Linux Foundation Exam 2026 KCSA Dumps Updated Questions UPDATED Jan-2026 [Q14-Q38]

Linux Foundation Exam 2026 KCSA Dumps Updated Questions UPDATED Jan-2026

Get The Most Updated KCSA Dumps To Kubernetes and Cloud Native Certification

NEW QUESTION # 14
What is the main reason an organization would use a Cloud Workload Protection Platform (CWPP) solution?

• A. To optimize resource utilization and scalability of containerized workloads.
• B. To protect containerized workloads from known vulnerabilities and malware threats.
• C. To automate the deployment and management of containerized workloads.
• D. To manage networking between containerized workloads in the Kubernetes cluster.

Answer: B

Explanation:
* CWPP (Cloud Workload Protection Platform):As defined by Gartner and adopted across cloud security practices, CWPPs are designed tosecure workloads(VMs, containers, serverless functions) in hybrid and cloud environments.
* They providevulnerability scanning, runtime protection, compliance checks, and malware detection.
* Exact extract (Gartner CWPP definition):"Cloud workload protection platforms protect workloads regardless of location, including physical machines, VMs, containers, and serverless workloads. They provide vulnerability management, system integrity protection, intrusion detection and prevention, and malware protection." References:
Gartner: Cloud Workload Protection Platforms Market Guide (summary): https://www.gartner.com/reviews
/market/cloud-workload-protection-platforms
CNCF Security Whitepaper:https://github.com/cncf/tag-security

NEW QUESTION # 15
What kind of organization would need to be compliant with PCI DSS?

• A. Merchants that process credit card payments.
• B. Retail stores that only accept cash payments.
• C. Government agencies that collect personally identifiable information.
• D. Non-profit organizations that handle sensitive customer data.

Answer: A

Explanation:
* PCI DSS (Payment Card Industry Data Security Standard):applies to any entity thatstores, processes, or transmits cardholder data.
* Exact extract (PCI DSS official summary):
* "PCI DSS applies to all entities that store, process or transmit cardholder data (CHD) and
/or sensitive authentication data (SAD)."
* Therefore,merchants who process credit card paymentsmust comply.
* Why others are wrong:
* A: No card payments, so no PCI scope.
* B: This falls underFISMA / NIST 800-53, not PCI DSS.
* C: Non-profits may handle sensitive data, but PCI only applies if they processcredit cards.
References:
PCI Security Standards Council - PCI DSS Summary: https://www.pcisecuritystandards.org/pci_security/

NEW QUESTION # 16
Is it possible to restrict permissions so that a controller can only change the image of a deployment (without changing anything else about it, e.g., environment variables, commands, replicas, secrets)?

• A. Yes, by granting permission to the /image subresource.
• B. No, because granting access to the spec.containers.image field always grants access to the rest of the spec object.
• C. Yes, with a 'managed fields' annotation.
• D. Not with RBAC, but it is possible with an admission webhook.

Answer: D

Explanation:
* RBAC in Kubernetesis coarse-grained: it controlsverbs(get, update, patch, delete) onresources(e.g., deployments), butnot individual fieldswithin a resource.
* There isno /image subresource for deployments(there is one for pods but only for ephemeral containers).
* Therefore,RBAC cannot restrict changes only to the image field.
* Admission Webhooks(mutating/validating)canenforce fine-grained policies (e.g., deny updates that change anything other than spec.containers[*].image).
* Exact extract (Kubernetes Docs - Admission Webhooks):
* "Admission webhooks can be used to enforce custom policies on objects being admitted." References:
Kubernetes Docs - RBAC: https://kubernetes.io/docs/reference/access-authn-authz/rbac/ Kubernetes Docs - Admission Webhooks: https://kubernetes.io/docs/reference/access-authn-authz
/extensible-admission-controllers/

NEW QUESTION # 17
Which step would give an attacker a foothold in a cluster butno long-term persistence?

• A. Create restarting container on host using Docker.
• B. Modify Kubernetes objects stored within etcd.
• C. Modify file on host filesystem.
• D. Starting a process in a running container.

Answer: D

Explanation:
* Starting a process in a running containerprovides an attacker withtemporary execution (foothold) inside the cluster, but once the container is stopped or restarted, that malicious process is lost. This means the attacker has nolong-term persistence.
* Incorrect options:
* (A) Modifying objects inetcdgrants persistent access since cluster state is stored in etcd.
* (B) Modifying files on thehost filesystemcan create persistence across reboots or container restarts.
* (D) Creating a restarting container directly on the host via Docker bypasses Kubernetes but persists across pod restarts if Docker restarts it.
References:
CNCF Security Whitepaper - Threat Modeling section: Describes howephemeral processes inside containersprovide attackers short-term control but not durable persistence.
Kubernetes Documentation - Cluster Threat Model emphasizes ephemeral vs. persistent attacker footholds.

