KCSA Dumps with Practice Exam Questions Answers

ThePodSecurity admission controllerenforces Pod Security Standards (Baseline, Restricted, Privileged)based on namespace labels.

If a tenant has full CRUD on the namespace object, they canmodify the namespace labelsto remove or weaken the restriction (e.g., setting pod-security.kubernetes.io/enforce=privileged).

This allows privileged Pods to be admitted despite the security policy.

Incorrect options:

(A) is false — namespace-level access allows tampering.

(C) is invalid — PodSecurity admission is not namespace-deployed, it’s a cluster-wide admission controller.

(D) is unrelated — Secrets from other namespaces wouldn’t directly bypass PodSecurity enforcement.

Service Mesh (e.g., Istio, Linkerd, Consul):operates atLayer 7 (application layer), enforcing policies like mTLS, authorization, and routing between services.

NetworkPolicy:works atLayer 3/4 (IP/port), not Layer 7.

Ingress Controller:handles external traffic ingress, not internal service-to-service traffic.

Container Runtime:responsible for running containers, not enforcing application-layer security.

Exact extract (Istio docs):

“Istio provides security by enforcing authentication, authorization, and encryption of service-to-service communication.”

Image signing (withNotary, cosign, or similar tools) ensures that images are from a trusted source and have not been modified.

Exact extract (Sigstore cosign docs):“Cosign allows you to sign and verify container images to ensure authenticity and integrity.”

Why others are wrong:

B:Ownership can be inferred but it’s aboutauthenticity & integritynot tenancy.

C:Not mandatory; enforcement requiresadmission controllers.

D:Metadata size is negligible and has no runtime performance impact.

When a Pod is created, Kubernetes automatically mounts aservice account tokenthat can authenticate to the API server.

TheRole-Based Access Control (RBAC)system defines what actions a service account can perform.

By carefully restricting Roles and RoleBindings, administrators limit the blast radius of a compromised Pod.

Incorrect options:

(A)PodSecurity admissionenforces workload-level security settings but does not control API access.

(B)NetworkPolicycontrols network communication, not API privileges.

(D)RuntimeClassselects container runtimes, unrelated to privilege escalation through API tokens.

kube-proxy:manages cluster network routing rules (via iptables or IPVS). It enables Pods to communicate with Services and Pods across nodes.

If kube-proxy fails (CrashLoopBackOff), service IP routing and cluster-wide pod-to-pod networking breaks. Local Pod-to-Pod communication within the same node may still work, butcross-node communication fails.

Exact extract (Kubernetes Docs – kube-proxy):

“kube-proxy maintains network rules on nodes. These rules allow network communication to Pods from network sessions inside or outside of the cluster.”