A Pod needs to read a Secret that is updated periodically. The team mounts the Secret as a volume, but the application does not see the updated value. The Secret is updated using 'kubectl apply'. What is the most likely cause?

The Secret type does not support updates.

The application is caching the file contents and does not re-read the file.

The Secret was not updated because 'kubectl apply' does not update existing Secrets.

The volume mount is read-only and cannot be updated.

A security audit finds that many users have cluster-admin access, and some of them are reading Secrets they do not need. The team wants to enforce least privilege for Secret access. Which action should they take?

Move Secrets to a separate cluster.

Create RBAC roles that grant get/list/watch on Secrets only to specific service accounts or users.

Use a Secret type that is hidden from users.

Enable encryption at rest for Secrets.

A team needs to create a Secret containing a username and password for a database. They want to avoid storing the credentials in a manifest file that is checked into source control. Which approach should they use?

Embed the credentials in the container image.

Use a ConfigMap to store the credentials.

Use 'kubectl create secret generic' with the --from-literal flags.

Write a Secret manifest and store it in a private Git repository.

A Pod needs to read a database password from a Secret. The security team requires that the password not be exposed in the container's environment variables or in the process list. Which method should be used to provide the Secret to the Pod?

Set the Secret as an environment variable using the valueFrom field.

Embed the password directly in the container image.

Use a ConfigMap to store the password and mount it as a volume.

Mount the Secret as a volume and read the file from the container.

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 3Objective 4

Data Protection KCSA Practice Questions (Page 2)

Part of the Kubernetes Security Fundamentals domain, which accounts for 22% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 14 practice questions to prepare you well beyond it. (estimate)

14questions here

3free pages

5concepts

22%of the exam

Questions 6–10

6foundation · easy
A cluster administrator needs to create a Secret to store credentials for pulling images from a private Docker registry. Which built-in Secret type should be used?
Select an answer first
7expert · hard
A Pod needs to read a Secret that is updated periodically. The team mounts the Secret as a volume, but the application does not see the updated value. The Secret is updated using 'kubectl apply'. What is the most likely cause?
Select an answer first
8application · medium
A security audit finds that many users have cluster-admin access, and some of them are reading Secrets they do not need. The team wants to enforce least privilege for Secret access. Which action should they take?
Select an answer first
9application · medium
A team needs to create a Secret containing a username and password for a database. They want to avoid storing the credentials in a manifest file that is checked into source control. Which approach should they use?
Select an answer first
10application · medium
A Pod needs to read a database password from a Secret. The security team requires that the password not be exposed in the container's environment variables or in the process list. Which method should be used to provide the Secret to the Pod?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.