Free KCSA - Kubernetes and Cloud Security Associate Exam Questions and Answers
KCSA - Kubernetes and Cloud Security Associate is one of the CNCF tests covered here. CNCF owns the curriculum but the exams are sold and proctored by Linux Foundation Training & Certification, taken online, and valid for two years. The mechanism splits sharply, and the name tells you which you are booking: an Associate exam such as KCNA or KCSA is multiple choice, while CKA, CKAD and CKS are performance-based — two hours at a real command line against a live cluster, with no multiple choice at all. Only one prerequisite is enforced anywhere in the programme: CKS requires a passed CKA. No pass mark is published for any of them.
The first 10 questions on this page are free to read, answers included — no account and no card. A plan opens the rest of the bank, the full timed practice test and your weak-topic reporting.
Last updated: September 19, 2026
- Provider
- CNCF
- Questions in our bank
- 1000+
- Free to read
- First 10, with answers
- Official page
- Official Exam website
- Our test mode duration & pass mark
- 130 mins · 70%
- Verified answers
- Reviewed weekly
Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.
Question #1
Which of the following statements best describes the role of the Scheduler in Kubernetes?
Please select an optionIncorrectCorrect answer: D
TheKubernetes Schedulerassigns Pods to nodes based on: Resource requests & availability (CPU, memory, GPU, etc.) Constraints (affinity, taints, tolerations, topology, policies) Exact extract (Kubernetes Docs – Scheduler): ??The scheduler is a control plane process that assigns Pods to Nodes. Scheduling decisions take into account resource requirements, affinity/anti-affinity, constraints, and policies.?? Other options clarified: A: Monitoring cluster health is theController Manager's/kubelet's job. B: Security is enforced throughRBAC, admission controllers, PSP/PSA, not the scheduler. C: Deployment scaling is handled by theController Manager(Deployment/ReplicaSet controller). References: Kubernetes Docs — Scheduler: https://kubernetes.io/docs/concepts/scheduling-eviction/kube-scheduler/
Was this answer correct?Question #2
In Kubernetes, what isPublic Key Infrastructure (PKI)used for?
Please select an optionIncorrectCorrect answer: A
Kubernetes usesPKI certificatesextensively to secure communication between control plane components (API server, etcd, kube-scheduler, kube-controller- manager) and with kubelets. Certificates enablemutual TLS authentication and encryptionacross components. PKI does not handle scaling, networking, or monitoring. References: Kubernetes Documentation – Certificates CNCF Security Whitepaper – Cluster communication security and the role of PKI.
Was this answer correct?Question #3
In a Kubernetes cluster, what are the security risks associated with using ConfigMaps for storing secrets?
Please select an optionIncorrectCorrect answer: B
ConfigMaps are explicitly not for confidential data. Exact extract (ConfigMap concept):"A ConfigMap is an API object used to store non-confidential data in key-value pairs." Exact extract (ConfigMap concept):"ConfigMaps are not intended to hold confidential data. Use a Secret for confidential data." Why this is risky:data placed into a ConfigMap is stored as regular (plaintext) string values in the API and etcd (unless you deliberately use binaryData for base64 content you supply). That means if someone has read access to the namespace or to etcd/APIServer storage, they can view the values. Secrets vs ConfigMaps (to clarify distractor D): Exact extract (Secret concept):"By default, secret data is stored as unencrypted base64-encoded strings.You canenable encryption at restto protect Secrets stored in etcd." This base64 behavior applies toSecrets, not to ConfigMap data. Thus optionDis incorrect for ConfigMaps. About RBAC (to clarify distractor A):Kubernetesdoessupport fine-grained RBAC forbothConfigMaps and Secrets; the issue isn't lack of RBAC but that ConfigMaps arenotdesigned for confidential material. About compatibility (to clarify distractor C):Using ConfigMaps for secrets doesn't make apps "incompatible"; it's simplyinsecureand against guidance. [References:, Kubernetes Docs —ConfigMaps: https://kubernetes.io/docs/concepts/configuration/configmap/, Kubernetes Docs —Secrets: https://kubernetes.io/docs/concepts/configuration/secret/, Kubernetes Docs —Encrypting Secret Data at Rest: https://kubernetes.io/docs/tasks/administer- cluster/encrypt-data/, Note: The citations above are from the official Kubernetes documentation and reflect the stated guidance that ConfigMaps are fornon- confidentialdata, while Secrets (with encryption at rest enabled) are forconfidentialdata, and that the 4C's map todefense in depth., ]
Was this answer correct?Question #4
Is it possible to restrict permissions so that a controller can only change the image of a deployment (without changing anything else about it, e.g., environment variables, commands, replicas, secrets)?
