A security analyst is tracing how a compromised application container could access sensitive data stored in the cluster. The container has a service account with permissions to read Secrets. Which path would the attacker MOST likely use?

Directly querying etcd from within the container

Using the service account token to call the Kubernetes API server

Reading secrets from the container's filesystem

Accessing the kubelet API on the node to retrieve secrets

What is a common attack vector where sensitive data is unintentionally exposed?

Using namespaces to isolate environments

Exposed secrets in source code or configuration files

A company wants to minimize the risk of secrets being exposed if a container is compromised. Which practice is MOST effective?

Using Kubernetes Secrets with encryption at rest

Mounting secrets as environment variables

Using a secret management tool like HashiCorp Vault with short-lived credentials

A company experiences a data breach where an attacker accessed Secrets in a Kubernetes cluster. The investigation reveals that the attacker used a service account that had 'get' and 'list' permissions on all Secrets. Which of the following is the MOST likely root cause?

The RBAC policy granted excessive permissions to the service account

The API server was exposed to the internet

The cluster had encryption at rest disabled

The service account was compromised

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 6Objective 4

Access to Sensitive Data KCSA Practice Questions (Page 5)

Part of the Kubernetes Threat Model domain, which accounts for 16% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

6concepts

16%of the exam

Questions 21–25

21application · medium
A security analyst is tracing how a compromised application container could access sensitive data stored in the cluster. The container has a service account with permissions to read Secrets. Which path would the attacker MOST likely use?
Select an answer first
22foundation · easy
What is a common attack vector where sensitive data is unintentionally exposed?
Select an answer first
23application · medium
A company wants to minimize the risk of secrets being exposed if a container is compromised. Which practice is MOST effective?
Select an answer first
24expert · hard
A company experiences a data breach where an attacker accessed Secrets in a Kubernetes cluster. The investigation reveals that the attacker used a service account that had 'get' and 'list' permissions on all Secrets. Which of the following is the MOST likely root cause?
Select an answer first
25foundation · easy
What is a potential consequence of sensitive data exposure in a Kubernetes cluster?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.