[Apr 20, 2026] Valid KCSA Test Answers & KCSA Exam PDF [Q19-Q43]

[Apr 20, 2026] Valid KCSA Test Answers & KCSA Exam PDF

Valid Kubernetes and Cloud Native KCSA Dumps Ensure Your Passing

NEW QUESTION # 19
A container image istrojanizedby an attacker by compromising the build server. Based on the STRIDE threat modeling framework, which threat category best defines this threat?

A. Tampering
B. Repudiation
C. Spoofing
D. Denial of Service

Answer: A

Explanation:
* In STRIDE,Tamperingis the threat category forunauthorized modification of data or code/artifacts. A trojanized container image is, by definition, an attacker'smodificationof the build output (the image) after compromising the CI/build system-i.e., tampering with the artifact in the software supply chain.
* Why not the others?
* Spoofingis about identity/authentication (e.g., pretending to be someone/something).
* Repudiationis about denying having performed an action without sufficient audit evidence.
* Denial of Servicetargets availability (exhausting resources or making a service unavailable).The scenario explicitly focuses on analtered imageresulting from a compromised build server-this squarely maps toTampering.
Authoritative references (for verification and deeper reading):
* Kubernetes (official docs)- Supply Chain Security (discusses risks such as compromised CI/CD pipelines leading to modified/poisoned images and emphasizes verifying image integrity/signatures).
* Kubernetes Docs#Security#Supply chain securityandSecuring a cluster(sections on image provenance, signing, and verifying artifacts).
* CNCF TAG Security - Cloud Native Security Whitepaper (v2)- Threat modeling in cloud-native and software supply chain risks; describes attackers modifying build outputs (images/artifacts) via CI
/CD compromise as a form oftamperingand prescribes controls (signing, provenance, policy).
* CNCF TAG Security - Software Supply Chain Security Best Practices- Explicitly covers CI/CD compromise leading tomaliciously modified imagesand recommends SLSA, provenance attestation, and signature verification (policy enforcement via admission controls).
* Microsoft STRIDE (canonical reference)- DefinesTamperingasmodifying data or code, which directly fits a trojanized image produced by a compromised build system.

NEW QUESTION # 20
Which of the following statements correctly describes a container breakout?

A. A container breakout is the process of escaping the container and gaining access to the cloud provider's infrastructure.
B. A container breakout is the process of escaping the container and gaining access to the Pod's network traffic.
C. A container breakout is the process of escaping the container and gaining access to the host operating system.
D. A container breakout is the process of escaping a container when it reaches its resource limits.

Answer: C

Explanation:
* Container breakoutrefers to an attacker escaping container isolation and reaching thehost OS.
* Once the host is compromised, the attacker can accessother containers, Kubernetes nodes, or escalate further.
* Exact extract (Kubernetes Security Docs):
* "If an attacker gains access to a container, they may attempt a container breakout to gain access to the host system."
* Other options clarified:
* A: Network access inside a Pod # breakout.
* B: Resource exhaustion is aDoS, not a breakout.
* C: Cloud infrastructure compromise is possibleafterhost compromise, but not the definition of breakout.
References:
Kubernetes Security Concepts: https://kubernetes.io/docs/concepts/security/ CNCF Security Whitepaper (Threats section):https://github.com/cncf/tag-security

NEW QUESTION # 21
In the event that kube-proxy is in a CrashLoopBackOff state, what impact does it have on the Pods running on the same worker node?

A. The Pods cannot communicate with other Pods in the cluster.
B. The Pod cannot mount persistent volumes through CSI drivers.
C. The Pod's resource utilization increases significantly.
D. The Pod's security context restrictions cannot be enforced.