NEW QUESTION # 18
In order to reduce the attack surface of the Scheduler, which default parameter should be set to false?

• A. --secure-kubeconfig
• B. --scheduler-name
• C. --profiling
• D. --bind-address

Answer: C

Explanation:
* Thekube-schedulerexposes aprofiling/debugging endpointwhen --profiling=true (default).
* This can unnecessarily increase the attack surface.
* Best practice: set --profiling=false in production.
* Exact extract (Kubernetes Docs - kube-scheduler flags):
* "--profiling (default true): Enable profiling via web interface host:port/debug/pprof/."
* Why others are wrong:
* --scheduler-name: just identifies the scheduler, not a security risk.
* --secure-kubeconfig: not a valid flag.
* --bind-address: changing it limits exposure but is not the default risk parameter for profiling.
References:
Kubernetes Docs - kube-scheduler options: https://kubernetes.io/docs/reference/command-line-tools- reference/kube-scheduler/

NEW QUESTION # 19
Which of the following statements regarding a container run with privileged: true is correct?

• A. A container run with privileged: true on a node can access all Secrets used on that node.
• B. A container run with privileged: true has no additional access to Secrets than if it were run with privileged: false.
• C. A container run with privileged: true within a cluster can access all Secrets used within that cluster.
• D. A container run with privileged: true within a Namespace can access all Secrets used within that Namespace.

Answer: B

Explanation:
* Setting privileged: true grants a containerelevated access to the host node, including access to host devices, kernel capabilities, and the ability to modify the host.
* However, Secrets in Kubernetes are not automatically exposedto privileged containers. Secrets are mounted into Pods only if explicitly referenced.
* Thus, being privilegeddoes not grant additional access to Kubernetes Secretscompared to a non- privileged Pod.
* The risk lies in node compromise: if a privileged container can take over the node, it could then indirectly gain access to Secrets (e.g., by reading kubelet credentials).
References:
Kubernetes Documentation - Security Context
CNCF Security Whitepaper - Pod security context and privileged container risks.

NEW QUESTION # 20
A user runs a command with kubectl to apply a change to a deployment. What is the first Kubernetes component that the request reaches?

• A. Kubernetes Scheduler
• B. kubelet
• C. Kubernetes Controller Manager
• D. Kubernetes API Server

Answer: D

Explanation:
* Allkubectl requestsgo to theKubernetes API Server.
* The API server is thefront-end of the control planeand validates/authenticates requests before other components act.
* Exact extract (Kubernetes Docs - Components):
* "The API server is a component of the Kubernetes control plane that exposes the Kubernetes API. It is the front end for the Kubernetes control plane."
* Other options clarified:
* Controller Manager: reconciles state after API Server processes the request.
* Scheduler: assigns Pods to nodes after API Server accepts workload objects.
* kubelet: node agent, only communicates after API Server updates desired state.
References:
Kubernetes Docs - Components: https://kubernetes.io/docs/concepts/overview/components/

NEW QUESTION # 21
What does thecluster-adminClusterRole enable when used in a RoleBinding?

• A. It allows read/write access to most resources in the role binding's namespace. This role does not allow write access to resource quota, to the namespace itself, and to EndpointSlices (or Endpoints).
• B. It gives full control over every resource in the role binding's namespace, including the namespace itself.
• C. It gives full control over every resource in the cluster and in all namespaces.
• D. It gives full control over every resource in the role binding's namespace, not including the namespace object for isolation purposes.

Answer: C

Explanation:
* Thecluster-adminClusterRole is asuperuser rolein Kubernetes.
* Binding it (via RoleBinding or ClusterRoleBinding) grantsunrestricted control over all resources in the cluster, across all namespaces.
* This includes management of cluster-scoped resources (nodes, CRDs, RBAC rules) and namespace- scoped resources.
* Therefore, cluster-admin is equivalent toroot-level accessin Kubernetes and must be used with extreme caution.
References:
Kubernetes Documentation - Default Roles and Role Bindings
CNCF Security Whitepaper - Identity and Access Management: cautions against assigningcluster-admin broadly due to its unrestricted nature.

NEW QUESTION # 22
What is Grafana?

