A security analyst needs to detect attempts to access the kubelet API with invalid credentials. The cluster uses a centralized logging solution that ingests logs from all nodes. Which configuration should the analyst enable to capture these failed authentication attempts?

Configure the container runtime to log all authentication attempts

Set --v=4 on the kubelet to increase verbosity of all logs

Enable the API server's audit logging by setting --audit-log-path on the kube-apiserver

Enable the kubelet's audit logging by setting --audit-log-path and --audit-policy-file

A DevOps engineer is troubleshooting why a kubelet on a worker node is repeatedly rejecting requests from the API server. The kubelet logs show 'Unauthorized' errors. The node was provisioned with a kubeconfig that references a client certificate, but the certificate was generated with a CN that does not match the node's hostname. The cluster uses Node authorization mode. Which change will resolve the authentication failure?

Set --anonymous-auth=true on the kubelet

Set --authorization-mode=AlwaysAllow on the API server

Regenerate the client certificate with a CN that matches the node's system:node: prefix and hostname

Add the node's hostname to the kubelet's --hostname-override flag

What is the purpose of enabling audit logging for the kubelet?

To record all API requests made to the kubelet

To record pod scheduling decisions

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 2Objective 4

Kubelet KCSA Practice Questions (Page 5)

Part of the Kubernetes Cluster Component Security domain, which accounts for 22% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

8concepts

22%of the exam

Questions 21–23

21application · medium
A security analyst needs to detect attempts to access the kubelet API with invalid credentials. The cluster uses a centralized logging solution that ingests logs from all nodes. Which configuration should the analyst enable to capture these failed authentication attempts?
Select an answer first
22expert · hard
A DevOps engineer is troubleshooting why a kubelet on a worker node is repeatedly rejecting requests from the API server. The kubelet logs show 'Unauthorized' errors. The node was provisioned with a kubeconfig that references a client certificate, but the certificate was generated with a CN that does not match the node's hostname. The cluster uses Node authorization mode. Which change will resolve the authentication failure?
Select an answer first
23foundation · easy
What is the purpose of enabling audit logging for the kubelet?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.

Kubelet KCSA Practice Questions (Page 5)

Questions 21–23

A security analyst needs to detect attempts to access the kubelet API with invalid credentials. The cluster uses a centralized logging solution that ingests logs from all nodes. Which configuration should the analyst enable to capture these failed authentication attempts?

What is the purpose of enabling audit logging for the kubelet?

Keep studying — Kubernetes Cluster Component Security