Answer: A

Explanation:
* kube-proxy:manages cluster network routing rules (via iptables or IPVS). It enables Pods to communicate with Services and Pods across nodes.
* If kube-proxy fails (CrashLoopBackOff), service IP routing and cluster-wide pod-to-pod networking breaks. Local Pod-to-Pod communication within the same node may still work, butcross-node communication fails.
* Exact extract (Kubernetes Docs - kube-proxy):
* "kube-proxy maintains network rules on nodes. These rules allow network communication to Pods from network sessions inside or outside of the cluster." References:
Kubernetes Docs - kube-proxy: https://kubernetes.io/docs/reference/command-line-tools-reference/kube- proxy/

NEW QUESTION # 22
What is the main reason an organization would use a Cloud Workload Protection Platform (CWPP) solution?

A. To manage networking between containerized workloads in the Kubernetes cluster.
B. To automate the deployment and management of containerized workloads.
C. To protect containerized workloads from known vulnerabilities and malware threats.
D. To optimize resource utilization and scalability of containerized workloads.

Answer: C

Explanation:
* CWPP (Cloud Workload Protection Platform):As defined by Gartner and adopted across cloud security practices, CWPPs are designed tosecure workloads(VMs, containers, serverless functions) in hybrid and cloud environments.
* They providevulnerability scanning, runtime protection, compliance checks, and malware detection.
* Exact extract (Gartner CWPP definition):"Cloud workload protection platforms protect workloads regardless of location, including physical machines, VMs, containers, and serverless workloads. They provide vulnerability management, system integrity protection, intrusion detection and prevention, and malware protection." References:
Gartner: Cloud Workload Protection Platforms Market Guide (summary): https://www.gartner.com/reviews
/market/cloud-workload-protection-platforms
CNCF Security Whitepaper:https://github.com/cncf/tag-security

NEW QUESTION # 23
An attacker has successfully overwhelmed the Kubernetes API server in a cluster with a single control plane node by flooding it with requests.
How would implementing a high-availability mode with multiple control plane nodes mitigate this attack?

A. By implementing rate limiting and throttling mechanisms on the API server to restrict the number of requests allowed.
B. By distributing the workload across multiple API servers, reducing the load on each server.
C. By implementing network segmentation to isolate the API server from the rest of the cluster, preventing the attack from spreading.
D. By increasing the resources allocated to the API server, allowing it to handle a higher volume of requests.

Answer: B

Explanation:
* Inhigh-availability clusters, multiple API server instances run behind a load balancer.
* Thisdistributes client requests across multiple API servers, preventing a single API server from being overwhelmed.
* Exact extract (Kubernetes Docs - High Availability Clusters):
* "A highly available control plane runs multiple instances of kube-apiserver, typically fronted by a load balancer, so that if one instance fails or is overloaded, others continue serving requests."
* Other options clarified:
* A: Network segmentation does not directly mitigate API server DoS.
* C: Adding resources helps, but doesn't solve single-point-of-failure.
* D: Rate limiting is a valid mitigation but not provided by HA alone.
References:
Kubernetes Docs - Building High-Availability Clusters: https://kubernetes.io/docs/setup/production- environment/tools/kubeadm/high-availability/

NEW QUESTION # 24
How do Kubernetes namespaces impact the application of policies when using Pod Security Admission?

A. Each namespace can have only one active policy.
B. The default namespace enforces the strictest security policies by default.
C. Namespaces are ignored; Pod Security Admission policies apply cluster-wide only.
D. Different policies can be applied to specific namespaces.

Answer: D

Explanation:
* Pod Security Admission (PSA)enforces policies by applyinglabels on namespaces, not globally across the cluster.
* Exact extract (Kubernetes Docs - Pod Security Admission):
* "You can apply Pod Security Standards to namespaces by adding labels such as pod- security.kubernetes.io/enforce. Different namespaces can enforce different policies."
* Clarifications:
* A: Incorrect, namespaces are the unit of enforcement.
* C: Misleading - a namespace can have multiple enforcement modes (enforce, audit, warn).
* D: Default namespace doesnotenforce strict policies unless labeled.
References:
Kubernetes Docs - Pod Security Admission: https://kubernetes.io/docs/concepts/security/pod-security- admission/

NEW QUESTION # 25
A Kubernetes cluster tenant can launch privileged Pods in contravention of therestricted Pod Security Standardmandated for cluster tenants and enforced by the built-inPodSecurity admission controller.
The tenant has full CRUD permissions on the namespace object and the namespaced resources. How did the tenant achieve this?

