Which configuration is considered a security best practice for container runtimes?

Mounting the host filesystem as read-write

Using the host's network namespace

Enabling user namespace remapping

What is the primary purpose of the Container Runtime Interface (CRI) in Kubernetes?

To provide a command-line interface for container runtime administration

To enforce security policies on container images

To manage the network configuration of containers

To provide a standardized API for Kubernetes to manage container runtimes

What is a trade-off when choosing CRI-O over containerd?

CRI-O is designed specifically for Kubernetes, while containerd is more general-purpose

CRI-O does not support container images

CRI-O is only available for Windows nodes

CRI-O is always more secure than containerd

A security analyst needs to detect anomalous behavior inside containers, such as unexpected system calls. Which monitoring approach would provide the most granular visibility into container runtime activity?

Enable Kubernetes audit logging

Collect container logs with Fluentd

Use Falco to monitor system calls

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 2Objective 5

Container Runtime KCSA Practice Questions (Page 4)

Part of the Kubernetes Cluster Component Security domain, which accounts for 22% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

8concepts

22%of the exam

Questions 16–20

16foundation · easy
Which configuration is considered a security best practice for container runtimes?
Select an answer first
17foundation · easy
What is the primary purpose of the Container Runtime Interface (CRI) in Kubernetes?
Select an answer first
18foundation · easy
What is a trade-off when choosing CRI-O over containerd?
Select an answer first
19application · medium
A security analyst needs to detect anomalous behavior inside containers, such as unexpected system calls. Which monitoring approach would provide the most granular visibility into container runtime activity?
Select an answer first
20foundation · easy
Which Kubernetes component uses the Container Runtime Interface to manage containers on a node?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.