Please select an optionIncorrectCorrect answer: C
RBAC in Kubernetesis coarse-grained: it controlsverbs(get, update, patch, delete) onresources(e.g., deployments), butnot individual fieldswithin a resource. There isno /image subresource for deployments(there is one for pods but only for ephemeral containers). Therefore,RBAC cannot restrict changes only to the image field. Admission Webhooks(mutating/validating)canenforce fine-grained policies (e.g., deny updates that change anything other than spec.containers[*].image). Exact extract (Kubernetes Docs – Admission Webhooks): "Admission webhooks can be used to enforce custom policies on objects being admitted." [References:, Kubernetes Docs — RBAC: https://kubernetes.io/docs/reference/access-authn-authz/rbac/, Kubernetes Docs — Admission Webhooks: https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/, ]
Was this answer correct?Question #5
You want to minimize security issues in running Kubernetes Pods. Which of the following actions can help achieve this goal?
Please select an optionIncorrectCorrect answer: C
Pod Security Standards (PSS): Kubernetes providesPod Security Admission (PSA)to enforce security controls based on policies. Official extract: ??Pod Security Standards define different isolation levels for Pods. The standards focus on restricting what Pods can do and what they can access.?? The three standard profiles are: Privileged: unrestricted (not recommended). Baseline: minimal restrictions. Restricted: highly restricted, enforcing least privilege. Why option C is correct: Applying Pod Security Standards in YAML ensures Pods adhere tobest practiceslike: No root user. Restricted host access. No privilege escalation. Seccomp/AppArmor profiles. This directly minimizes security risks. Why others are wrong: A:Sharing sensitive data increases risk of exposure. B:Running with elevated privileges contradicts least privilege principle. D:Random Pod names donotcontribute to security. [References:, Kubernetes Docs — Pod Security Standards: https://kubernetes.io/docs/concepts/security/pod-security-standards/, Kubernetes Docs — Pod Security Admission: https://kubernetes.io/docs/concepts/security/pod-security-admission/, ]
Was this answer correct?Question #6
A container running in a Kubernetes cluster has permission to modify host processes on the underlying node. What combination of privileges and capabilities is most likely to have led to this privilege escalation?
Please select an optionIncorrectCorrect answer: B
hostPID:When enabled, the container shares the host's process namespace ?? container can see and potentially interact with host processes. SYS_PTRACE capability:Grants the container the ability to trace, inspect, and modify other processes (e.g., via ptrace). Combination of hostPID + SYS_PTRACE allows a container toattach to and modify host processes, which is a direct privilege escalation. Other options explained: hostPath + AUDIT_WRITE:hostPath exposes filesystem paths but does not inherently allow process modification. hostNetwork + NET_RAW:grants raw socket access but only for networking, not host process modification. A:Incorrect — such combinationsdo exist(like B). [References:, Kubernetes Docs — Configure a Pod to use hostPID: https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/, Linux Capabilities man page: https://man7.org/linux/man-pages/man7/capabilities.7.html, ]
Was this answer correct?Question #7
When using a cloud provider's managed Kubernetes service, who is responsible for maintaining the etcd cluster?
Please select an optionIncorrectCorrect answer: C
Inmanaged Kubernetes services(EKS, GKE, AKS), the control plane is operated by thecloud provider. This includesetcd, API server, controller manager, scheduler. Users manageworker nodes(in some models) and workloads, but not the control plane. Exact extract (GKE Docs): "The control plane, including the API server and etcd database, is managed and maintained by Google." Similarly forEKSandAKS, etcd is fully managed by the provider. [References:, GKE Architecture: https://cloud.google.com/kubernetes-engine/docs/concepts/cluster-architecture, EKS Architecture: https://docs.aws.amazon.com/eks/latest/userguide/eks-architecture.html, AKS Docs: https://learn.microsoft.com/en-us/azure/aks/concepts-clusters-workloads, ]
Was this answer correct?Question #8
An attacker has access to the network segment that the cluster is on. What happens when a compromised Pod attempts to connect to the API server?
