What is the purpose of enabling TLS for communication between Kubernetes components?

To prevent unauthorized access to the container runtime

To compress network traffic to reduce bandwidth usage

To encrypt data at rest in etcd

To encrypt data in transit and authenticate the communicating parties

A security analyst is investigating a potential data breach and needs to determine if any user accessed a specific ConfigMap that contains database credentials. Which audit log field should they search on?

The 'objectRef.name' field set to the ConfigMap's name.

The 'user.username' field set to the user's name.

The 'responseStatus.code' field set to 200.

A security auditor is reviewing the data flow in a cluster and wants to ensure that sensitive data stored in etcd is protected at rest. They have already enabled encryption at rest for etcd. What additional measure should they take to protect the encryption keys?

Enable audit logging for all etcd access.

Use a stronger encryption algorithm, such as AES-256.

Restrict access to etcd to only the API server.

Store the encryption key in a separate secret management system, such as a KMS provider.

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 3Objective 6

Auditing and Monitoring KCSA Practice Questions (Page 4)

Part of the Kubernetes Security Fundamentals domain, which accounts for 22% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

22%of the exam

Questions 16–20

16foundation · easy
What is the purpose of enabling TLS for communication between Kubernetes components?
Select an answer first
17foundation · easy
Which of the following is a valid audit log backend in Kubernetes?
Select an answer first
18application · medium
A security analyst is investigating a potential data breach and needs to determine if any user accessed a specific ConfigMap that contains database credentials. Which audit log field should they search on?
Select an answer first
19expert · hard
A security auditor is reviewing the data flow in a cluster and wants to ensure that sensitive data stored in etcd is protected at rest. They have already enabled encryption at rest for etcd. What additional measure should they take to protect the encryption keys?
Select an answer first
20foundation · easy
Which API server flag is used to enable the log file audit backend?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.

Auditing and Monitoring KCSA Practice Questions (Page 4)

Questions 16–20

What is the purpose of enabling TLS for communication between Kubernetes components?

Which of the following is a valid audit log backend in Kubernetes?

A security analyst is investigating a potential data breach and needs to determine if any user accessed a specific ConfigMap that contains database credentials. Which audit log field should they search on?

A security auditor is reviewing the data flow in a cluster and wants to ensure that sensitive data stored in etcd is protected at rest. They have already enabled encryption at rest for etcd. What additional measure should they take to protect the encryption keys?

Which API server flag is used to enable the log file audit backend?

Keep studying — Kubernetes Security Fundamentals