A security team is reviewing how private keys are stored on Kubernetes worker nodes. They want to ensure that the kubelet client certificate private key is protected. What is the best practice?

Store the key in a Kubernetes Secret and mount it into the kubelet

Place the key in a file with permissions set to 0400 and owned by root

Store the key in etcd as a base64-encoded string

Embed the key in the kubelet's systemd unit file

A developer wants to create a custom controller that requests a certificate for a new webhook. They plan to use Kubernetes' built-in CSR API. What is the correct sequence of steps?

Create a CSR object, wait for approval, then generate a key pair

Submit a certificate directly to the API server for signing

Generate a key pair, create a CSR object, submit it, wait for approval, then retrieve the signed certificate

Use the kubelet's bootstrap mechanism to request a certificate

What is the purpose of certificate revocation?

To extend the validity period of a certificate

To generate a new key pair for the certificate holder

To back up the certificate and private key

To invalidate a certificate before its natural expiration

A new administrator is troubleshooting why a kubelet cannot authenticate to the kube-apiserver. The kubelet certificate is signed by a different CA than the one the API server trusts. What is the root cause?

The trust chain is broken because the kubelet's certificate is not signed by the API server's trusted CA

The kubelet's certificate has expired

The kubelet is using the wrong private key

The API server's certificate is not trusted by the kubelet

A cluster administrator notices that the kube-apiserver certificate is about to expire. The cluster was provisioned with kubeadm. What is the recommended way to renew this certificate?

Manually generate a new certificate with openssl and replace the file

Run 'kubeadm certs renew apiserver' and restart the kube-apiserver

Run 'kubeadm upgrade apply' to renew all certificates automatically

Delete the certificate and let the kube-apiserver regenerate it on restart

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 4Objective 5

PKI KCSA Practice Questions (Page 5)

Part of the Platform Security domain, which accounts for 16% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–1 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

7concepts

16%of the exam

Questions 21–25

21application · medium
A security team is reviewing how private keys are stored on Kubernetes worker nodes. They want to ensure that the kubelet client certificate private key is protected. What is the best practice?
Select an answer first
22application · medium
A developer wants to create a custom controller that requests a certificate for a new webhook. They plan to use Kubernetes' built-in CSR API. What is the correct sequence of steps?
Select an answer first
23foundation · easy
What is the purpose of certificate revocation?
Select an answer first
24application · medium
A new administrator is troubleshooting why a kubelet cannot authenticate to the kube-apiserver. The kubelet certificate is signed by a different CA than the one the API server trusts. What is the root cause?
Select an answer first
25application · medium
A cluster administrator notices that the kube-apiserver certificate is about to expire. The cluster was provisioned with kubeadm. What is the recommended way to renew this certificate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.