What is the purpose of admission controllers in the kubelet?

To manage network traffic between pods

To store pod specifications in etcd

To enforce security policies on pods before they are admitted to the node

How does the kubelet apply security contexts to containers?

By passing the security context to the container runtime via the CRI

By setting environment variables in the container

By directly modifying the container image

By editing the pod's spec in etcd

A monitoring tool needs to retrieve pod metrics from the kubelet's /metrics endpoint. The tool runs as a pod in the cluster and uses a ServiceAccount. The kubelet is configured with --authorization-mode=Webhook. What must be configured to allow the ServiceAccount to access the metrics endpoint?

Set --anonymous-auth=true on the kubelet to allow the ServiceAccount to access metrics

Configure the kubelet's --client-ca-file to trust the ServiceAccount token

Set --authorization-mode=AlwaysAllow on the kubelet

Create a ClusterRole and ClusterRoleBinding that grants the ServiceAccount permission to access the /metrics endpoint

A pod is configured with a seccomp profile that uses the 'localhost' type and references a profile file. The kubelet is expected to make this profile available to the container runtime. Where must the profile file be located on the node?

In the API server's configuration directory

In the container runtime's default seccomp directory

In the directory specified by the kubelet's --seccomp-profile-root flag

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 2Objective 4

Kubelet KCSA Practice Questions (Page 1)

Part of the Kubernetes Cluster Component Security domain, which accounts for 22% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

8concepts

22%of the exam

Questions 1–5

1foundation · easy
What is the purpose of admission controllers in the kubelet?
Select an answer first
2application · medium
A cluster administrator is hardening a kubelet and wants to ensure that the kubelet does not serve any unauthenticated endpoints. The kubelet currently has the read-only port enabled. Which flag should be set to disable the read-only port?
Select an answer first
3foundation · easy
How does the kubelet apply security contexts to containers?
Select an answer first
4application · medium
A monitoring tool needs to retrieve pod metrics from the kubelet's /metrics endpoint. The tool runs as a pod in the cluster and uses a ServiceAccount. The kubelet is configured with --authorization-mode=Webhook. What must be configured to allow the ServiceAccount to access the metrics endpoint?
Select an answer first
5application · medium
A pod is configured with a seccomp profile that uses the 'localhost' type and references a profile file. The kubelet is expected to make this profile available to the container runtime. Where must the profile file be located on the node?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.