[2026年03月] 合格させるKCSA試験一発合格、最新のKCSA Fast2testの提供する試験問題
Kubernetes and Cloud Native問題集でKCSA試験の完全版解答試験学習ガイド
Linux Foundation KCSA 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
質問 # 36
How do Kubernetes namespaces impact the application of policies when using Pod Security Admission?
- A. Namespaces are ignored; Pod Security Admission policies apply cluster-wide only.
- B. The default namespace enforces the strictest security policies by default.
- C. Each namespace can have only one active policy.
- D. Different policies can be applied to specific namespaces.
正解：D
解説：
* Pod Security Admission (PSA)enforces policies by applyinglabels on namespaces, not globally across the cluster.
* Exact extract (Kubernetes Docs - Pod Security Admission):
* "You can apply Pod Security Standards to namespaces by adding labels such as pod- security.kubernetes.io/enforce. Different namespaces can enforce different policies."
* Clarifications:
* A: Incorrect, namespaces are the unit of enforcement.
* C: Misleading - a namespace can have multiple enforcement modes (enforce, audit, warn).
* D: Default namespace doesnotenforce strict policies unless labeled.
References:
Kubernetes Docs - Pod Security Admission: https://kubernetes.io/docs/concepts/security/pod-security- admission/
質問 # 37
A cluster administrator wants to enforce the use of a different container runtime depending on the application a workload belongs to.
- A. By configuring avalidating admission controllerwebhook that verifies the container runtime based on the application label and rejects requests that do not comply.
- B. By manually modifying the container runtime for each workload after it has been created.
- C. By modifying the kube-apiserver configuration file to specify the desired container runtime for each application.
- D. By configuring amutating admission controllerwebhook that intercepts new workload creation requests and modifies the container runtime based on the application label.
正解：D
解説：
* Kubernetes supports workload-specific runtimes viaRuntimeClass.
* Amutating admission controllercan enforce this automatically by:
* Intercepting workload creation requests.
* Modifying the Pod spec to set runtimeClassName based on labels or policies.
* Incorrect options:
* (A) Manual modification is not scalable or secure.
* (B) kube-apiserver cannot enforce per-application runtime policies.
* (C) A validating webhook can onlyreject, not modify, the runtime.
References:
Kubernetes Documentation - RuntimeClass
CNCF Security Whitepaper - Admission controllers for enforcing runtime policies.
質問 # 38
Why mightNetworkPolicyresources have no effect in a Kubernetes cluster?
- A. NetworkPolicy resources are only enforced for unprivileged Pods.
- B. NetworkPolicy resources are only enforced if the networking plugin supports them.
- C. NetworkPolicy resources are only enforced if the Kubernetes scheduler supports them.
- D. NetworkPolicy resources are only enforced if the user has the right RBAC permissions.
正解：B
解説：
* NetworkPolicies define how Pods can communicate with each other and external endpoints.
* However, Kubernetes itselfdoes not enforce NetworkPolicy. Enforcement depends on theCNI plugin used (e.g., Calico, Cilium, Kube-Router, Weave Net).
* If a cluster is using a network plugin that does not support NetworkPolicies, then creating NetworkPolicy objects hasno effect.
References:
Kubernetes Documentation - Network Policies
CNCF Security Whitepaper - Platform security section: notes that security enforcement relies on CNI capabilities.
質問 # 39
Which of the following statements is true concerning the use ofmicroVMsover user-space kernel implementations for advanced container sandboxing?
- A. MicroVMs offer lower isolation and security compared to user-space kernel implementations.
- B. MicroVMs provide reduced application compatibility and higher per-system call overhead than user- space kernel implementations.
- C. MicroVMs offer higher isolation than user-space kernel implementations at the cost of a higher per- instance memory footprint.
- D. MicroVMs allow for easier container management and orchestration than user-space kernel implementation.
正解：C
解説：
* MicroVM-based runtimes(e.g., Firecracker, Kata Containers) use lightweight VMs to provide strong isolation between workloads.
* Compared touser-space kernel implementations(e.g., gVisor), microVMs generally:
* Offerhigher isolation and security(due to VM-level separation).
