Controller Manager KCSA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A cluster administrator is performing a security audit. They discover that the kube-controller-manager is running with the `--port=0` flag. Which of the following best describes the security implication of this configuration?

   • AIt disables the insecure HTTP port, which is a recommended security hardening measure.
   • BIt allows the controller manager to listen on all network interfaces, increasing its attack surface.
   • CIt is a misconfiguration that will prevent the controller manager from starting.
   • DIt enables the secure HTTPS port, which is required for all controller manager communication.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In which part of a Kubernetes cluster does the kube-controller-manager typically run?

   • AIn the control plane, often as a static pod or systemd service
   • BInside the etcd cluster as a distributed service
   • COn every worker node alongside the kubelet
   • DAs a DaemonSet that runs on every node in the cluster
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which controller is responsible for ensuring that the desired number of pod replicas are running?

   • AService account controller
   • BNode controller
   • CEndpoint controller
   • DReplication controller
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A cluster administrator is setting up a new Kubernetes cluster and wants to ensure the kube-controller-manager is secure by default. Which of the following is a recommended security best practice for the kube-controller-manager?

   • ADisable the insecure port and enable the secure port with TLS
   • BBind the controller manager to all network interfaces
   • CUse the default kubeconfig with cluster-admin privileges
   • DEnable the insecure port for easier debugging
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A developer is creating a new Namespace and wants to ensure that when the Namespace is deleted, all resources within it are also deleted. Which controller is responsible for this cleanup?

   • AThe ReplicationController
   • BThe EndpointSlice Controller
   • CThe Garbage Collector
   • DThe Namespace Controller
   Reveal Solution Discussion Select an answer first