• A. A container orchestration platform for managing and scaling applications.
• B. A cloud-native distributed tracing system for monitoring microservices architectures.
• C. A platform for monitoring and visualizing time-series data.
• D. A cloud-native security tool for scanning and detecting vulnerabilities in Kubernetes clusters.

Answer: C

Explanation:
* Grafana:An open-source analytics and visualization platform widely used with Prometheus, Loki, etc.
* Exact extract (Grafana Docs):"Grafana is the open-source analytics and monitoring solution for every database. It allows you to query, visualize, alert on, and understand your metrics no matter where they are stored."
* A is wrong:That describesJaeger(distributed tracing).
* B is wrong:That'sKubernetesitself.
* D is wrong:That'sTrivy/Aqua/Prismatype tools.
References:
Grafana Docs: https://grafana.com/docs/grafana/latest/

NEW QUESTION # 23
In a cluster that contains Nodes withmultiple container runtimesinstalled, how can a Pod be configured to be created on a specific runtime?

• A. By specifying the container runtime in the Pod's YAML file.
• B. By modifying the Docker daemon configuration.
• C. By setting the container runtime as an environment variable in the Pod.
• D. By using a command-line flag when creating the Pod.

Answer: A

Explanation:
* Kubernetes supportsmultiple container runtimeson a node via theRuntimeClassresource.
* To select a runtime, you specify the runtimeClassName field in thePod's YAML manifest. Example:
* apiVersion: v1
* kind: Pod
* metadata:
* name: example
* spec:
* runtimeClassName: gvisor
* containers:
* - name: app
* image: nginx
* Incorrect options:
* (A) You cannot specify container runtime through a kubectl command-line flag.
* (B) Modifying the Docker daemon config does not direct Kubernetes Pods to a runtime.
* (C) Environment variables inside a Pod spec do not control container runtimes.
References:
Kubernetes Documentation - RuntimeClass
CNCF Security Whitepaper - Workload isolation via different runtimes (e.g., gVisor, Kata) for enhanced security.

NEW QUESTION # 24
Which standard approach to security is augmented by the 4C's of Cloud Native security?

• A. Least Privilege
• B. Secure-by-Design
• C. Defense-in-Depth
• D. Zero Trust

Answer: C

Explanation:
* The 4C's model (Cloud, Cluster, Container, Code) is presented in the official Kubernetes documentation as alayeredmodel that explicitly maps todefense-in-depth.
* Exact extracts from Kubernetes docs(security overview):
* "The 4C's of Cloud Native Security are Cloud, Clusters, Containers, and Code."
* "You can think of the 4C's asa layered approach to security; applying security measures at each layer reduces risk."
* "This layered approach is commonly known asdefense in depth."
References:
Kubernetes Docs - Security overview #The 4C's of Cloud Native Security: https://kubernetes.io/docs
/concepts/security/overview/#the-4cs-of-cloud-native-security

NEW QUESTION # 25
Which of the following statements best describe container image signing and verification in the cloud environment?

• A. Container image signatures are mandatory in cloud environments, as cloud providers would deny the execution of unsigned container images.
• B. Container image signatures are concerned with defining developer ownership of applications within multi-tenant environments.
• C. Container image signatures and their verification ensure their authenticity and integrity against tampering.
• D. Container image signatures affect the performance of containerized applications, as they increase the size of images with additional metadata.

Answer: C

Explanation:
* Image signing (withNotary, cosign, or similar tools) ensures that images are from a trusted source and have not been modified.
* Exact extract (Sigstore cosign docs):"Cosign allows you to sign and verify container images to ensure authenticity and integrity."
* Why others are wrong:
* B:Ownership can be inferred but it's aboutauthenticity & integritynot tenancy.
* C:Not mandatory; enforcement requiresadmission controllers.
* D:Metadata size is negligible and has no runtime performance impact.
References:
Sigstore Project: https://docs.sigstore.dev/cosign/overview
CNCF Security Whitepaper

NEW QUESTION # 26
An attacker has access to the network segment that the cluster is on.
What happens when a compromised Pod attempts to connect to the API server?

• A. The compromised Pod is allowed to connect to the API server without any restrictions.
• B. The compromised Pod is automatically isolated from the network to prevent any connections to the API server.
• C. The compromised Pod attempts to connect to the API server, but its requests may be blocked due to network policies.
• D. The compromised Pod connects to the API server and is granted elevated privileges by default.