Please select an optionIncorrectCorrect answer: C
By default,Pods can connect to the API server(since ServiceAccount tokens are mounted). However, whether they succeed in acting depends on: Network Policies(may block egress). RBAC(controls permissions). Exact extract (Kubernetes Docs – API Access): ??Pods authenticate to the API server using the service account token mounted into the Pod. Authorization is then enforced by RBAC. NetworkPolicies may further restrict access.?? Clarifications: A: No default automatic isolation. B: Not always unrestricted; policies may apply. D: Pods get minimal default privileges, not automatic elevation. References: Kubernetes Docs — API Access to Pods: https://kubernetes.io/docs/concepts/security/service-accounts/ Kubernetes Docs — Network Policies: https://kubernetes.io/docs/concepts/services-networking/network- policies/
Was this answer correct?Question #9
Which label should be added to the Namespace to block any privileged Pods from being created in that Namespace?
Please select an optionIncorrectCorrect answer: C
KubernetesPod Security Admission (PSA)enforcesPod Security Standardsby applying labels on Namespaces. Exact extract (Kubernetes Docs – Pod Security Admission): ??You can label a namespace with pod-security.kubernetes.io/enforce: baseline to enforce the Baseline policy.?? Thebaselineprofile explicitly disallowsprivileged podsand other unsafe features. Why others are wrong: A & D: These labels do not exist in Kubernetes. B: Setting privileged: true would allow privileged pods, not block them. References: Kubernetes Docs — Pod Security Admission: https://kubernetes.io/docs/concepts/security/pod-security- admission/ Kubernetes Docs — Pod Security Standards: https://kubernetes.io/docs/concepts/security/pod-security- standards/
Was this answer correct?Question #10
What is the reasoning behind considering the Cloud as the trusted computing base of a Kubernetes cluster?
Please select an optionIncorrectCorrect answer: D
The4C's of Cloud Native Security(Cloud, Cluster, Container, Code) model starts withCloudas the base layer. If the Cloud (infrastructure layer) is compromised, every higher layer (Cluster, Container, Code) inherits that compromise. Exact extract (Kubernetes Security Overview): ??The 4C's of Cloud Native security are Cloud, Clusters, Containers, and Code. You can think of the 4C's as a layered approach. A Kubernetes cluster can only be as secure as the cloud infrastructure it is deployed on.?? This means the cloud is part of thetrusted computing baseof a Kubernetes cluster. References: Kubernetes Docs — Security Overview (4C's): https://kubernetes.io/docs/concepts/security/overview/#the- 4cs-of-cloud-native-security
Was this answer correct?
Continue with KCSA - Kubernetes and Cloud Security Associate
Unlock the full question bank
You have read the first 10 questions. A subscription opens every question in KCSA - Kubernetes and Cloud Security Associate, the full timed practice test, and your progress and weak-topic reporting.
Single exam
$19.99for 30 days
Full question bank and practice test for one exam, for 30 days.
Single exam
$49.99for 1 year
One exam for a full year. Nothing renews and nothing to cancel.
Full access
$39.99/mo
Every exam in the catalogue, month to month.
Full access
$199.99/yr
Every exam in the catalogue for a year.
Already subscribed? Sign in to pick up where you left off.
Other CNCF certifications
- CGOA - GitOps Certified Associate (opens in a new tab)
- CAPA - Certified Argo Project Associate (opens in a new tab)
- CKAD - Certified Kubernetes Application Developer (opens in a new tab)
- CKS - Certified Kubernetes Security Specialist (opens in a new tab)
- PCA - Prometheus Certified Associate (opens in a new tab)
- ICA - Istio Certified Associate (opens in a new tab)
Reviews
★★★★★
This platform is a lifesaver. The practice questions and explanations are so detailed. It’s the best study tool I’ve ever used.