* Come with ahigher memory and resource overhead per instancethan user-space approaches.
* Incorrect options:
* (A) Orchestration is handled by Kubernetes, not inherently easier with microVMs.
* (C) Compatibility is typically better with microVMs, not worse.
* (D) Isolation is stronger, not weaker.
References:
CNCF Security Whitepaper - Workload isolation: microVMs vs. user-space kernel sandboxes.
Kata Containers Project - isolation trade-offs.
質問 # 40
When using a cloud provider's managed Kubernetes service, who is responsible for maintaining the etcd cluster?
- A. Application developer
- B. Kubernetes administrator
- C. Cloud provider
- D. Namespace administrator
正解：C
解説：
* Inmanaged Kubernetes services(EKS, GKE, AKS), the control plane is operated by thecloud provider
.
* This includesetcd, API server, controller manager, scheduler.
* Users manageworker nodes(in some models) and workloads, but not the control plane.
* Exact extract (GKE Docs):
* "The control plane, including the API server and etcd database, is managed and maintained by Google."
* Similarly forEKSandAKS, etcd is fully managed by the provider.
References:
GKE Architecture: https://cloud.google.com/kubernetes-engine/docs/concepts/cluster-architecture EKS Architecture: https://docs.aws.amazon.com/eks/latest/userguide/eks-architecture.html AKS Docs: https://learn.microsoft.com/en-us/azure/aks/concepts-clusters-workloads
質問 # 41
Which of the following statements correctly describes a container breakout?
- A. A container breakout is the process of escaping the container and gaining access to the Pod's network traffic.
- B. A container breakout is the process of escaping a container when it reaches its resource limits.
- C. A container breakout is the process of escaping the container and gaining access to the host operating system.
- D. A container breakout is the process of escaping the container and gaining access to the cloud provider's infrastructure.
正解：C
解説：
* Container breakoutrefers to an attacker escaping container isolation and reaching thehost OS.
* Once the host is compromised, the attacker can accessother containers, Kubernetes nodes, or escalate further.
* Exact extract (Kubernetes Security Docs):
* "If an attacker gains access to a container, they may attempt a container breakout to gain access to the host system."
* Other options clarified:
* A: Network access inside a Pod # breakout.
* B: Resource exhaustion is aDoS, not a breakout.
* C: Cloud infrastructure compromise is possibleafterhost compromise, but not the definition of breakout.
References:
Kubernetes Security Concepts: https://kubernetes.io/docs/concepts/security/ CNCF Security Whitepaper (Threats section):https://github.com/cncf/tag-security
質問 # 42
Which of the following statements regarding a container run with privileged: true is correct?
- A. A container run with privileged: true within a Namespace can access all Secrets used within that Namespace.
- B. A container run with privileged: true has no additional access to Secrets than if it were run with privileged: false.
- C. A container run with privileged: true on a node can access all Secrets used on that node.
- D. A container run with privileged: true within a cluster can access all Secrets used within that cluster.
正解：B
解説：
* Setting privileged: true grants a containerelevated access to the host node, including access to host devices, kernel capabilities, and the ability to modify the host.
* However, Secrets in Kubernetes are not automatically exposedto privileged containers. Secrets are mounted into Pods only if explicitly referenced.
* Thus, being privilegeddoes not grant additional access to Kubernetes Secretscompared to a non- privileged Pod.
* The risk lies in node compromise: if a privileged container can take over the node, it could then indirectly gain access to Secrets (e.g., by reading kubelet credentials).
References:
Kubernetes Documentation - Security Context
CNCF Security Whitepaper - Pod security context and privileged container risks.
質問 # 43
What is Grafana?
- A. A platform for monitoring and visualizing time-series data.
- B. A container orchestration platform for managing and scaling applications.
- C. A cloud-native security tool for scanning and detecting vulnerabilities in Kubernetes clusters.
- D. A cloud-native distributed tracing system for monitoring microservices architectures.
正解：A
解説：
* Grafana:An open-source analytics and visualization platform widely used with Prometheus, Loki, etc.
