KCSA Practice Exam Questions and Answers

A.  

The scope of the tenant role means privilege escalation is impossible.

B.  

By tampering with the namespace labels.

C.  

By deleting the PodSecurity admission controller deployment running in their namespace.

D.  

By using higher-level access credentials obtained reading secrets from another namespace.

A.  

By using a command-line flag when creating the Pod.

B.  

By modifying the Docker daemon configuration.

C.  

By setting the container runtime as an environment variable in the Pod.

D.  

By specifying the container runtime in the Pod's YAML file.

A.  

A container breakout is the process of escaping the container and gaining access to the Pod's network traffic.

B.  

A container breakout is the process of escaping a container when it reaches its resource limits.

C.  

A container breakout is the process of escaping the container and gaining access to the cloud provider's infrastructure.

D.  

A container breakout is the process of escaping the container and gaining access to the host operating system.

A.  

When the priority is enabling resource sharing and efficiency between tenants.

B.  

When the priority is enabling complete isolation between tenants.

C.  

When the priority is enabling fine-grained control over tenant resources.

D.  

When the priority is enabling strict security boundaries between tenants.

A.  

Zero Trust

B.  

Least Privilege

C.  

Defense-in-Depth

D.  

Secure-by-Design

A.  

A container run with privileged: true within a cluster can access all Secrets used within that cluster.

B.  

A container run with privileged: true within a Namespace can access all Secrets used within that Namespace.

C.  

A container run with privileged: true on a node can access all Secrets used on that node.

D.  

A container run with privileged: true has no additional access to Secrets than if it were run with privileged: false.

A.  

Container Runtime Security

B.  

Kubernetes Security Context

C.  

Container Security Standards

D.  

Pod Security Policy

A.  

To evaluate and monitor existing suppliers for adherence to security requirements.

B.  

To conduct regular audits of suppliers' financial performance.

C.  

To establish contractual agreements with suppliers.

D.  

To identify potential suppliers for the organization.

A.  

Modify Kubernetes objects stored within etcd.

B.  

Modify file on host filesystem.

C.  

Starting a process in a running container.

D.  

Create restarting container on host using Docker.

A.  

Through implementing Kyverno or OPA Policies.

B.  

Use the PodSecurity admission controller.

C.  

It is only possible to enforce the Pod Security Standard with additional tools within the cloud native ecosystem.

D.  

No additional measures have to be taken to enforce the Pod Security Standard.