A company has a policy that all user access to the Kubernetes API must be revocable within 15 minutes of an employee's termination. The cluster currently uses client certificates with a 1-year validity. Which change best meets the policy?

Switch to OIDC authentication and configure token lifetime to 15 minutes

Issue client certificates with a 15-minute validity period

Use static bearer tokens and rotate them daily

Keep client certificates but add a webhook to check revocation status

A cluster uses an authentication webhook for user tokens. The webhook is configured with a failure policy of 'Fail'. During a network partition, the API server cannot reach the webhook. A user with a valid token attempts to access the cluster. What is the outcome?

The request is allowed because the token is valid and the API server trusts it

The request is allowed because the API server falls back to anonymous access

The request is queued until the webhook becomes available

The request is denied because the webhook is unreachable and the failure policy is 'Fail'

A pod needs to authenticate to the Kubernetes API server using a service account. The cluster has legacy service account tokens disabled. What is the recommended way for the pod to obtain a token?

Use the projected service account token mounted at /var/run/secrets/kubernetes.io/serviceaccount/token

Read the token from the mounted service account secret

Use the kubeconfig from the node's filesystem

Generate a static token and place it in the pod's environment variables

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 3Objective 2

Authentication and Authorization KCSA Practice Questions (Page 4)

Part of the Kubernetes Security Fundamentals domain, which accounts for 22% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

4concepts

22%of the exam

Questions 16–19

16expert · hard
A company has a policy that all user access to the Kubernetes API must be revocable within 15 minutes of an employee's termination. The cluster currently uses client certificates with a 1-year validity. Which change best meets the policy?
Select an answer first
17expert · hard
A cluster uses an authentication webhook for user tokens. The webhook is configured with a failure policy of 'Fail'. During a network partition, the API server cannot reach the webhook. A user with a valid token attempts to access the cluster. What is the outcome?
Select an answer first
18foundation · easy
Which authentication method in Kubernetes uses a JSON Web Token (JWT) that is validated by the API server against an external identity provider?
Select an answer first
19application · medium
A pod needs to authenticate to the Kubernetes API server using a service account. The cluster has legacy service account tokens disabled. What is the recommended way for the pod to obtain a token?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.

Authentication and Authorization KCSA Practice Questions (Page 4)

Questions 16–19

A company has a policy that all user access to the Kubernetes API must be revocable within 15 minutes of an employee's termination. The cluster currently uses client certificates with a 1-year validity. Which change best meets the policy?

A cluster uses an authentication webhook for user tokens. The webhook is configured with a failure policy of 'Fail'. During a network partition, the API server cannot reach the webhook. A user with a valid token attempts to access the cluster. What is the outcome?

Which authentication method in Kubernetes uses a JSON Web Token (JWT) that is validated by the API server against an external identity provider?

A pod needs to authenticate to the Kubernetes API server using a service account. The cluster has legacy service account tokens disabled. What is the recommended way for the pod to obtain a token?

Keep studying — Kubernetes Security Fundamentals