* Exact extract (Grafana Docs):"Grafana is the open-source analytics and monitoring solution for every database. It allows you to query, visualize, alert on, and understand your metrics no matter where they are stored."
* A is wrong:That describesJaeger(distributed tracing).
* B is wrong:That'sKubernetesitself.
* D is wrong:That'sTrivy/Aqua/Prismatype tools.
References:
Grafana Docs: https://grafana.com/docs/grafana/latest/
質問 # 44
When should soft multitenancy be used over hard multitenancy?
- A. When the priority is enabling complete isolation between tenants.
- B. When the priority is enabling resource sharing and efficiency between tenants.
- C. When the priority is enabling fine-grained control over tenant resources.
- D. When the priority is enabling strict security boundaries between tenants.
正解：B
解説：
* Soft multitenancy(Namespaces, RBAC, Network Policies) # assumes some level of trust between tenants, focuses onresource sharing and efficiency.
* Hard multitenancy(separate clusters or strong virtualization) # strict isolation, used when tenants are untrusted.
* Exact extract (CNCF TAG Security Multi-Tenancy Whitepaper):
* "Soft multi-tenancy refers to multiple workloads running in the same cluster with some trust assumptions. It provides resource sharing and operational efficiency. Hard multi- tenancy requires stronger isolation guarantees, typically separate clusters." References:
CNCF Security TAG - Multi-Tenancy Whitepaper:https://github.com/cncf/tag-security/tree/main/multi- tenancy
質問 # 45
In Kubernetes, what isPublic Key Infrastructure (PKI)used for?
- A. To manage certificates and ensure secure communication in a Kubernetes cluster.
- B. To automate the scaling of containers in a Kubernetes cluster.
- C. To manage networking in a Kubernetes cluster.
- D. To monitor and analyze performance metrics of a Kubernetes cluster.
正解：A
解説：
* Kubernetes usesPKI certificatesextensively to secure communication between control plane components (API server, etcd, kube-scheduler, kube-controller-manager) and with kubelets.
* Certificates enablemutual TLS authentication and encryptionacross components.
* PKI does not handle scaling, networking, or monitoring.
References:
Kubernetes Documentation - Certificates
CNCF Security Whitepaper - Cluster communication security and the role of PKI.
質問 # 46
Which technology can be used to apply security policy for internal cluster traffic at the application layer of the network?
- A. Ingress Controller
- B. Container Runtime
- C. Network Policy
- D. Service Mesh
正解：D
解説：
* Service Mesh (e.g., Istio, Linkerd, Consul):operates atLayer 7 (application layer), enforcing policies like mTLS, authorization, and routing between services.
* NetworkPolicy:works atLayer 3/4 (IP/port), not Layer 7.
* Ingress Controller:handles external traffic ingress, not internal service-to-service traffic.
* Container Runtime:responsible for running containers, not enforcing application-layer security.
Exact extract (Istio docs):
* "Istio provides security by enforcing authentication, authorization, and encryption of service-to- service communication." References:
Kubernetes Docs - Network Policies: https://kubernetes.io/docs/concepts/services-networking/network- policies/ Istio Security Docs: https://istio.io/latest/docs/concepts/security/
質問 # 47
What is the difference between gVisor and Firecracker?
- A. gVisor and Firecracker are two names for the same technology, which provides isolation and security for containers.
- B. gVisor is a lightweight virtualization technology for creating and managing secure, multi-tenant container and function-as-a-service (FaaS) workloads. At the same time, Firecracker is a user-space kernel that provides isolation and security for containers.
- C. gVisor is a user-space kernel that provides isolation and security for containers. At the same time, Firecracker is a lightweight virtualization technology for creating and managing secure, multi-tenant container and function-as-a-service (FaaS) workloads.
- D. gVisor and Firecracker are both container runtimes that can be used interchangeably.
正解：C
解説：
* gVisor:
* Google-developed, implemented as auser-space kernelthat intercepts and emulates syscalls made by containers.
* Providesstrong isolationwithout requiring a full VM.
* Official docs: "gVisor is a user-space kernel, written in Go, that implements a substantial portion of the Linux system call interface."
