An organization wants to enforce that all Ingress objects use TLS and have a valid certificate specified in the `spec.tls` field. They want to manage this policy as code in a Git repository and have it automatically applied to the cluster. Which tool is best suited for this?

A NetworkPolicy that denies traffic to Ingress objects without TLS.

A Kubernetes CronJob that runs a script to check all Ingress objects and report violations.

kube-bench with a custom profile for Ingress objects.

OPA/Gatekeeper with a ConstraintTemplate that validates Ingress objects for the presence of `spec.tls`.

What is the purpose of running automated compliance checks continuously in a Kubernetes cluster?

To generate reports only when a compliance violation occurs

To replace the need for security monitoring tools

To automatically patch all vulnerabilities

To ensure the cluster remains compliant as configurations change over time

In a Kubernetes environment, which practice is an example of automating the enforcement of a security framework?

Using a policy engine to reject pods that violate the CIS Kubernetes Benchmark

Running a one-time security audit after a major release

Documenting security procedures in a wiki for developers to follow

Manually reviewing each pod's security context before deployment

In a CI/CD pipeline, where is an automated compliance check typically placed to prevent non-compliant workloads from being deployed?

Before the deployment step, as a gate

In a separate manual review process

After the deployment step, as a report

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 5Objective 4

Automation and Tooling KCSA Practice Questions (Page 2)

Part of the Compliance and Security Frameworks domain, which accounts for 10% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

5concepts

10%of the exam

Questions 6–10

6application · medium
An organization wants to enforce that all Ingress objects use TLS and have a valid certificate specified in the `spec.tls` field. They want to manage this policy as code in a Git repository and have it automatically applied to the cluster. Which tool is best suited for this?
Select an answer first
7expert · medium
A security team wants to automate the detection of misconfigured RBAC rules that could allow privilege escalation. They want to integrate this into their CI/CD pipeline and also run it periodically in the cluster. Which tool is best suited for this?
Select an answer first
8foundation · easy
What is the purpose of running automated compliance checks continuously in a Kubernetes cluster?
Select an answer first
9foundation · easy
In a Kubernetes environment, which practice is an example of automating the enforcement of a security framework?
Select an answer first
10foundation · easy
In a CI/CD pipeline, where is an automated compliance check typically placed to prevent non-compliant workloads from being deployed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.