A Kubernetes administrator wants to switch from one CRI-compliant runtime to another without changing the kubelet configuration. Which aspect of the CRI makes this possible?

CRI provides a standard API for kubelet to interact with any runtime

CRI requires all runtimes to use the same image format

CRI is a plugin that runs inside the kubelet

CRI automatically detects and configures the runtime

A security team is hardening their container runtime configuration. They want to ensure that containers cannot escalate privileges by gaining additional capabilities beyond the default set. Which configuration should they apply?

Drop all capabilities and add only the required ones

Use a read-only root filesystem

Set the container's securityContext to run as non-root

Enable seccomp with a default profile

A security team discovered that a container runtime vulnerability allows a malicious container to escape to the host. They need to mitigate this risk immediately. Which action is the most effective immediate mitigation?

Enable seccomp profiles on all containers

Update the container runtime to the latest patched version

Drop all capabilities from containers

Restrict containers to run as non-root

What is the primary purpose of monitoring container runtime activity?

To automatically patch container images

To reduce container startup time

To replace the need for network security policies

To detect suspicious behavior and potential security incidents

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 2Objective 5

Container Runtime KCSA Practice Questions (Page 3)

Part of the Kubernetes Cluster Component Security domain, which accounts for 22% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

8concepts

22%of the exam

Questions 11–15

11application · medium
A cluster administrator wants to run containers with reduced privileges by ensuring that the root user inside the container is mapped to a non-root user on the host. Which runtime security feature should they enable?
Select an answer first
12application · medium
A Kubernetes administrator wants to switch from one CRI-compliant runtime to another without changing the kubelet configuration. Which aspect of the CRI makes this possible?
Select an answer first
13application · medium
A security team is hardening their container runtime configuration. They want to ensure that containers cannot escalate privileges by gaining additional capabilities beyond the default set. Which configuration should they apply?
Select an answer first
14application · medium
A security team discovered that a container runtime vulnerability allows a malicious container to escape to the host. They need to mitigate this risk immediately. Which action is the most effective immediate mitigation?
Select an answer first
15foundation · easy
What is the primary purpose of monitoring container runtime activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.