A. By deleting the PodSecurity admission controller deployment running in their namespace.
B. By tampering with the namespace labels.
C. The scope of the tenant role means privilege escalation is impossible.
D. By using higher-level access credentials obtained reading secrets from another namespace.

Answer: B

Explanation:
* ThePodSecurity admission controllerenforces Pod Security Standards (Baseline, Restricted, Privileged)based on namespace labels.
* If a tenant has full CRUD on the namespace object, they canmodify the namespace labelsto remove or weaken the restriction (e.g., setting pod-security.kubernetes.io/enforce=privileged).
* This allows privileged Pods to be admitted despite the security policy.
* Incorrect options:
* (A) is false - namespace-level access allows tampering.
* (C) is invalid - PodSecurity admission is not namespace-deployed, it's a cluster-wide admission controller.
* (D) is unrelated - Secrets from other namespaces wouldn't directly bypass PodSecurity enforcement.
References:
Kubernetes Documentation - Pod Security Admission
CNCF Security Whitepaper - Admission control and namespace-level policy enforcement weaknesses.

NEW QUESTION # 26
A cluster administrator wants to enforce the use of a different container runtime depending on the application a workload belongs to.

A. By modifying the kube-apiserver configuration file to specify the desired container runtime for each application.
B. By manually modifying the container runtime for each workload after it has been created.
C. By configuring amutating admission controllerwebhook that intercepts new workload creation requests and modifies the container runtime based on the application label.
D. By configuring avalidating admission controllerwebhook that verifies the container runtime based on the application label and rejects requests that do not comply.

Answer: C

Explanation:
* Kubernetes supports workload-specific runtimes viaRuntimeClass.
* Amutating admission controllercan enforce this automatically by:
* Intercepting workload creation requests.
* Modifying the Pod spec to set runtimeClassName based on labels or policies.
* Incorrect options:
* (A) Manual modification is not scalable or secure.
* (B) kube-apiserver cannot enforce per-application runtime policies.
* (C) A validating webhook can onlyreject, not modify, the runtime.
References:
Kubernetes Documentation - RuntimeClass
CNCF Security Whitepaper - Admission controllers for enforcing runtime policies.

NEW QUESTION # 27
What does thecluster-adminClusterRole enable when used in a RoleBinding?

A. It gives full control over every resource in the role binding's namespace, not including the namespace object for isolation purposes.
B. It gives full control over every resource in the cluster and in all namespaces.
C. It gives full control over every resource in the role binding's namespace, including the namespace itself.
D. It allows read/write access to most resources in the role binding's namespace. This role does not allow write access to resource quota, to the namespace itself, and to EndpointSlices (or Endpoints).

Answer: B

Explanation:
* Thecluster-adminClusterRole is asuperuser rolein Kubernetes.
* Binding it (via RoleBinding or ClusterRoleBinding) grantsunrestricted control over all resources in the cluster, across all namespaces.
* This includes management of cluster-scoped resources (nodes, CRDs, RBAC rules) and namespace- scoped resources.
* Therefore, cluster-admin is equivalent toroot-level accessin Kubernetes and must be used with extreme caution.
References:
Kubernetes Documentation - Default Roles and Role Bindings
CNCF Security Whitepaper - Identity and Access Management: cautions against assigningcluster-admin broadly due to its unrestricted nature.

NEW QUESTION # 28
What is Grafana?

