Automation and Tooling KCSA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which statement best describes the primary benefit of using automation to enforce security frameworks in a Kubernetes environment?

   • AIt eliminates the need for human oversight of security controls.
   • BIt ensures consistent, repeatable application of security controls across clusters.
   • CIt replaces the need for security frameworks like CIS Benchmarks.
   • DIt automatically patches all vulnerabilities without any configuration.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company wants to automate the enforcement of a security framework that requires all Secrets to be encrypted at rest. They are using a managed Kubernetes service and want to ensure that the encryption is enabled and cannot be disabled by cluster administrators. What is the best approach?

   • AUse a mutating webhook to encrypt all Secrets before they are stored.
   • BUse the managed service's built-in encryption feature and enforce it with an organizational policy that restricts disabling it.
   • CUse a CronJob to periodically check if encryption is enabled and alert if it is not.
   • DUse a ValidatingAdmissionPolicy that checks the encryption configuration of the cluster.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of a compliance scanner like kube-bench in a Kubernetes environment?

   • ATo manage user authentication and authorization
   • BTo deploy applications to the cluster
   • CTo monitor real-time network traffic for intrusions
   • DTo check the cluster against a set of security best practices and frameworks
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A team wants to add a compliance check to their CI/CD pipeline that fails the build if any Kubernetes manifest in the repository violates a set of security best practices, such as running as root or using privileged containers. They want the check to run before the manifests are applied to the cluster. Which tool should they use?

   • Akubectl apply --dry-run=client
   • Bkube-bench
   • Ckube-score
   • Dkubectl auth can-i
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A compliance team needs to generate a report of all Pods that are running with privileged containers or host network access. They want to run this report automatically every day and have it stored for audit purposes. What is the most appropriate approach?

   • AUse a ValidatingAdmissionPolicy to deny any Pod with privileged or host network access.
   • BUse a CronJob that runs a script to query the Kubernetes API and generate a report in a shared volume.
   • CUse kubectl get pods -o yaml and manually review the output.
   • DUse kube-bench to check for privileged containers.
   Reveal Solution Discussion Select an answer first