Answer: C

Explanation:
* By default,Pods can connect to the API server(since ServiceAccount tokens are mounted).
* However, whether they succeed in acting depends on:
* Network Policies(may block egress).
* RBAC(controls permissions).
* Exact extract (Kubernetes Docs - API Access):
* "Pods authenticate to the API server using the service account token mounted into the Pod.
Authorization is then enforced by RBAC. NetworkPolicies may further restrict access."
* Clarifications:
* A: No default automatic isolation.
* B: Not always unrestricted; policies may apply.
* D: Pods get minimal default privileges, not automatic elevation.
References:
Kubernetes Docs - API Access to Pods: https://kubernetes.io/docs/concepts/security/service-accounts/ Kubernetes Docs - Network Policies: https://kubernetes.io/docs/concepts/services-networking/network- policies/

NEW QUESTION # 27
What is the reasoning behind considering the Cloud as the trusted computing base of a Kubernetes cluster?

• A. The Cloud enforces security controls at the Kubernetes cluster level, so application developers can focus on applications only.
• B. A vulnerability in the Cloud layer has a negligible impact on containers due to Linux isolation mechanisms.
• C. A Kubernetes cluster can only be as secure as the security posture of its Cloud hosting.
• D. A Kubernetes cluster can only be trusted if the underlying Cloud provider is certified against international standards.

Answer: C

Explanation:
* The4C's of Cloud Native Security(Cloud, Cluster, Container, Code) model starts withCloudas the base layer.
* If the Cloud (infrastructure layer) is compromised, every higher layer (Cluster, Container, Code) inherits that compromise.
* Exact extract (Kubernetes Security Overview):
* "The 4C's of Cloud Native security are Cloud, Clusters, Containers, and Code. You can think of the 4C's as a layered approach. A Kubernetes cluster can only be as secure as the cloud infrastructure it is deployed on."
* This means the cloud is part of thetrusted computing baseof a Kubernetes cluster.
References:
Kubernetes Docs - Security Overview (4C's): https://kubernetes.io/docs/concepts/security/overview/#the-
4cs-of-cloud-native-security

NEW QUESTION # 28
What mechanism can I use to block unsigned images from running in my cluster?

• A. Configuring Container Runtime Interface (CRI) to enforce image signing and validation.
• B. Enabling Admission Controllers to validate image signatures.
• C. Using Pod Security Standards (PSS) to enforce validation of signatures.
• D. Using PodSecurityPolicy (PSP) to enforce image signing and validation.

Answer: B

Explanation:
* KubernetesAdmission Controllers(particularlyValidatingAdmissionWebhooks) can be used to enforce policies that validate image signatures.
* This is commonly implemented withtools like Sigstore/cosign, Kyverno, or OPA Gatekeeper.
* PodSecurityPolicy (PSP):deprecated and never supported image signature validation.
* Pod Security Standards (PSS):only apply to pod security fields (privilege, users, host access), not image signatures.
* CRI:while runtimes (containerd, CRI-O) may integrate with signature verification tools, enforcement in Kubernetes is generally done viaAdmission Controllersat the API layer.
Exact extract (Admission Controllers docs):
* "Admission webhooks can be used to enforce custom policies on the objects being admitted." (e.g., validating signatures).
References:
Kubernetes Docs - Admission Controllers: https://kubernetes.io/docs/reference/access-authn-authz
/admission-controllers/
Sigstore Project (cosign): https://sigstore.dev/
Kyverno ImageVerify Policy: https://kyverno.io/policies/pod-security/require-image-verification/

NEW QUESTION # 29
In the event that kube-proxy is in a CrashLoopBackOff state, what impact does it have on the Pods running on the same worker node?

• A. The Pod's security context restrictions cannot be enforced.
• B. The Pods cannot communicate with other Pods in the cluster.
• C. The Pod's resource utilization increases significantly.
• D. The Pod cannot mount persistent volumes through CSI drivers.

Answer: B

Explanation:
* kube-proxy:manages cluster network routing rules (via iptables or IPVS). It enables Pods to communicate with Services and Pods across nodes.
* If kube-proxy fails (CrashLoopBackOff), service IP routing and cluster-wide pod-to-pod networking breaks. Local Pod-to-Pod communication within the same node may still work, butcross-node communication fails.
* Exact extract (Kubernetes Docs - kube-proxy):
* "kube-proxy maintains network rules on nodes. These rules allow network communication to Pods from network sessions inside or outside of the cluster." References:
Kubernetes Docs - kube-proxy: https://kubernetes.io/docs/reference/command-line-tools-reference/kube- proxy/

NEW QUESTION # 30
What is a multi-stage build?

