Compliance Frameworks KCSA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company handles both health records and credit card data in the same Kubernetes cluster. They need to comply with both HIPAA and PCI DSS. What is a key challenge they will face?

   • ACompliance with one framework automatically ensures compliance with the other.
   • BIt is impossible to comply with both frameworks in the same cluster.
   • CThe two frameworks have overlapping but distinct control requirements that must be mapped and implemented together.
   • DThe frameworks require completely separate clusters with no shared components.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An auditor requires evidence that all changes to a Kubernetes cluster are reviewed and approved. The team has audit logging enabled but no formal change management process. What should they do to satisfy this requirement?

   • AImplement a change management process that requires approval for changes and use audit logs to verify that only approved changes were made.
   • BRestrict access to the cluster to only the security team.
   • CEnable audit logging and assume that all logged changes are approved.
   • DUse a NetworkPolicy to block changes to the cluster.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A financial services company is preparing for a SOC 2 audit of their Kubernetes environment. The auditor requires evidence of who accessed the cluster and what actions they performed. Which approach should the team take to meet this requirement?

   • AEnable audit logging but only keep logs for 24 hours to minimize storage costs.
   • BUse Kubernetes Events and store them in a ConfigMap for later review.
   • CEnable verbose logging on all application containers and store logs in the cluster's etcd.
   • DEnable Kubernetes audit logging and forward the logs to a centralized SIEM with long-term retention.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company must comply with SOC 2's requirement for logical and physical access controls. They have a Kubernetes cluster with sensitive workloads. Which combination of controls should they implement to address both logical and physical access?

   • ANetworkPolicies for logical access and audit logging for physical access.
   • BResourceQuotas for logical access and a backup solution for physical access.
   • CRBAC for logical access control and node-level security (e.g., restricted SSH access, hardware security modules) for physical access.
   • DPodSecurity admission for logical access and a monitoring system for physical access.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   To meet encryption requirements from frameworks like PCI DSS, what should be configured in a Kubernetes cluster?

   • AResource quotas
   • BPod priority classes
   • CNetwork policies
   • DEncryption at rest and in transit (e.g., TLS, etcd encryption)
   Reveal Solution Discussion Select an answer first