Controller Manager KCSA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security audit reveals that the kube-controller-manager is running with `--authorization-mode=AlwaysAllow`. The cluster is in a production environment. Which of the following is the most immediate and significant risk?

   • AThe controller manager will not be able to authenticate to the API server.
   • BThe controller manager will not be able to communicate with the API server over TLS.
   • CThe controller manager will not be able to read Secrets from the API server.
   • DAny process that can reach the controller manager's secure port can perform any action, such as creating or deleting Pods.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security engineer is reviewing the kube-controller-manager configuration. They notice that `--authorization-mode=RBAC` is set, but the controller manager is using a kubeconfig file that points to the API server with a token that has `cluster-admin` privileges. What is the most significant security concern with this configuration?

   • AThe controller manager will not be able to authenticate to the API server because it is using a token.
   • BThe controller manager can perform any action on the cluster, which violates the principle of least privilege.
   • CThe `--authorization-mode=RBAC` setting is ineffective because the controller manager is not using RBAC for its own endpoints.
   • DThe controller manager will not be able to communicate with the API server over TLS.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security engineer is reviewing the control plane components and wants to identify which controller is responsible for ensuring that a newly created Service with a selector has its endpoints populated. Which controller's logs should the engineer examine?

   • AThe Namespace controller
   • BThe EndpointSlice controller
   • CThe ReplicationController
   • DThe Service controller
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which controller is responsible for maintaining the list of IP addresses for a Service?

   • AEndpoint controller
   • BReplication controller
   • CNamespace controller
   • DNode controller
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a potential security risk associated with the kube-controller-manager?

   • AIt allows any pod to schedule onto any node without authentication
   • BIt is exposed on port 10250, which allows unauthenticated access
   • CIt stores all cluster secrets in plaintext on the local filesystem
   • DIt runs with a service account that has broad cluster-wide permissions
   Reveal Solution Discussion Select an answer first