• A. A build process that involves multiple developers collaborating on building an image.
• B. A build process that involves multiple stages of image creation, allowing for smaller, optimized images.
• C. A build process that involves multiple repositories for storing container images.
• D. A build process that involves multiple containers running simultaneously to speed up the image creation.

Answer: B

Explanation:
* Multi-stage buildsare a Docker/Kaniko feature that allows building images in multiple stages # final image contains only runtime artifacts, not build tools.
* This reducesimage size, attack surface, and security risks.
* Exact extract (Docker Docs):
* "Multi-stage builds allow you to use multiple FROM statements in a Dockerfile. You can copy artifacts from one stage to another, resulting in smaller, optimized images."
* Clarifications:
* A: Collaboration is not the definition.
* B: Multiple repositories # multi-stage builds.
* C: Build concurrency # multi-stage builds.
References:
Docker Docs - Multi-Stage Builds: https://docs.docker.com/develop/develop-images/multistage-build/

NEW QUESTION # 31
Which security knowledge-base focuses specifically onoffensive tools, techniques, and procedures?

• A. MITRE ATT&CK
• B. OWASP Top 10
• C. NIST Cybersecurity Framework
• D. CIS Controls

Answer: A

Explanation:
* MITRE ATT&CKis a globally recognizedknowledge base of adversary tactics, techniques, and procedures (TTPs). It is focused on describingoffensive behaviorsattackers use.
* Incorrect options:
* (B)OWASP Top 10highlights common application vulnerabilities, not attacker techniques.
* (C)CIS Controlsare defensive best practices, not offensive tools.
* (D)NIST Cybersecurity Frameworkprovides a risk-based defensive framework, not adversary TTPs.
References:
MITRE ATT&CK Framework
CNCF Security Whitepaper - Threat intelligence section: references MITRE ATT&CK for describing attacker behavior.

NEW QUESTION # 32
Which label should be added to the Namespace to block any privileged Pods from being created in that Namespace?

• A. privileged: true
• B. pod.security.kubernetes.io/privileged: false
• C. pod-security.kubernetes.io/enforce: baseline
• D. privileged: false

Answer: C

Explanation:
* KubernetesPod Security Admission (PSA)enforcesPod Security Standardsby applying labels on Namespaces.
* Exact extract (Kubernetes Docs - Pod Security Admission):
* "You can label a namespace with pod-security.kubernetes.io/enforce: baseline to enforce the Baseline policy."
* Thebaselineprofile explicitly disallowsprivileged podsand other unsafe features.
* Why others are wrong:
* A & D: These labels do not exist in Kubernetes.
* B: Setting privileged: true would allow privileged pods, not block them.
References:
Kubernetes Docs - Pod Security Admission: https://kubernetes.io/docs/concepts/security/pod-security- admission/ Kubernetes Docs - Pod Security Standards: https://kubernetes.io/docs/concepts/security/pod-security- standards/

NEW QUESTION # 33
What was the name of the precursor to Pod Security Standards?

• A. Kubernetes Security Context
• B. Pod Security Policy
• C. Container Runtime Security
• D. Container Security Standards

Answer: B

Explanation:
* Kubernetes originally had a feature calledPodSecurityPolicy (PSP), which provided controls to restrict pod behavior.
* Official docs:
* "PodSecurityPolicy was deprecated in Kubernetes v1.21 and removed in v1.25."
* "Pod Security Standards (PSS) replace PodSecurityPolicy (PSP) with a simpler, policy- driven approach."
* PSP was often complex and hard to manage, so it was replaced by Pod Security Admission (PSA) which enforcesPod Security Standards.
References:
Kubernetes Docs - PodSecurityPolicy (deprecated): https://kubernetes.io/docs/concepts/security/pod- security-policy/ Kubernetes Blog - PodSecurityPolicy Deprecation: https://kubernetes.io/blog/2021/04/06/podsecuritypolicy- deprecation-past-present-and-future/

NEW QUESTION # 34
A cluster is failing to pull more recent versions of images from k8s.gcr.io. Why may this be?

• A. There is a bug in the container runtime or the image pull process.
• B. There is a network connectivity issue between the cluster and k8s.gcr.io.
• C. The container image registry k8s.gcr.io has been deprecated.
• D. The authentication credentials for accessing k8s.gcr.io are incorrectly scoped.