A. A cloud-native security tool for scanning and detecting vulnerabilities in Kubernetes clusters.
B. A container orchestration platform for managing and scaling applications.
C. A platform for monitoring and visualizing time-series data.
D. A cloud-native distributed tracing system for monitoring microservices architectures.

Answer: C

Explanation:
* Grafana:An open-source analytics and visualization platform widely used with Prometheus, Loki, etc.
* Exact extract (Grafana Docs):"Grafana is the open-source analytics and monitoring solution for every database. It allows you to query, visualize, alert on, and understand your metrics no matter where they are stored."
* A is wrong:That describesJaeger(distributed tracing).
* B is wrong:That'sKubernetesitself.
* D is wrong:That'sTrivy/Aqua/Prismatype tools.
References:
Grafana Docs: https://grafana.com/docs/grafana/latest/

NEW QUESTION # 29
A container running in a Kubernetes cluster has permission to modify host processes on the underlying node.
What combination of privileges and capabilities is most likely to have led to this privilege escalation?

A. hostNetwork and NET_RAW
B. There is no combination of privileges and capabilities that permits this.
C. hostPath and AUDIT_WRITE
D. hostPID and SYS_PTRACE

Answer: D

Explanation:
* hostPID:When enabled, the container shares the host's process namespace # container can see and potentially interact with host processes.
* SYS_PTRACE capability:Grants the container the ability to trace, inspect, and modify other processes (e.g., via ptrace).
* Combination of hostPID + SYS_PTRACE allows a container toattach to and modify host processes, which is a direct privilege escalation.
* Other options explained:
* hostPath + AUDIT_WRITE:hostPath exposes filesystem paths but does not inherently allow process modification.
* hostNetwork + NET_RAW:grants raw socket access but only for networking, not host process modification.
* A:Incorrect - such combinationsdo exist(like B).
References:
Kubernetes Docs - Configure a Pod to use hostPID: https://kubernetes.io/docs/tasks/configure-pod-container
/share-process-namespace/
Linux Capabilities man page: https://man7.org/linux/man-pages/man7/capabilities.7.html

NEW QUESTION # 30
Which technology can be used to apply security policy for internal cluster traffic at the application layer of the network?

A. Container Runtime
B. Service Mesh
C. Network Policy
D. Ingress Controller

Answer: B

Explanation:
* Service Mesh (e.g., Istio, Linkerd, Consul):operates atLayer 7 (application layer), enforcing policies like mTLS, authorization, and routing between services.
* NetworkPolicy:works atLayer 3/4 (IP/port), not Layer 7.
* Ingress Controller:handles external traffic ingress, not internal service-to-service traffic.
* Container Runtime:responsible for running containers, not enforcing application-layer security.
Exact extract (Istio docs):
* "Istio provides security by enforcing authentication, authorization, and encryption of service-to- service communication." References:
Kubernetes Docs - Network Policies: https://kubernetes.io/docs/concepts/services-networking/network- policies/ Istio Security Docs: https://istio.io/latest/docs/concepts/security/

NEW QUESTION # 31
An attacker has access to the network segment that the cluster is on.
What happens when a compromised Pod attempts to connect to the API server?

A. The compromised Pod is allowed to connect to the API server without any restrictions.
B. The compromised Pod is automatically isolated from the network to prevent any connections to the API server.
C. The compromised Pod connects to the API server and is granted elevated privileges by default.
D. The compromised Pod attempts to connect to the API server, but its requests may be blocked due to network policies.

