Access to Sensitive Data KCSA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security analyst is investigating an incident where an attacker accessed sensitive data in a Kubernetes cluster. The attacker used a valid service account token that was found in a pod's environment variables. The service account had permissions to read Secrets in the same namespace. Which of the following is the MOST likely attack vector?

   • AMisconfigured RBAC
   • BCompromised container
   • CExposed service account token
   • DExposed secrets
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A Kubernetes cluster stores TLS certificates as Secrets. An attacker gains read access to these Secrets and uses them to impersonate the service. What is the MOST likely impact?

   • APrivilege escalation
   • BCompliance violation
   • CData breach
   • DIdentity theft and loss of trust
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security analyst is investigating a breach where an attacker accessed sensitive data. The attacker used a service account token that was found in a public container image. The service account had permissions to list all Secrets in the cluster. Which of the following is the MOST likely threat actor and attack vector combination?

   • AMalicious insider using compromised node
   • BExternal attacker using exposed secrets and misconfigured RBAC
   • CCompromised container using API server misconfiguration
   • DThird-party vendor using exposed secrets
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A DevOps team uses a shared Kubernetes cluster for multiple applications. A disgruntled employee who recently left the company still has a valid service account token that was never revoked. Which threat actor does this scenario primarily illustrate?

   • AThird-party vendor with excessive permissions
   • BExternal attacker exploiting a network vulnerability
   • CCompromised container running malicious code
   • DMalicious insider abusing legitimate credentials
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is considered sensitive configuration data in a Kubernetes environment?

   • AA Service's port number
   • BA ConfigMap containing application settings
   • CA Deployment's replica count
   • DA Secret containing a database password
   Reveal Solution Discussion Select an answer first