A DevOps team is responsible for a Kubernetes cluster that runs a critical database. The database uses a PersistentVolume for its data. The team wants to ensure that the data is protected against accidental deletion and corruption. They have already configured the underlying storage to be encrypted at rest. What additional step should they take to meet this goal?

Set the PersistentVolume's 'accessModes' to 'ReadWriteMany'.

Create a CronJob that periodically takes a snapshot of the PersistentVolume using the CSI snapshot API.

Enable etcd encryption to protect the PersistentVolume's metadata.

Set the PersistentVolume's 'persistentVolumeReclaimPolicy' to 'Retain'.

A cluster administrator wants to ensure that a specific set of pods, which process sensitive data, cannot be scheduled on the same node as other less-trusted pods. The administrator also wants to ensure that these pods cannot access the host's network namespace. Which two features should be combined to achieve this?

Taints and tolerations on the nodes and a NetworkPolicy that denies egress to the host network.

Pod anti-affinity rules and a SecurityContext with 'hostNetwork: false'.

ResourceQuota and a LimitRange in the namespace.

Node affinity rules and a Pod Security Admission label of 'baseline'.

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 3Objective 1

Cluster Components Security KCSA Practice Questions (Page 1)

Part of the Kubernetes Security Fundamentals domain, which accounts for 22% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

5concepts

22%of the exam

Questions 1–5

1application · medium
A DevOps team is responsible for a Kubernetes cluster that runs a critical database. The database uses a PersistentVolume for its data. The team wants to ensure that the data is protected against accidental deletion and corruption. They have already configured the underlying storage to be encrypted at rest. What additional step should they take to meet this goal?
Select an answer first
2foundation · easy
Which Kubernetes feature is used to define a set of conditions that a Pod must meet to be admitted into the cluster, such as requiring specific user IDs or filesystem groups?
Select an answer first
3application · medium
A cluster administrator wants to ensure that a specific set of pods, which process sensitive data, cannot be scheduled on the same node as other less-trusted pods. The administrator also wants to ensure that these pods cannot access the host's network namespace. Which two features should be combined to achieve this?
Select an answer first
4foundation · easy
Which Kubernetes resource is used to control traffic flow between Pods based on labels and ports?
Select an answer first
5foundation · easy
Which Kubernetes resource defines how storage is provisioned, including options like encryption and performance characteristics?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.

Cluster Components Security KCSA Practice Questions (Page 1)

Questions 1–5

Which Kubernetes feature is used to define a set of conditions that a Pod must meet to be admitted into the cluster, such as requiring specific user IDs or filesystem groups?

Which Kubernetes resource is used to control traffic flow between Pods based on labels and ports?

Which Kubernetes resource defines how storage is provisioned, including options like encryption and performance characteristics?

Keep studying — Kubernetes Security Fundamentals