What is the purpose of the API server's TLS certificate?

To authenticate the API server to clients and encrypt communication.

To authorize users to access cluster resources.

To provide a backup of the cluster's CA certificate.

To encrypt data at rest in etcd.

A security audit reveals that the API server is listening on port 8080 in addition to the secure port 6443. The cluster is running in a production environment. What is the immediate security concern and the recommended action?

Port 8080 is deprecated but still secure; it can be left enabled

Port 8080 is insecure and allows unauthenticated access; disable it by not setting `--insecure-port`

Port 8080 is used for metrics and should be restricted with network policies

Port 8080 is required for kubelet communication; it cannot be disabled

A pod needs to authenticate to the API server using a service account token. The pod is running in the `default` namespace. The service account `my-sa` exists. What must be done to allow the pod to use this service account?

Create a RoleBinding that grants the service account access to the API

Set `serviceAccountName: my-sa` in the pod spec

Create a Secret with the service account token and mount it manually

Set `automountServiceAccountToken: true` in the pod spec

What is the purpose of the audit policy in Kubernetes audit logging?

It defines which admission controllers are enabled.

It defines which users are allowed to access the audit logs.

It defines which events should be logged and at what level of detail.

It defines how long audit logs are retained.

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 2Objective 1

API Server KCSA Practice Questions (Page 4)

Part of the Kubernetes Cluster Component Security domain, which accounts for 22% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

9concepts

22%of the exam

Questions 16–20

16foundation · easy
What is the purpose of the API server's TLS certificate?
Select an answer first
17application · medium
A security audit reveals that the API server is listening on port 8080 in addition to the secure port 6443. The cluster is running in a production environment. What is the immediate security concern and the recommended action?
Select an answer first
18application · medium
A pod needs to authenticate to the API server using a service account token. The pod is running in the `default` namespace. The service account `my-sa` exists. What must be done to allow the pod to use this service account?
Select an answer first
19foundation · easy
What is the purpose of the audit policy in Kubernetes audit logging?
Select an answer first
20foundation · easy
Which of the following is an example of an admission controller that enforces security policies?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.