Which certificate is used to secure communication between the kube-apiserver and etcd?

The service account signing key

The kube-apiserver's serving certificate

A security incident response team is handling a compromised kube-apiserver certificate. What is the most important step after revoking the certificate?

Increase the logging level on the API server

Delete the old certificate from all nodes

Issue a new certificate and update all components that trust the old one

Restart all control plane components

A security engineer is configuring a new Kubernetes cluster and wants to ensure that the kube-apiserver can verify the identity of the kubelet. What is the most secure configuration?

Use the same CA for all components to simplify management

Use self-signed certificates for kubelets

Use a dedicated CA for kubelet certificates and configure the API server to trust it

Disable client certificate authentication and use tokens only

How does Kubernetes handle certificate revocation for components like the kubelet?

It relies on the kube-apiserver to reject connections from revoked certificates

It automatically revokes certificates when they expire

It does not have a built-in revocation mechanism; certificates are rotated and replaced

It uses a CertificateRevocationList (CRL) that is checked by all components

A cluster administrator wants to automate the approval of CSRs for kubelet certificates. What is the recommended approach?

Set the kubelet's certificate to never expire

Configure the kubelet to use the bootstrap token and approve CSRs automatically via the 'csrapprover' controller

Use a custom script to approve CSRs based on node name

Manually approve each CSR using kubectl

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 4Objective 5

PKI KCSA Practice Questions (Page 3)

Part of the Platform Security domain, which accounts for 16% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–1 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

7concepts

16%of the exam

Questions 11–15

11foundation · easy
Which certificate is used to secure communication between the kube-apiserver and etcd?
Select an answer first
12application · medium
A security incident response team is handling a compromised kube-apiserver certificate. What is the most important step after revoking the certificate?
Select an answer first
13expert · hard
A security engineer is configuring a new Kubernetes cluster and wants to ensure that the kube-apiserver can verify the identity of the kubelet. What is the most secure configuration?
Select an answer first
14foundation · easy
How does Kubernetes handle certificate revocation for components like the kubelet?
Select an answer first
15application · medium
A cluster administrator wants to automate the approval of CSRs for kubelet certificates. What is the recommended approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.