Kubernetes and Cloud Native Security Associate (KCSA)
Domain 2Objective 4
Kubelet KCSA Practice Questions (Page 2)
Part of the Kubernetes Cluster Component Security domain, which accounts for 22% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)
23questions here
5free pages
8concepts
22%of the exam
Questions 6–10
- 6
Which of the following is a recommended kubelet hardening practice?
Select an answer first - 7
A security team is investigating a potential compromise where an attacker gained access to a pod and attempted to query the kubelet API. The kubelet has --anonymous-auth=false and --authorization-mode=Webhook. The team wants to review the exact requests made to the kubelet, including the request body, to understand what the attacker attempted. Which logging configuration should they enable?
Select an answer first - 8
What is the effect of setting --anonymous-auth=false on the kubelet?
Select an answer first - 9
A kubelet is failing to register with the API server. The kubelet logs show 'TLS handshake error' when connecting to the API server. The kubelet is configured with a kubeconfig that points to the API server, but the client certificate has expired. What is the most direct fix?
Select an answer first - 10
Which kubelet flag enables authentication for requests to the kubelet's API?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.