Which of the following is a recommended mitigation for container breakout attacks?

Disable the container runtime's security features to improve performance.

Use the same kernel for all containers to simplify management.

Run containers with the least privileges necessary, dropping all capabilities and using read-only root filesystems.

Run all containers as privileged to ensure they have enough permissions.

A pod running in the `monitoring` namespace is compromised. The attacker extracts the pod's service account token from `/var/run/secrets/kubernetes.io/serviceaccount/token`. The service account `monitor-sa` has a ClusterRoleBinding granting `get` and `list` on `secrets` cluster-wide. What is the most immediate risk from this token theft?

The attacker can access the host node by exploiting the kubelet API.

The attacker can modify ClusterRoles and ClusterRoleBindings.

The attacker can impersonate the pod and read secrets from any namespace, potentially extracting cluster-admin credentials.

The attacker can immediately create new pods in the `monitoring` namespace.

In the Kubernetes threat model, which scenario best describes privilege escalation?

An administrator intentionally grants a service account the ability to list pods in a single namespace.

A developer accidentally deploys a pod with a typo in the image name, causing the deployment to fail.

A node fails and the kubelet restarts, temporarily losing its ability to report status to the control plane.

A user with read-only access to secrets uses a vulnerability in the API server to obtain cluster-admin credentials.

Which node-level resource, if compromised, could provide an attacker with credentials to access the cluster?

The node's /etc/os-release file.

The kubelet's client certificate and key.

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 6Objective 5

Privilege Escalation KCSA Practice Questions (Page 4)

Part of the Kubernetes Threat Model domain, which accounts for 16% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

7concepts

16%of the exam

Questions 16–20

16foundation · easy
Which of the following is a recommended mitigation for container breakout attacks?
Select an answer first
17application · medium
A pod running in the `monitoring` namespace is compromised. The attacker extracts the pod's service account token from `/var/run/secrets/kubernetes.io/serviceaccount/token`. The service account `monitor-sa` has a ClusterRoleBinding granting `get` and `list` on `secrets` cluster-wide. What is the most immediate risk from this token theft?
Select an answer first
18foundation · easy
In the Kubernetes threat model, which scenario best describes privilege escalation?
Select an answer first
19foundation · easy
Which node-level resource, if compromised, could provide an attacker with credentials to access the cluster?
Select an answer first
20foundation · easy
Which RBAC permission, if granted to a user, could allow them to modify cluster-wide security policies?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.

Privilege Escalation KCSA Practice Questions (Page 4)

Questions 16–20

Which of the following is a recommended mitigation for container breakout attacks?

In the Kubernetes threat model, which scenario best describes privilege escalation?

Which node-level resource, if compromised, could provide an attacker with credentials to access the cluster?

Which RBAC permission, if granted to a user, could allow them to modify cluster-wide security policies?

Keep studying — Kubernetes Threat Model