What is the recommended way to store private keys for Kubernetes components?

In a file on the node with restricted file permissions (e.g., 0600)

In a Kubernetes Secret with default permissions

Who is responsible for approving a CertificateSigningRequest (CSR) in a Kubernetes cluster?

A cluster administrator or an automated approval policy

The kubelet on the node where the request originated

What should be done first if a Kubernetes component's private key is suspected to be compromised?

Ignore it if the certificate has not expired

Revoke the associated certificate and rotate the key

Restart the component to clear the compromise

Backup the key for forensic analysis

What is the primary reason for regularly rotating Kubernetes certificates?

To reduce the size of the etcd database

To improve performance of the API server

To enable new features in the cluster

To reduce the risk of key compromise and limit the impact of a potential breach

In Kubernetes, what is the purpose of a CertificateSigningRequest (CSR) resource?

To revoke an existing certificate

To encrypt communication between pods

To request a certificate from the cluster CA

To store the private key of a component

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 4Objective 5

PKI KCSA Practice Questions (Page 4)

Part of the Platform Security domain, which accounts for 16% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–1 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

7concepts

16%of the exam

Questions 16–20

16foundation · easy
What is the recommended way to store private keys for Kubernetes components?
Select an answer first
17foundation · easy
Who is responsible for approving a CertificateSigningRequest (CSR) in a Kubernetes cluster?
Select an answer first
18foundation · easy
What should be done first if a Kubernetes component's private key is suspected to be compromised?
Select an answer first
19foundation · easy
What is the primary reason for regularly rotating Kubernetes certificates?
Select an answer first
20foundation · easy
In Kubernetes, what is the purpose of a CertificateSigningRequest (CSR) resource?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.