Answer: D

Explanation:
* By default,Pods can connect to the API server(since ServiceAccount tokens are mounted).
* However, whether they succeed in acting depends on:
* Network Policies(may block egress).
* RBAC(controls permissions).
* Exact extract (Kubernetes Docs - API Access):
* "Pods authenticate to the API server using the service account token mounted into the Pod.
Authorization is then enforced by RBAC. NetworkPolicies may further restrict access."
* Clarifications:
* A: No default automatic isolation.
* B: Not always unrestricted; policies may apply.
* D: Pods get minimal default privileges, not automatic elevation.
References:
Kubernetes Docs - API Access to Pods: https://kubernetes.io/docs/concepts/security/service-accounts/ Kubernetes Docs - Network Policies: https://kubernetes.io/docs/concepts/services-networking/network- policies/

NEW QUESTION # 32
A user runs a command with kubectl to apply a change to a deployment. What is the first Kubernetes component that the request reaches?

A. Kubernetes API Server
B. Kubernetes Scheduler
C. kubelet
D. Kubernetes Controller Manager

Answer: A

Explanation:
* Allkubectl requestsgo to theKubernetes API Server.
* The API server is thefront-end of the control planeand validates/authenticates requests before other components act.
* Exact extract (Kubernetes Docs - Components):
* "The API server is a component of the Kubernetes control plane that exposes the Kubernetes API. It is the front end for the Kubernetes control plane."
* Other options clarified:
* Controller Manager: reconciles state after API Server processes the request.
* Scheduler: assigns Pods to nodes after API Server accepts workload objects.
* kubelet: node agent, only communicates after API Server updates desired state.
References:
Kubernetes Docs - Components: https://kubernetes.io/docs/concepts/overview/components/

NEW QUESTION # 33
What is the purpose of an egress NetworkPolicy?

A. To control the outgoing network traffic from one or more Kubernetes Pods.
B. To control the incoming network traffic to a Kubernetes cluster.
C. To secure the Kubernetes cluster against unauthorized access.
D. To control the outbound network traffic from a Kubernetes cluster.

Answer: A

Explanation:
* NetworkPolicycontrols network trafficat the Pod level.
* Ingress rules:controlincomingconnections to Pods.
* Egress rules:controloutgoingconnectionsfrom Pods.
* Exact extract (Kubernetes Docs - Network Policies):
* "An egress rule controls outgoing connections from Pods that match the policy."
* Clarifying wrong answers:
* A/B: Too broad (cluster-level); policies apply per Pod/Namespace.
* C: Security against unauthorized access is broader than egress policies.
References:
Kubernetes Docs - Network Policies: https://kubernetes.io/docs/concepts/services-networking/network- policies/

NEW QUESTION # 34
What is the purpose of the Supplier Assessments and Reviews control in the NIST 800-53 Rev. 5 set of controls for Supply Chain Risk Management?

A. To identify potential suppliers for the organization.
B. To evaluate and monitor existing suppliers for adherence to security requirements.
C. To establish contractual agreements with suppliers.
D. To conduct regular audits of suppliers' financial performance.

Answer: B

Explanation:
* In NIST SP 800-53 Rev. 5,SR-6: Supplier Assessments and Reviewsrequires evaluating and monitoring suppliers' security and risk practices.
* Exact extract (NIST SP 800-53 Rev. 5, SR-6):
* "The organization assesses and monitors suppliers to ensure they are meeting the security requirements specified in contracts and agreements."
* This is aboutongoing monitoringof supplier adherence, not financial audits, not contract creation, and not supplier discovery.
References:
NIST SP 800-53 Rev. 5, Control SR-6 (Supplier Assessments and Reviews): https://csrc.nist.gov/publications
/detail/sp/800-53/rev-5/final

NEW QUESTION # 35
In a Kubernetes environment, what kind of Admission Controller can modify resource manifests when applied to the Kubernetes API to fix misconfigurations automatically?

