PKI KCSA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In a PKI trust chain, what is the role of a root certificate authority (CA)?

   • AIt verifies the identity of users before they can access the network
   • BIt stores all private keys for the organization
   • CIt signs certificates for end users and servers directly
   • DIt is the top-level trust anchor that issues certificates to intermediate CAs or directly to entities
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A cluster administrator discovers that a kubelet certificate was revoked due to a suspected compromise. What is the most important follow-up action?

   • AIncrease the logging level on the kubelet
   • BInvestigate the node for signs of compromise and reissue a new certificate
   • CDelete the node from the cluster
   • DImmediately reissue a new certificate to restore service
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which stage of a certificate's lifecycle involves generating a new key pair and replacing the existing certificate before it expires?

   • ARotation
   • BRenewal
   • CRevocation
   • DIssuance
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which Kubernetes feature automatically renews kubelet certificates before they expire?

   • AThe kube-proxy
   • BThe kube-scheduler
   • CThe etcd leader election
   • DThe kubelet's certificate rotation feature
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security auditor is reviewing the PKI setup of a Kubernetes cluster. They notice that the etcd client certificate is stored in a Kubernetes Secret. What is the auditor's likely concern?

   • AThe Secret is not encrypted at rest
   • BThe Secret cannot be rotated
   • CThe Secret is stored in etcd, which is insecure
   • DThe Secret is accessible to any pod with the appropriate RBAC permissions
   Reveal Solution Discussion Select an answer first