A security engineer wants to automatically rotate the TLS certificates used by a web application running in the cluster. The certificates are stored as Kubernetes Secrets. They want to minimize manual intervention and ensure the application picks up the new certificates without downtime. What is the most effective automation?

Write a CronJob that manually updates the Secret every 90 days and restarts the application Pods.

Use a ValidatingAdmissionPolicy to require that certificates are valid for at least 90 days.

Use cert-manager to automatically issue and renew certificates, and configure the application to watch for Secret updates and reload the certificate.

Use kube-bench to check the certificate expiration and alert the team.

A multi-team organization wants to ensure that only approved container images are used in their clusters. They have a private registry and want to block any Pod that references an image from an external registry. What is the most effective way to enforce this?

Use a NetworkPolicy to block egress traffic to external registries.

Use a CronJob to scan all running Pods and report any that use external images.

Use kube-bench to check the image registry configuration.

Use an admission controller that validates the image registry and denies Pods that reference external registries.

What is the core idea of policy-as-code in Kubernetes security?

Storing security policies in a database for manual retrieval

Writing security policies in a human-readable language and storing them in version control

Using a firewall to enforce network security rules

Writing policies in a natural language like English for documentation

How does a tool like OPA/Gatekeeper integrate with Kubernetes to enforce policies?

By requiring developers to run the tool manually before deploying

By running as a standalone service that scans the cluster periodically

By intercepting API requests through admission webhooks and evaluating them against policies

By modifying the Kubernetes source code to include policy checks

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 5Objective 4

Automation and Tooling KCSA Practice Questions (Page 3)

Part of the Compliance and Security Frameworks domain, which accounts for 10% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

5concepts

10%of the exam

Questions 11–15

11application · medium
A security engineer wants to automatically rotate the TLS certificates used by a web application running in the cluster. The certificates are stored as Kubernetes Secrets. They want to minimize manual intervention and ensure the application picks up the new certificates without downtime. What is the most effective automation?
Select an answer first
12application · medium
A multi-team organization wants to ensure that only approved container images are used in their clusters. They have a private registry and want to block any Pod that references an image from an external registry. What is the most effective way to enforce this?
Select an answer first
13foundation · easy
What is the core idea of policy-as-code in Kubernetes security?
Select an answer first
14foundation · easy
How does a tool like OPA/Gatekeeper integrate with Kubernetes to enforce policies?
Select an answer first
15foundation · easy
Which tool is commonly used to scan Kubernetes manifests and clusters for misconfigurations against security frameworks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.

Automation and Tooling KCSA Practice Questions (Page 3)

Questions 11–15

A multi-team organization wants to ensure that only approved container images are used in their clusters. They have a private registry and want to block any Pod that references an image from an external registry. What is the most effective way to enforce this?

What is the core idea of policy-as-code in Kubernetes security?

How does a tool like OPA/Gatekeeper integrate with Kubernetes to enforce policies?

Which tool is commonly used to scan Kubernetes manifests and clusters for misconfigurations against security frameworks?

Keep studying — Compliance and Security Frameworks