At what point in the API request lifecycle do admission controllers execute?

Only for requests from external users, not for internal components.

Before authentication, to ensure only valid requests are processed.

After authentication and authorization, but before the request is persisted to etcd.

After the request is persisted to etcd, to validate the changes.

A cluster has a requirement to encrypt all communication between the API server and kubelets. The kubelets use self-signed certificates. What must be configured on the API server to allow this?

Set `--kubelet-preferred-address-types` to InternalIP

Set `--kubelet-insecure-tls` to true

Set `--kubelet-certificate-authority` to the CA that signs the kubelet certificates

Set `--kubelet-client-certificate` and `--kubelet-client-key`

Which of the following is a supported authentication method for the Kubernetes API server?

Username and password stored in etcd

What happens if an API request fails the admission controller check?

The request is forwarded to the kubelet for further processing.

The request is persisted but marked as 'admission failed'.

The request is automatically retried after a delay.

The request is rejected and an error is returned to the client.

A developer needs to create and delete pods in the `dev` namespace, but only in that namespace. They authenticate using a client certificate. What RBAC objects should be created?

A ClusterRole and ClusterRoleBinding

A Role and RoleBinding in the `dev` namespace

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 2Objective 1

API Server KCSA Practice Questions (Page 5)

Part of the Kubernetes Cluster Component Security domain, which accounts for 22% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

9concepts

22%of the exam

Questions 21–25

21foundation · easy
At what point in the API request lifecycle do admission controllers execute?
Select an answer first
22expert · hard
A cluster has a requirement to encrypt all communication between the API server and kubelets. The kubelets use self-signed certificates. What must be configured on the API server to allow this?
Select an answer first
23foundation · easy
Which of the following is a supported authentication method for the Kubernetes API server?
Select an answer first
24foundation · easy
What happens if an API request fails the admission controller check?
Select an answer first
25application · medium
A developer needs to create and delete pods in the `dev` namespace, but only in that namespace. They authenticate using a client certificate. What RBAC objects should be created?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.