A. ResourceQuota
B. ValidatingAdmissionController
C. MutatingAdmissionController
D. PodSecurityPolicy

Answer: C

Explanation:
* Kubernetes Admission Controllers can eithervalidateormutateincoming requests.
* MutatingAdmissionWebhook (Mutating Admission Controller):
* Canmodify or mutate resource manifestsbefore they are persisted in etcd.
* Used for automatic injection of sidecars (e.g., Istio Envoy proxy), setting default values, or fixing misconfigurations.
* ValidatingAdmissionWebhook (Validating Admission Controller):only allows/denies but doesnot change requests.
* PodSecurityPolicy:deprecated; cannot mutate requests.
* ResourceQuota:enforces resource usage, but does not mutate manifests.
Exact Extract:
* "Mutating admission webhooks are invoked first, and can modify objects to enforce defaults.
Validating admission webhooks are invoked second, and can reject requests to enforce invariants.
"
References:
Kubernetes Docs - Admission Controllers: https://kubernetes.io/docs/reference/access-authn-authz
/admission-controllers/
Kubernetes Docs - Admission Webhooks: https://kubernetes.io/docs/reference/access-authn-authz
/extensible-admission-controllers/

NEW QUESTION # 36
Why mightNetworkPolicyresources have no effect in a Kubernetes cluster?

A. NetworkPolicy resources are only enforced if the Kubernetes scheduler supports them.
B. NetworkPolicy resources are only enforced if the networking plugin supports them.
C. NetworkPolicy resources are only enforced if the user has the right RBAC permissions.
D. NetworkPolicy resources are only enforced for unprivileged Pods.

Answer: B

Explanation:
* NetworkPolicies define how Pods can communicate with each other and external endpoints.
* However, Kubernetes itselfdoes not enforce NetworkPolicy. Enforcement depends on theCNI plugin used (e.g., Calico, Cilium, Kube-Router, Weave Net).
* If a cluster is using a network plugin that does not support NetworkPolicies, then creating NetworkPolicy objects hasno effect.
References:
Kubernetes Documentation - Network Policies
CNCF Security Whitepaper - Platform security section: notes that security enforcement relies on CNI capabilities.

NEW QUESTION # 37
A container image istrojanizedby an attacker by compromising the build server. Based on the STRIDE threat modeling framework, which threat category best defines this threat?

A. Tampering
B. Repudiation
C. Spoofing
D. Denial of Service

Answer: A

NEW QUESTION # 38
On a client machine, what directory (by default) contains sensitive credential information?

A. /opt/kubernetes/secrets/
B. $HOME/.config/kubernetes/
C. /etc/kubernetes/
D. $HOME/.kube

Answer: D

Explanation:
* Thekubectlclient uses configuration from$HOME/.kube/configby default.
* This file contains: cluster API server endpoint, user certificates, tokens, or kubeconfigs #sensitive credentials.
* Exact extract (Kubernetes Docs - Configure Access to Clusters):
* "By default, kubectl looks for a file named config in the $HOME/.kube directory. This file contains configuration information including user credentials."
* Other options clarified:
* A: /etc/kubernetes/ exists on nodes (control plane) not client machines.
* C: /opt/kubernetes/secrets/ is not a standard path.
* D: $HOME/.config/kubernetes/ is not where kubeconfig is stored by default.
References:
Kubernetes Docs - Configure Access to Clusters: https://kubernetes.io/docs/concepts/configuration/organize- cluster-access-kubeconfig/

NEW QUESTION # 39
What kind of organization would need to be compliant with PCI DSS?

A. Government agencies that collect personally identifiable information.
B. Retail stores that only accept cash payments.
C. Merchants that process credit card payments.
D. Non-profit organizations that handle sensitive customer data.

Answer: C

Explanation:
* PCI DSS (Payment Card Industry Data Security Standard):applies to any entity thatstores, processes, or transmits cardholder data.
* Exact extract (PCI DSS official summary):
* "PCI DSS applies to all entities that store, process or transmit cardholder data (CHD) and
/or sensitive authentication data (SAD)."
* Therefore,merchants who process credit card paymentsmust comply.
* Why others are wrong:
* A: No card payments, so no PCI scope.
* B: This falls underFISMA / NIST 800-53, not PCI DSS.
* C: Non-profits may handle sensitive data, but PCI only applies if they processcredit cards.
References:
PCI Security Standards Council - PCI DSS Summary: https://www.pcisecuritystandards.org/pci_security/

NEW QUESTION # 40
Given a standard Kubernetes cluster architecture comprising a single control plane node (hosting bothetcdand the control plane as Pods) and three worker nodes, which of the following data flows crosses atrust boundary
?