Hannah Smith
USA
★★★★★
I highly recommend Exam Practice. The feedback after each test helped me improve significantly, and I passed my exams easily.
Oscar Nyström
Sweden
★★★★★
Exam Practice is worth every penny. The mock exams are realistic, and the feedback helped me focus on key areas.
Amit Sharma
India
FAQ
Learn More: https://training.linuxfoundation.org/certification
- Q1: What is the KCSA - Kubernetes and Cloud Security Associate exam?
- A: KCSA - Kubernetes and Cloud Security Associate is a CNCF certification exam. Judging by the questions in our bank, it concentrates on kubernetes, pods, cluster, namespaces and secret.
- Q2: What topics does the KCSA - Kubernetes and Cloud Security Associate exam cover?
- A: Questions in our KCSA - Kubernetes and Cloud Security Associate bank cluster around kubernetes, pods, cluster, namespaces, secret and containers. Working through the full set is the quickest way to find which of these you are weakest on.
- Q3: How should I prepare for KCSA - Kubernetes and Cloud Security Associate?
- A: Work through the KCSA - Kubernetes and Cloud Security Associate practice questions here, checking your answer on each one, then sit the practice test to rehearse the exam under timed conditions before the real thing.
- Q4: Are these real KCSA - Kubernetes and Cloud Security Associate exam questions?
- A: They are drawn from officially released past questions and from community members who have sat KCSA - Kubernetes and Cloud Security Associate. Answers are verified and updated weekly.
- Q5: Where do I register for the KCSA - Kubernetes and Cloud Security Associate exam?
- A: Register through CNCF directly at https://training.linuxfoundation.org/certification. Exampractice is not affiliated with CNCF and does not administer the exam.
- Q6: Is there a free KCSA - Kubernetes and Cloud Security Associate sample?
- A: Yes. Every KCSA - Kubernetes and Cloud Security Associate page shows a free sample of real questions. Upgrading opens the full bank and the practice test.
- Q7: What are CNCF Certification Exams?
- A: CNCF (Cloud Native Computing Foundation) Certification Exams validate your expertise in cloud-native technologies, including Kubernetes, Prometheus, and other cloud-native tools. These certifications demonstrate your proficiency in deploying, managing, and troubleshooting cloud-native applications and infrastructures.
- Q8: Why should I pursue CNCF Certification?
- A: CNCF Certification enhances your professional credibility, showcasing your skills and knowledge in cloud-native technologies. This can lead to better job opportunities, higher salaries, and career advancement in the cloud computing and IT industries.
- Q9: What are the benefits of CNCF Certification?
- A: Benefits include recognition as a certified cloud-native professional, improved job performance, access to exclusive resources, continuing education opportunities, and staying current with the latest cloud-native technologies and best practices.
- Q10: Who should take CNCF Certification Exams?
- A: Cloud engineers, DevOps professionals, system administrators, IT architects, and anyone involved in managing cloud-native environments should consider these certifications to validate their expertise and advance their careers.
- Q11: What types of CNCF Certification Exams are available?
- A: CNCF offers various certification paths, including:
- Q12: How do I prepare for CNCF Certification Exams?
- A: Preparation can include official CNCF training courses, study guides, practice exams, online tutorials, and hands-on experience with cloud-native technologies like Kubernetes.
- Q13: Where can I take CNCF Certification Exams?
- A: CNCF Certification Exams can be taken online with remote proctoring, providing flexibility to fit your schedule and location.
- Q14: How do CNCF Certifications impact my career?
- A: CNCF Certifications significantly boost your career by demonstrating your expertise to employers, making you a more competitive candidate for advanced roles and promotions in cloud computing and IT.
- Q15: Are there any prerequisites for CNCF Certification Exams?
- A: Some exams may have prerequisites, such as foundational knowledge or prior experience with cloud-native technologies. Check the specific requirements for each certification path on the CNCF website.
- Q16: How often do I need to recertify for CNCF Certifications?
- A: CNCF Certifications typically require recertification every three years to ensure certified professionals stay updated with the latest cloud-native technologies and industry practices.