KCSA Practice Test

KCSA practice test: what's covered

• 4Cs & Cloud Native Security
• Cluster Component Security
• RBAC & Pod Security
• Threat Model
• Platform & Supply Chain
• CIS Benchmarks

Free KCSA sample questions

1. A platform team is mapping their defenses to the CNCF 4Cs of Cloud Native Security model. Which option lists the four layers in the correct order from the outermost to the innermost?

   • A. Cloud, Cluster, Container, Code
   • B. Code, Container, Cluster, Cloud
   • C. Cloud, Container, Cluster, Code
   • D. Cluster, Cloud, Code, Container
   Show answer

   Correct: A. The 4Cs model is layered outermost-to-innermost as Cloud, Cluster, Container, Code. Each outer layer's security is the foundation for the inner layers; weak Cloud security cannot be fixed by hardening Code alone.

2. In the 4Cs model, why does the model emphasize that you cannot rely solely on hardening the innermost Code layer?

   • A. Security is layered, so a weak outer layer (Cloud or Cluster) undermines everything inside it
   • B. Code can never contain vulnerabilities once it is compiled into a container
   • C. The Cloud layer is automatically secured by every provider's default settings
   • D. Application code is the only layer that attackers are able to reach
   Show answer

   Correct: A. The 4Cs are defense-in-depth: each inner layer inherits the security posture of the layers around it. A compromised cloud account or misconfigured cluster exposes containers and code regardless of how clean the application code is.

3. A security architect is explaining 'defense in depth' for a cloud native platform. Which statement best captures the principle?

   • A. Multiple independent layers of controls so that the failure of one control does not lead to full compromise
   • B. Encrypting every payload twice with the same algorithm to double the key strength
   • C. Placing all workloads behind a single perimeter firewall that inspects north-south traffic
   • D. Granting administrators broad access so they can respond quickly during incidents
   Show answer

   Correct: A. Defense in depth layers overlapping, independent controls (network, identity, admission, runtime, monitoring) so a single bypass does not give an attacker full access. Doubling one algorithm or a single perimeter does not provide layered redundancy.

4. A team is adopting a 'shift-left' security strategy for their cloud native pipeline. Which of the following are valid shift-left practices? (Choose TWO)

   • A. Scanning container images for vulnerabilities during the CI build, before deployment
   • B. Running static application security testing (SAST) on source code in the pull-request pipeline
   • C. Waiting until production runtime to detect insecure dependencies
   • D. Disabling all admission controllers to speed up developer feedback
   • E. Granting cluster-admin to every developer to remove deployment friction
   Show answer

   Correct: A and B. Shift-left moves security checks earlier in the lifecycle — image scanning and SAST in CI/PR catch issues before deployment. Waiting for runtime, disabling admission control, or handing out cluster-admin all push risk later and broaden exposure.

5. Which CNCF-related effort provides a community framework that maps attacker tactics and techniques specifically to Kubernetes and cloud native environments?

   • A. The Cloud Native Security Whitepaper and threat-matrix work that aligns with MITRE ATT&CK for containers
   • B. The Open Container Initiative (OCI) image specification
   • C. The Kubernetes Horizontal Pod Autoscaler API
   • D. The CSI (Container Storage Interface) driver registry
   Show answer

   Correct: A. The CNCF Cloud Native Security Whitepaper and container threat matrices (aligned with MITRE ATT&CK for Containers) describe tactics and techniques in K8s contexts. OCI, HPA, and CSI are packaging, scaling, and storage specs, not threat frameworks.

Last updated: 2026-10-19

KCSA practice test FAQ