Answer: C

Explanation:
* k8s.gcr.iowas the historic Kubernetes image registry.
* It has beendeprecatedand replaced withregistry.k8s.io.
* Exact extract (Kubernetes Blog):
* "The k8s.gcr.io image registry will be frozen from April 3, 2023 and fully deprecated. All Kubernetes project images are now served from registry.k8s.io."
* Pulling newer versions from k8s.gcr.io fails because the registry no longer receives updates.
References:
Kubernetes Blog - Image Registry Update: https://kubernetes.io/blog/2023/02/06/k8s-gcr-io-freeze- announcement/

NEW QUESTION # 35
Which of the following statements best describes the role of the Scheduler in Kubernetes?

• A. The Scheduler is responsible for managing the deployment and scaling of applications in the Kubernetes cluster.
• B. The Scheduler is responsible for ensuring the security of the Kubernetes cluster and its components.
• C. The Scheduler is responsible for assigning Pods to nodes based on resource availability and other constraints.
• D. The Scheduler is responsible for monitoring and managing the health of the Kubernetes cluster.

Answer: C

Explanation:
* TheKubernetes Schedulerassigns Pods to nodes based on:
* Resource requests & availability (CPU, memory, GPU, etc.)
* Constraints (affinity, taints, tolerations, topology, policies)
* Exact extract (Kubernetes Docs - Scheduler):
* "The scheduler is a control plane process that assigns Pods to Nodes. Scheduling decisions take into account resource requirements, affinity/anti-affinity, constraints, and policies."
* Other options clarified:
* A: Monitoring cluster health is theController Manager's/kubelet's job.
* B: Security is enforced throughRBAC, admission controllers, PSP/PSA, not the scheduler.
* C: Deployment scaling is handled by theController Manager(Deployment/ReplicaSet controller).
References:
Kubernetes Docs - Scheduler: https://kubernetes.io/docs/concepts/scheduling-eviction/kube-scheduler/

NEW QUESTION # 36
A Kubernetes cluster tenant can launch privileged Pods in contravention of therestricted Pod Security Standardmandated for cluster tenants and enforced by the built-inPodSecurity admission controller.
The tenant has full CRUD permissions on the namespace object and the namespaced resources. How did the tenant achieve this?

• A. By deleting the PodSecurity admission controller deployment running in their namespace.
• B. By tampering with the namespace labels.
• C. The scope of the tenant role means privilege escalation is impossible.
• D. By using higher-level access credentials obtained reading secrets from another namespace.

Answer: B

Explanation:
* ThePodSecurity admission controllerenforces Pod Security Standards (Baseline, Restricted, Privileged)based on namespace labels.
* If a tenant has full CRUD on the namespace object, they canmodify the namespace labelsto remove or weaken the restriction (e.g., setting pod-security.kubernetes.io/enforce=privileged).
* This allows privileged Pods to be admitted despite the security policy.
* Incorrect options:
* (A) is false - namespace-level access allows tampering.
* (C) is invalid - PodSecurity admission is not namespace-deployed, it's a cluster-wide admission controller.
* (D) is unrelated - Secrets from other namespaces wouldn't directly bypass PodSecurity enforcement.
References:
Kubernetes Documentation - Pod Security Admission
CNCF Security Whitepaper - Admission control and namespace-level policy enforcement weaknesses.

NEW QUESTION # 37
Which of the following is a valid security risk caused by having no egress controls in a Kubernetes cluster?

• A. Unauthorized access to external resources
• B. Data exfiltration
• C. Increased attack surface
• D. Denial of Service

Answer: B

Explanation:
* Egress NetworkPoliciesrestrict outbound traffic from Pods.
* Without egress restrictions, a compromised Pod could exfiltrate sensitive data (secrets, logs, customer data) to an attacker-controlled server.
* Exact extract (Kubernetes Docs - Network Policies):
* "Egress rules control outbound connections from Pods. Without such restrictions, compromised workloads can connect freely to external endpoints."
* Other options clarified:
* A: DoS is more about flooding, not egress absence.
* C: "Increased attack surface" is vague but not the main risk.
* D: True in a sense, but the precise and most common risk isdata exfiltration.
References:
Kubernetes Docs - Network Policies: https://kubernetes.io/docs/concepts/services-networking/network- policies/

NEW QUESTION # 38
......

Linux Foundation Certified KCSA  Dumps Questions Valid KCSA Materials: https://www.prep4pass.com/KCSA_exam-braindumps.html

Current KCSA Exam Dumps [2026] Complete Linux Foundation Exam Smoothly: https://drive.google.com/open?id=1b1dGsV4wfr7HZuCTVTPvvKxS0kBlmLOq