
* kubelet: node agent, only communicates after API Server updates desired state.
References:
Kubernetes Docs - Components: https://kubernetes.io/docs/concepts/overview/components/
NEW QUESTION # 44
What is Grafana?
- A. A platform for monitoring and visualizing time-series data.
- B. A container orchestration platform for managing and scaling applications.
- C. A cloud-native security tool for scanning and detecting vulnerabilities in Kubernetes clusters.
- D. A cloud-native distributed tracing system for monitoring microservices architectures.
Answer: A
Explanation:
* Grafana:An open-source analytics and visualization platform widely used with Prometheus, Loki, etc.
* Exact extract (Grafana Docs):"Grafana is the open-source analytics and monitoring solution for every database. It allows you to query, visualize, alert on, and understand your metrics no matter where they are stored."
* A is wrong:That describesJaeger(distributed tracing).
* B is wrong:That'sKubernetesitself.
* D is wrong:That'sTrivy/Aqua/Prismatype tools.
References:
Grafana Docs: https://grafana.com/docs/grafana/latest/
NEW QUESTION # 45
How do Kubernetes namespaces impact the application of policies when using Pod Security Admission?
- A. The default namespace enforces the strictest security policies by default.
- B. Each namespace can have only one active policy.
- C. Namespaces are ignored; Pod Security Admission policies apply cluster-wide only.
- D. Different policies can be applied to specific namespaces.
Answer: D
Explanation:
* Pod Security Admission (PSA)enforces policies by applyinglabels on namespaces, not globally across the cluster.
* Exact extract (Kubernetes Docs - Pod Security Admission):
* "You can apply Pod Security Standards to namespaces by adding labels such as pod- security.kubernetes.io/enforce. Different namespaces can enforce different policies."
* Clarifications:
* A: Incorrect, namespaces are the unit of enforcement.
* C: Misleading - a namespace can have multiple enforcement modes (enforce, audit, warn).
* D: Default namespace doesnotenforce strict policies unless labeled.
References:
Kubernetes Docs - Pod Security Admission: https://kubernetes.io/docs/concepts/security/pod-security- admission/
NEW QUESTION # 46
Which of the following snippets from a RoleBinding correctly associates user bob with Role pod-reader ?
- A. subjects:
- kind: User
name: bob
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: pod-reader
apiGroup: rbac.authorization.k8s.io - B. subjects:
- kind: User
name: pod-reader
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: bob
apiGroup: rbac.authorization.k8s.io - C. subjects:
- kind: Group
name: bob
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: pod-reader
apiGroup: rbac.authorization.k8s.io - D. subjects:
- kind: User
name: bob
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: pod-reader
apiGroup: rbac.authorization.k8s.io
Answer: D
Explanation:
Kubernetes RBAC usesRoleBindingto grant permissions defined in aRoleto asubject(user, group, or service account) within a namespace. The official example shows binding user jane to Role pod-reader:
"A RoleBinding grants the permissions defined in a Role to a user or set of users...." Example:
subjects:
- kind: User
name: jane
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: pod-reader
apiGroup: rbac.authorization.k8s.io
- Kubernetes docs, RBAC: RoleBinding and ClusterRoleBinding
OptionBmatches this pattern exactly, with name: bob as theUsersubject and roleRef pointing to theRole named pod-reader.
* Aswaps the names (subject is pod-reader, role is bob) # incorrect.
* Creferences aClusterRole, not aRole(the question asks for Role).
* Duses kind: Group even though we need theUserbob.
References:
Kubernetes Docs - Using RBAC Authorization #RoleBinding and ClusterRoleBinding: https://kubernetes.io
/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding
NEW QUESTION # 47
An attacker has successfully overwhelmed the Kubernetes API server in a cluster with a single control plane node by flooding it with requests.
How would implementing a high-availability mode with multiple control plane nodes mitigate this attack?
- A. By increasing the resources allocated to the API server, allowing it to handle a higher volume of requests.
- B. By implementing rate limiting and throttling mechanisms on the API server to restrict the number of requests allowed.
- C. By distributing the workload across multiple API servers, reducing the load on each server.
- D. By implementing network segmentation to isolate the API server from the rest of the cluster, preventing the attack from spreading.
Answer: C
Explanation:
* Inhigh-availability clusters, multiple API server instances run behind a load balancer.
* Thisdistributes client requests across multiple API servers, preventing a single API server from being overwhelmed.
