What is a recommended security practice for kubeconfig files that contain client credentials?

Restrict file permissions to the owner (e.g., 0600) and avoid committing to version control

Encrypt the file with a password and share the password with the team

Store them in a public Git repository for easy sharing

Set file permissions to read-only for all users

A cluster administrator is configuring authentication for a cluster that will be accessed by both human users and automated CI/CD pipelines. The requirement is that human users must use multi-factor authentication (MFA), while pipelines should use non-interactive credentials. Which combination of authentication methods should be used?

Client certificates for human users and static tokens for pipelines

OIDC for both human users and pipelines

OIDC for human users and service account tokens for pipelines

Bearer tokens for human users and client certificates for pipelines

A security audit reveals that a developer's kubeconfig file contains a client certificate that is valid for 10 years. The developer uses this kubeconfig from a personal laptop. Which change best reduces the risk of long-term credential exposure?

Use a bearer token that never expires

Issue a new client certificate with a short validity period and configure the kubeconfig to use it

Remove the certificate and rely on anonymous access

Store the kubeconfig in a public repository for backup

A pod running in a namespace needs to call the Kubernetes API to list pods in the same namespace. The pod uses the default service account. What is the most secure way to grant this permission?

Create a Role and RoleBinding for the default service account in that namespace

Place the kubeconfig with admin credentials inside the pod

Create a dedicated service account, bind a Role with list permission to it, and set the pod's serviceAccountName to that account

Create a ClusterRole and ClusterRoleBinding for the default service account

What happens when a request to the Kubernetes API server cannot be authenticated by any configured authentication method?

The request is assigned the 'system:masters' group for troubleshooting

The request is automatically denied with a 401 Unauthorized response

The request is redirected to an authentication webhook for a second attempt

The request is treated as anonymous and may be allowed if anonymous access is enabled and RBAC permits it

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 3Objective 2

Authentication and Authorization KCSA Practice Questions (Page 3)

Part of the Kubernetes Security Fundamentals domain, which accounts for 22% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

4concepts

22%of the exam

Questions 11–15

11foundation · easy
What is a recommended security practice for kubeconfig files that contain client credentials?
Select an answer first
12expert · hard
A cluster administrator is configuring authentication for a cluster that will be accessed by both human users and automated CI/CD pipelines. The requirement is that human users must use multi-factor authentication (MFA), while pipelines should use non-interactive credentials. Which combination of authentication methods should be used?
Select an answer first
13application · medium
A security audit reveals that a developer's kubeconfig file contains a client certificate that is valid for 10 years. The developer uses this kubeconfig from a personal laptop. Which change best reduces the risk of long-term credential exposure?
Select an answer first
14application · medium
A pod running in a namespace needs to call the Kubernetes API to list pods in the same namespace. The pod uses the default service account. What is the most secure way to grant this permission?
Select an answer first
15foundation · easy
What happens when a request to the Kubernetes API server cannot be authenticated by any configured authentication method?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.