Free Linux-Foundation KCSA Exam Dumps Questions

What information is stored in etcd?

Correct Answer:A
etcdis Kubernetes??key-value storeforcluster state.
Stores: ConfigMaps, Secrets, Pod definitions, Deployments, RBAC policies, and metadata.
Exact extract (Kubernetes Docs – etcd):
??etcd is a consistent and highly-available key-value store used as Kubernetes?? backing store for all cluster data.??
Clarifications:
B: Logs/metrics are handled by logging/monitoring solutions, not etcd.
C: Secrets may be stored here but encoded in base64, not specifically "usernames/passwords" as primary use.
D: Persistent Volumes are external storage, not stored in etcd.
References:
Kubernetes Docs — etcd: https://kubernetes.io/docs/concepts/overview/components/#etcd

By default, in a Kubeadm cluster, which authentication methods are enabled?

Correct Answer:C
In akubeadm cluster, by default the API server enables several authentication mechanisms:
X509 Client Certs: Used for authenticating kubelets, admins, and control-plane components.
Bootstrap Tokens: Temporary credentials used for node bootstrap/joining clusters.
Service Account Tokens: Used by workloads in pods to authenticate with the API server.
Exact extract (Kubernetes Docs – Authentication):
"Kubernetes uses client certificates, bearer tokens, an authenticating proxy, or HTTP basic auth to authenticate API requests."
"Bootstrap tokens are a simple bearer token that is meant to be used when creating new clusters or joining new nodes to an existing cluster."
"Service accounts are special accounts that provide an identity for processes that run in a Pod."
References:
Kubernetes Docs — Authentication: https://kubernetes.io/docs/reference/access-authn-authz/authentication/
Kubeadm — TLS Bootstrapping: https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/

Why mightNetworkPolicyresources have no effect in a Kubernetes cluster?

Correct Answer:B
NetworkPolicies define how Pods can communicate with each other and external endpoints.
However, Kubernetes itselfdoes not enforce NetworkPolicy. Enforcement depends on theCNI plugin
used (e.g., Calico, Cilium, Kube-Router, Weave Net).
If a cluster is using a network plugin that does not support NetworkPolicies, then creating NetworkPolicy objects hasno effect.
References:
Kubernetes Documentation – Network Policies
CNCF Security Whitepaper – Platform security section: notes that security enforcement relies on CNI capabilities.

A cluster administrator wants to enforce the use of a different container runtime depending on the application a workload belongs to.

Correct Answer:D
Kubernetes supports workload-specific runtimes viaRuntimeClass.
Amutating admission controllercan enforce this automatically by:
Intercepting workload creation requests.
Modifying the Pod spec to set runtimeClassName based on labels or policies.
Incorrect options:
(A) Manual modification is not scalable or secure.
(B) kube-apiserver cannot enforce per-application runtime policies.
(C) A validating webhook can onlyreject, not modify, the runtime.
[References:, Kubernetes Documentation – RuntimeClass, CNCF Security Whitepaper – Admission controllers for enforcing runtime policies., ]

Given a standard Kubernetes cluster architecture comprising a single control plane node (hosting bothetcdand the control plane as Pods) and three worker nodes, which of the following data flows crosses atrust boundary?

Correct Answer:B
Trust boundariesexist where data flows between different security domains.
In Kubernetes:
Communication between thekubelet (node agent)and theAPI Server (control plane)crosses the
node-to-control-plane trust boundary.
(A) Kubelet to container runtime is local, no boundary crossing.
(C) Kubelet does not communicate directly with the controller manager.
(D) API server does not talk directly to the container runtime; it delegates to kubelet.
Therefore, (B) is the correct trust boundary crossing flow.
References:
CNCF Security Whitepaper – Kubernetes Threat Model: identifies node-to-control-plane communications (kubelet # API Server) as crossing trust boundaries.
Kubernetes Documentation – Cluster Architecture

In the event that kube-proxy is in a CrashLoopBackOff state, what impact does it have on the Pods running on the same worker node?

Correct Answer:A
kube-proxy:manages cluster network routing rules (via iptables or IPVS). It enables Pods to communicate with Services and Pods across nodes.
If kube-proxy fails (CrashLoopBackOff), service IP routing and cluster-wide pod-to-pod networking breaks. Local Pod-to-Pod communication within the same node may still work, butcross-node communication fails.
Exact extract (Kubernetes Docs – kube-proxy):
"kube-proxy maintains network rules on nodes. These rules allow network communication to Pods from network sessions inside or outside of the cluster."
[References:, Kubernetes Docs — kube-proxy: https://kubernetes.io/docs/reference/command-line-tools-reference/kube-proxy/, ]