A security analyst is reviewing audit logs and notices a series of events where a service account named 'ci-builder' is creating pods with hostPath volumes that mount the host's /etc directory. The service account has cluster-admin privileges. Which finding is the most critical security concern?

The service account has excessive privileges that allow it to access the host filesystem.

The audit logs show that the service account is not using a dedicated namespace.

The service account is creating pods, which is unusual for a CI system.

The pods are using hostPath volumes, which are not allowed in production.

In an audit policy file, what is the effect of a rule that specifies 'level: None'?

The event is logged with the highest verbosity

Events matching the rule are not logged

Only the request body is logged

A company wants to ensure that data transmitted between the kubelet and the API server is encrypted. They have already enabled TLS for the API server. What else must be configured?

The API server must be configured to use a KMS provider for encryption.

The kubelet's read-only port must be disabled.

The kubelet must be configured with a server certificate and serve on HTTPS.

The API server must be configured to use a webhook audit backend.

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 3Objective 6

Auditing and Monitoring KCSA Practice Questions (Page 5)

Part of the Kubernetes Security Fundamentals domain, which accounts for 22% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

22%of the exam

Questions 21–25

21expert · hard
A security analyst is reviewing audit logs and notices a series of events where a service account named 'ci-builder' is creating pods with hostPath volumes that mount the host's /etc directory. The service account has cluster-admin privileges. Which finding is the most critical security concern?
Select an answer first
22foundation · easy
In an audit policy file, what is the effect of a rule that specifies 'level: None'?
Select an answer first
23foundation · easy
In a Kubernetes audit log event, which field identifies the stage of the request handling at which the event was generated?
Select an answer first
24application · medium
A company wants to ensure that data transmitted between the kubelet and the API server is encrypted. They have already enabled TLS for the API server. What else must be configured?
Select an answer first
25foundation · easy
In the data flow of a Kubernetes cluster, which component is responsible for persisting the cluster state?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.

Auditing and Monitoring KCSA Practice Questions (Page 5)

Questions 21–25

A security analyst is reviewing audit logs and notices a series of events where a service account named 'ci-builder' is creating pods with hostPath volumes that mount the host's /etc directory. The service account has cluster-admin privileges. Which finding is the most critical security concern?

In an audit policy file, what is the effect of a rule that specifies 'level: None'?

In a Kubernetes audit log event, which field identifies the stage of the request handling at which the event was generated?

A company wants to ensure that data transmitted between the kubelet and the API server is encrypted. They have already enabled TLS for the API server. What else must be configured?

In the data flow of a Kubernetes cluster, which component is responsible for persisting the cluster state?

Keep studying — Kubernetes Security Fundamentals