KCSAUpdated 8d ago · Aug 28, 2026

KCSA: Kubernetes and Cloud Native Security Associate

60 questions across 1 topics, with suggested answers, explanations where available, and imported community discussion. The first 6 questions are free to preview.

Browse questions Practice mode

Topics

#	Topic	Questions	Free
1	Kubernetes Security Fundamentals	60	6

Preview

6 of 60 accessible

Question 1 · Kubernetes Security Fundamentals Open

Which of the following is a data-plane isolation measure in a Kubernetes multi-tenancy scenario?

Answer: A Assigning each tenant’s Pods to a dedicated set of worker nodes isolates their runtime workloads and reduces cross-tenant exposure through shared compute infrastructure.

Question 2 · Kubernetes Threat Model Open

An attacker has turned off log forwarding for a Kubernetes cluster to conceal evidence of malicious activity from incident response. Which STRIDE attack type does this represent?

Answer: A Repudiation involves undermining accountability or auditability so that actions cannot be reliably traced to an actor. Disabling log forwarding suppresses evidence needed for incident response and attribution.

Question 3 · Kubernetes Cluster Component Security Open

Which component should have direct network-level access to etcd?

Answer: D etcd is the Kubernetes cluster’s sensitive backing datastore. Direct access can read or alter cluster state and bypass Kubernetes API authorization, admission, and audit controls, so network access should be restricted to the Kubernetes API server. [Kubernetes: API Server Bypass Risks](https://kubernetes.io/docs/concepts/security/api-server-bypass-risks/) **Learn more:** [Kubernetes API Server Bypass Risks](https://kubernetes.io/docs/concepts/security/api-server-bypass-risks/) · [Operating etcd clusters for Kubernetes](https://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/)