* Exact extract (Kubernetes Docs - High Availability Clusters):
* "A highly available control plane runs multiple instances of kube-apiserver, typically fronted by a load balancer, so that if one instance fails or is overloaded, others continue serving requests."
* Other options clarified:
* A: Network segmentation does not directly mitigate API server DoS.
* C: Adding resources helps, but doesn't solve single-point-of-failure.
* D: Rate limiting is a valid mitigation but not provided by HA alone.
References:
Kubernetes Docs - Building High-Availability Clusters: https://kubernetes.io/docs/setup/production- environment/tools/kubeadm/high-availability/
NEW QUESTION # 48
What is the purpose of an egress NetworkPolicy?
- A. To control the outgoing network traffic from one or more Kubernetes Pods.
- B. To control the incoming network traffic to a Kubernetes cluster.
- C. To control the outbound network traffic from a Kubernetes cluster.
- D. To secure the Kubernetes cluster against unauthorized access.
Answer: A
Explanation:
* NetworkPolicycontrols network trafficat the Pod level.
* Ingress rules:controlincomingconnections to Pods.
* Egress rules:controloutgoingconnectionsfrom Pods.
* Exact extract (Kubernetes Docs - Network Policies):
* "An egress rule controls outgoing connections from Pods that match the policy."
* Clarifying wrong answers:
* A/B: Too broad (cluster-level); policies apply per Pod/Namespace.
* C: Security against unauthorized access is broader than egress policies.
References:
Kubernetes Docs - Network Policies: https://kubernetes.io/docs/concepts/services-networking/network- policies/
NEW QUESTION # 49
A container running in a Kubernetes cluster has permission to modify host processes on the underlying node.
What combination of privileges and capabilities is most likely to have led to this privilege escalation?
- A. hostNetwork and NET_RAW
- B. There is no combination of privileges and capabilities that permits this.
- C. hostPID and SYS_PTRACE
- D. hostPath and AUDIT_WRITE
Answer: C
Explanation:
* hostPID:When enabled, the container shares the host's process namespace # container can see and potentially interact with host processes.
* SYS_PTRACE capability:Grants the container the ability to trace, inspect, and modify other processes (e.g., via ptrace).
* Combination of hostPID + SYS_PTRACE allows a container toattach to and modify host processes, which is a direct privilege escalation.
* Other options explained:
* hostPath + AUDIT_WRITE:hostPath exposes filesystem paths but does not inherently allow process modification.
* hostNetwork + NET_RAW:grants raw socket access but only for networking, not host process modification.
* A:Incorrect - such combinationsdo exist(like B).
References:
Kubernetes Docs - Configure a Pod to use hostPID: https://kubernetes.io/docs/tasks/configure-pod-container
/share-process-namespace/
Linux Capabilities man page: https://man7.org/linux/man-pages/man7/capabilities.7.html
NEW QUESTION # 50
By default, in a Kubeadm cluster, which authentication methods are enabled?
- A. X509 Client Certs, Bootstrap Tokens, and Service Account Tokens
- B. X509 Client Certs, OIDC, and Service Account Tokens
- C. OIDC, Bootstrap tokens, and Service Account Tokens
- D. X509 Client Certs, Webhook Authentication, and Service Account Tokens
Answer: A
Explanation:
* In akubeadm cluster, by default the API server enables several authentication mechanisms:
* X509 Client Certs: Used for authenticating kubelets, admins, and control-plane components.
* Bootstrap Tokens: Temporary credentials used for node bootstrap/joining clusters.
* Service Account Tokens: Used by workloads in pods to authenticate with the API server.
* Exact extract (Kubernetes Docs - Authentication):
* "Kubernetes uses client certificates, bearer tokens, an authenticating proxy, or HTTP basic auth to authenticate API requests."
* "Bootstrap tokens are a simple bearer token that is meant to be used when creating new clusters or joining new nodes to an existing cluster."
* "Service accounts are special accounts that provide an identity for processes that run in a Pod." References:
Kubernetes Docs - Authentication: https://kubernetes.io/docs/reference/access-authn-authz/authentication/ Kubeadm - TLS Bootstrapping: https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/
NEW QUESTION # 51
......
KCSA certification guide Q&A from Training Expert TestKingIT: https://www.testkingit.com/Linux-Foundation/latest-KCSA-exam-dumps.html
KCSA Certification Overview Latest KCSA PDF Dumps: https://drive.google.com/open?id=16jmhtnjzjRXu9TBUEHsgVrZnI_ADZh1v