A cluster administrator discovers that a kubelet client certificate was accidentally exposed in a public repository. What is the immediate action to mitigate the risk?

Delete the certificate from the repository and continue using it

Increase the certificate's validity period to reduce future renewals

Revoke the certificate and issue a new one for the affected node

Rotate the cluster CA and reissue all certificates

A cluster administrator is planning to rotate the cluster CA in a production cluster. They are concerned about the impact on existing certificates. What is the most important consideration?

All existing certificates must be reissued and all components must trust the new CA

The cluster will be unavailable for a few minutes

The etcd database will be corrupted

The kubelet certificates will automatically renew

A cluster administrator is planning the certificate lifecycle for a production cluster. They want to minimize downtime during certificate renewal. What is the best approach?

Use certificates with a 10-year validity to avoid frequent renewals

Wait until certificates expire and then renew them all at once

Renew certificates before they expire and use a rolling restart of components

Renew certificates only when a security incident occurs

A security team discovers that the cluster CA private key was exposed in a log file. They need to respond. What is the most appropriate action?

Disable the cluster until the log file is deleted

Rotate the cluster CA and reissue all certificates

Increase the logging level to monitor for unauthorized use

Revoke only the certificates that were in the log file

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 4Objective 5

PKI KCSA Practice Questions (Page 1)

Part of the Platform Security domain, which accounts for 16% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–1 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

7concepts

16%of the exam

Questions 1–5

1application · medium
A cluster administrator discovers that a kubelet client certificate was accidentally exposed in a public repository. What is the immediate action to mitigate the risk?
Select an answer first
2expert · hard
A cluster administrator is planning to rotate the cluster CA in a production cluster. They are concerned about the impact on existing certificates. What is the most important consideration?
Select an answer first
3application · medium
A cluster administrator is planning the certificate lifecycle for a production cluster. They want to minimize downtime during certificate renewal. What is the best approach?
Select an answer first
4foundation · easy
Which Kubernetes component uses a certificate to authenticate to the kube-apiserver?
Select an answer first
5expert · hard
A security team discovers that the cluster CA private key was exposed in a log file. They need to respond. What is the most appropriate action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.