A security auditor flags that the kubelet on a production node is accepting requests from unauthenticated clients on port 10250. The cluster uses a private VPC with no public exposure, and all legitimate monitoring agents authenticate using client certificates issued by the cluster CA. You need to block anonymous access while preserving the ability of the monitoring agents to query kubelet metrics. What should you configure?

Set --anonymous-auth=false and --authorization-mode=Webhook on the kubelet

Set --anonymous-auth=true and --authorization-mode=AlwaysAllow on the kubelet

Set --client-ca-file to the cluster CA and leave --anonymous-auth at its default

Set --read-only-port=10250 and --authorization-mode=AlwaysAllow on the kubelet

What is the primary role of the kubelet in a Kubernetes cluster?

To manage the cluster's network policies and service discovery

To act as the primary node agent that manages pods and containers on a node

To serve as the API gateway for external users to interact with the cluster

To store cluster state and manage etcd database operations

How does the kubelet communicate with the Kubernetes control plane?

By using the Kubernetes API server over HTTPS

By using a peer-to-peer mesh network with other nodes

By using SSH to the control plane nodes

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 2Objective 4

Kubelet KCSA Practice Questions (Page 4)

Part of the Kubernetes Cluster Component Security domain, which accounts for 22% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

8concepts

22%of the exam

Questions 16–20

16foundation · easy
Where does the kubelet write its logs by default?
Select an answer first
17application · medium
A security auditor flags that the kubelet on a production node is accepting requests from unauthenticated clients on port 10250. The cluster uses a private VPC with no public exposure, and all legitimate monitoring agents authenticate using client certificates issued by the cluster CA. You need to block anonymous access while preserving the ability of the monitoring agents to query kubelet metrics. What should you configure?
Select an answer first
18foundation · easy
What is the primary role of the kubelet in a Kubernetes cluster?
Select an answer first
19foundation · easy
Which authentication mechanism is commonly used for the kubelet to authenticate to the API server?
Select an answer first
20foundation · easy
How does the kubelet communicate with the Kubernetes control plane?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.

Kubelet KCSA Practice Questions (Page 4)

Questions 16–20

Where does the kubelet write its logs by default?

What is the primary role of the kubelet in a Kubernetes cluster?

Which authentication mechanism is commonly used for the kubelet to authenticate to the API server?

How does the kubelet communicate with the Kubernetes control plane?

Keep studying — Kubernetes Cluster Component Security