A. From kubelet to Controller Manager
B. From kubelet to Container Runtime
C. From API Server to Container Runtime
D. From kubelet to API Server

Answer: D

Explanation:
* Trust boundariesexist where data flows between different security domains.
* In Kubernetes:
* Communication between thekubelet (node agent)and theAPI Server (control plane)crosses the node-to-control-plane trust boundary.
* (A) Kubelet to container runtime is local, no boundary crossing.
* (C) Kubelet does not communicate directly with the controller manager.
* (D) API server does not talk directly to the container runtime; it delegates to kubelet.
* Therefore, (B) is the correct trust boundary crossing flow.
References:
CNCF Security Whitepaper - Kubernetes Threat Model: identifies node-to-control-plane communications (kubelet # API Server) as crossing trust boundaries.
Kubernetes Documentation - Cluster Architecture

NEW QUESTION # 41
Which of the following statements best describes the role of the Scheduler in Kubernetes?

A. The Scheduler is responsible for ensuring the security of the Kubernetes cluster and its components.
B. The Scheduler is responsible for assigning Pods to nodes based on resource availability and other constraints.
C. The Scheduler is responsible for monitoring and managing the health of the Kubernetes cluster.
D. The Scheduler is responsible for managing the deployment and scaling of applications in the Kubernetes cluster.

Answer: B

Explanation:
* TheKubernetes Schedulerassigns Pods to nodes based on:
* Resource requests & availability (CPU, memory, GPU, etc.)
* Constraints (affinity, taints, tolerations, topology, policies)
* Exact extract (Kubernetes Docs - Scheduler):
* "The scheduler is a control plane process that assigns Pods to Nodes. Scheduling decisions take into account resource requirements, affinity/anti-affinity, constraints, and policies."
* Other options clarified:
* A: Monitoring cluster health is theController Manager's/kubelet's job.
* B: Security is enforced throughRBAC, admission controllers, PSP/PSA, not the scheduler.
* C: Deployment scaling is handled by theController Manager(Deployment/ReplicaSet controller).
References:
Kubernetes Docs - Scheduler: https://kubernetes.io/docs/concepts/scheduling-eviction/kube-scheduler/

NEW QUESTION # 42
What was the name of the precursor to Pod Security Standards?

A. Kubernetes Security Context
B. Container Security Standards
C. Container Runtime Security
D. Pod Security Policy

Answer: D

Explanation:
* Kubernetes originally had a feature calledPodSecurityPolicy (PSP), which provided controls to restrict pod behavior.
* Official docs:
* "PodSecurityPolicy was deprecated in Kubernetes v1.21 and removed in v1.25."
* "Pod Security Standards (PSS) replace PodSecurityPolicy (PSP) with a simpler, policy- driven approach."
* PSP was often complex and hard to manage, so it was replaced by Pod Security Admission (PSA) which enforcesPod Security Standards.
References:
Kubernetes Docs - PodSecurityPolicy (deprecated): https://kubernetes.io/docs/concepts/security/pod- security-policy/ Kubernetes Blog - PodSecurityPolicy Deprecation: https://kubernetes.io/blog/2021/04/06/podsecuritypolicy- deprecation-past-present-and-future/

NEW QUESTION # 43
......

KCSA Dumps Real Exam Questions Test Engine Dumps Training: https://freetorrent.braindumpsvce.com/KCSA_exam-dumps-torrent.html

[Apr 20, 2026] Valid KCSA Test Answers & KCSA Exam PDF [Q19-Q43]

Related Articles