A cluster uses an authentication webhook to validate bearer tokens. The webhook service becomes temporarily unavailable. What happens to API requests that present a bearer token?

They are redirected to the webhook's backup endpoint

They are allowed because the API server falls back to anonymous access

They are cached and processed once the webhook returns

They are denied because the API server cannot validate the token

A cluster administrator wants to ensure that a service account token cannot be used after the pod that requested it is deleted. Which token type should be used?

Static bearer token from a token file

Client certificate with a long validity period

Projected service account token with an expiration timestamp

A company requires that all user access to the Kubernetes API be authenticated using the corporate single sign-on (SSO) system. Which authentication mechanism should be configured on the API server?

Client certificate authentication

A pod needs to access the Kubernetes API to read secrets in its namespace. The pod uses a service account. The cluster has RBAC enabled. What is the correct way to grant this access?

Create a ClusterRole that allows 'get' on secrets and bind it to the service account

Create a Role that allows 'get' on secrets and bind it to the service account in the namespace

Place the secret in an environment variable and skip RBAC

Grant the default service account admin permissions in the namespace

What is the primary purpose of a Kubernetes service account?

To encrypt network traffic between nodes

To authenticate human users to the cluster

To provide an identity for pods and workloads to authenticate to the API server

To store cluster configuration for kubectl

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 3Objective 2

Authentication and Authorization KCSA Practice Questions (Page 1)

Part of the Kubernetes Security Fundamentals domain, which accounts for 22% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

4concepts

22%of the exam

Questions 1–5

1application · medium
A cluster uses an authentication webhook to validate bearer tokens. The webhook service becomes temporarily unavailable. What happens to API requests that present a bearer token?
Select an answer first
2application · medium
A cluster administrator wants to ensure that a service account token cannot be used after the pod that requested it is deleted. Which token type should be used?
Select an answer first
3application · medium
A company requires that all user access to the Kubernetes API be authenticated using the corporate single sign-on (SSO) system. Which authentication mechanism should be configured on the API server?
Select an answer first
4expert · medium
A pod needs to access the Kubernetes API to read secrets in its namespace. The pod uses a service account. The cluster has RBAC enabled. What is the correct way to grant this access?
Select an answer first
5foundation · easy
What is the primary purpose of a Kubernetes service account?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.