Controller Manager KCSA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst wants to create an alert that triggers when the kube-controller-manager is unable to authenticate to the API server. Which of the following metrics or logs would be most useful for this alert?

   • AThe `process_cpu_seconds_total` metric
   • BThe `rest_client_requests_total` metric with a label for HTTP 401 responses
   • CThe `go_goroutines` metric
   • DThe `workqueue_depth` metric
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team is reviewing the RBAC configuration for the kube-controller-manager. They want to ensure that the controller manager can only perform the actions it needs to manage cluster state, such as reading and updating Pods, Services, and Deployments. Which approach best aligns with the principle of least privilege?

   • ADisable RBAC for the controller manager and rely on the API server's authentication
   • BUse the default `system:kube-controller-manager` ClusterRole, which grants all permissions
   • CGrant the controller manager's service account the `cluster-admin` ClusterRole
   • DCreate a dedicated ClusterRole with specific verbs (get, list, watch, update) on the resources the controller manager manages
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary role of the kube-controller-manager in a Kubernetes cluster?

   • ATo run control loops that reconcile the cluster's actual state with its desired state
   • BTo run container runtimes and manage local node resources
   • CTo schedule pods onto worker nodes based on resource requirements
   • DTo serve the Kubernetes API and persist cluster state in etcd
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A developer is troubleshooting an issue where a Node has been unreachable for 10 minutes, but its Pods are still running. The developer wants to understand which controller is responsible for taking action when a Node becomes unreachable. Which controller should they investigate?

   • AThe EndpointSlice Controller
   • BThe ReplicationController
   • CThe Node Lifecycle Controller
   • DThe Service Controller
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a recommended hardening practice for the kube-controller-manager?

   • AExpose the controller manager's metrics to the public internet for monitoring
   • BEnable the insecure port for easier debugging
   • CRun the controller manager with the --allow-privileged flag set to true
   • DDisable the insecure port and enable TLS on the secure port
   Reveal Solution Discussion Select an answer first