Free Practice Questions for Linux Foundation KCSA Exam

Question 1

What is the purpose of an egress NetworkPolicy?

ATo control the incoming network traffic to a Kubernetes cluster.

BTo control the outbound network traffic from a Kubernetes cluster.

CTo secure the Kubernetes cluster against unauthorized access.

DTo control the outgoing network traffic from one or more Kubernetes Pods.

Correct Answer: D. To control the outgoing network traffic from one or more Kubernetes Pods.

Question 2

Which of the following statements regarding a container run with privileged: true is correct?

AA container run with privileged: true within a cluster can access all Secrets used within that cluster.

BA container run with privileged: true within a Namespace can access all Secrets used within that Namespace.

CA container run with privileged: true on a node can access all Secrets used on that node.

DA container run with privileged: true has no additional access to Secrets than if it were run with privileged: false.

Correct Answer: D. A container run with privileged: true has no additional access to Secrets than if it were run with privileged: false.

Question 3

You want to minimize security issues in running Kubernetes Pods. Which of the following actions can help achieve this goal?

ASharing sensitive data among Pods in the same cluster to improve collaboration.

BRunning Pods with elevated privileges to maximize their capabilities.

CImplement Pod Security standards in the Pod's YAML configuration.

DDeploying Pods with randomly generated names to obfuscate their identities.

Correct Answer: C. Implement Pod Security standards in the Pod's YAML configuration.

Question 4

What was the name of the precursor to Pod Security Standards?

AContainer Runtime Security

BKubernetes Security Context

CContainer Security Standards

DPod Security Policy

Correct Answer: D. Pod Security Policy

Question 5

A user runs a command with kubectl to apply a change to a deployment. What is the first Kubernetes component that the request reaches?

AKubernetes Controller Manager

BKubernetes API Server

CKubernetes Scheduler

Dkubelet

Correct Answer: B. Kubernetes API Server

Question 6

What is the difference between gVisor and Firecracker?

AgVisor is a user-space kernel that provides isolation and security for containers. At the same time, Firecracker is a lightweight virtualization technology for creating and managing secure, multi-tenant container and function-as-a-service (FaaS) workloads.

BgVisor is a lightweight virtualization technology for creating and managing secure, multi-tenant container and function-as-a-service (FaaS) workloads. At the same time, Firecracker is a user-space kernel that provides isolation and security for containers.

CgVisor and Firecracker are both container runtimes that can be used interchangeably.

DgVisor and Firecracker are two names for the same technology, which provides isolation and security for containers.

Correct Answer: A. gVisor is a user-space kernel that provides isolation and security for containers. At the same time, Firecracker is a lightweight virtualization technology for creating and managing secure, multi-tenant container and function-as-a-service (FaaS) workloads.

Question 7

Which information does a user need to verify a signed container image?

AThe image's SHA-256 hash and the private key of the signing authority.

BThe image's digital signature and the private key of the signing authority.

CThe image's SHA-256 hash and the public key of the signing authority.

DThe image's digital signature and the public key of the signing authority.

Correct Answer: D. The image's digital signature and the public key of the signing authority.

Question 8

How do Kubernetes namespaces impact the application of policies when using Pod Security Admission?

ANamespaces are ignored; Pod Security Admission policies apply cluster-wide only.

BDifferent policies can be applied to specific namespaces.

CEach namespace can have only one active policy.

DThe default namespace enforces the strictest security policies by default.

Correct Answer: B. Different policies can be applied to specific namespaces.

Question 9

You are responsible for securing the kubelet component in a Kubernetes cluster.

Which of the following statements about kubelet security is correct?

AKubelet runs as a privileged container by default.

BKubelet does not have any built-in security features.

CKubelet supports TLS authentication and encryption for secure communication with the API server.

DKubelet requires root access to interact with the host system.

Correct Answer: C. Kubelet supports TLS authentication and encryption for secure communication with the API server.

Question 10

Which of the following statements is true concerning the use of microVMs over user-space kernel implementations for advanced container sandboxing?

AMicroVMs allow for easier container management and orchestration than user-space kernel implementation.

BMicroVMs offer higher isolation than user-space kernel implementations at the cost of a higher per-instance memory footprint.

CMicroVMs provide reduced application compatibility and higher per-system call overhead than user-space kernel implementations.

DMicroVMs offer lower isolation and security compared to user-space kernel implementations.

Correct Answer: B. MicroVMs offer higher isolation than user-space kernel implementations at the cost of a higher per-instance memory footprint.