* Source: https://gvisor.dev/docs/
* Firecracker:
* AWS-developed,lightweight virtualization technologybuilt on KVM, used in AWS Lambda and Fargate.
* Optimized for running secure, multi-tenant microVMs (MicroVMs) for containers and FaaS.
* Official docs: "Firecracker is an open-source virtualization technology that is purpose-built for creating and managing secure, multi-tenant container and function-based services."
* Source: https://firecracker-microvm.github.io/
* Key difference:gVisor # syscall interception in userspace kernel (container isolation). Firecracker # lightweight virtualization with microVMs (multi-tenant security).
* Therefore, optionAis correct.
References:
gVisor Docs: https://gvisor.dev/docs/
Firecracker Docs: https://firecracker-microvm.github.io/
質問 # 48
Which of the following statements best describes the role of the Scheduler in Kubernetes?
- A. The Scheduler is responsible for assigning Pods to nodes based on resource availability and other constraints.
- B. The Scheduler is responsible for monitoring and managing the health of the Kubernetes cluster.
- C. The Scheduler is responsible for managing the deployment and scaling of applications in the Kubernetes cluster.
- D. The Scheduler is responsible for ensuring the security of the Kubernetes cluster and its components.
正解：A
解説：
* TheKubernetes Schedulerassigns Pods to nodes based on:
* Resource requests & availability (CPU, memory, GPU, etc.)
* Constraints (affinity, taints, tolerations, topology, policies)
* Exact extract (Kubernetes Docs - Scheduler):
* "The scheduler is a control plane process that assigns Pods to Nodes. Scheduling decisions take into account resource requirements, affinity/anti-affinity, constraints, and policies."
* Other options clarified:
* A: Monitoring cluster health is theController Manager's/kubelet's job.
* B: Security is enforced throughRBAC, admission controllers, PSP/PSA, not the scheduler.
* C: Deployment scaling is handled by theController Manager(Deployment/ReplicaSet controller).
References:
Kubernetes Docs - Scheduler: https://kubernetes.io/docs/concepts/scheduling-eviction/kube-scheduler/
質問 # 49
Which of the following statements best describes the role of the Scheduler in Kubernetes?
- A. The Scheduler is responsible for assigning Pods to nodes based on resource availability and other constraints.
- B. The Scheduler is responsible for monitoring and managing the health of the Kubernetes cluster.
- C. The Scheduler is responsible for managing the deployment and scaling of applications in the Kubernetes cluster.
- D. The Scheduler is responsible for ensuring the security of the Kubernetes cluster and its components.
正解：A
解説：
* TheKubernetes Schedulerassigns Pods to nodes based on:
* Resource requests & availability (CPU, memory, GPU, etc.)
* Constraints (affinity, taints, tolerations, topology, policies)
* Exact extract (Kubernetes Docs - Scheduler):
* "The scheduler is a control plane process that assigns Pods to Nodes. Scheduling decisions take into account resource requirements, affinity/anti-affinity, constraints, and policies."
* Other options clarified:
* A: Monitoring cluster health is theController Manager's/kubelet's job.
* B: Security is enforced throughRBAC, admission controllers, PSP/PSA, not the scheduler.
* C: Deployment scaling is handled by theController Manager(Deployment/ReplicaSet controller).
References:
Kubernetes Docs - Scheduler: https://kubernetes.io/docs/concepts/scheduling-eviction/kube-scheduler/
質問 # 50
To restrict the kubelet's rights to the Kubernetes API, whatauthorization modeshould be set on the Kubernetes API server?
- A. AlwaysAllow
- B. Webhook
- C. kubelet
- D. Node
正解：D
解説：
* TheNode authorization modeis designed to specifically limit what kubelets can do when they connect to the Kubernetes API server.
* It authorizes requests from kubelets based on the Pods scheduled to run on their nodes, ensuring kubelets cannot interact with resources beyond their scope.
* Incorrect options:
* (B)AlwaysAllowallows unrestricted access (insecure).
* (C) No kubelet authorization mode exists.
* (D)Webhookmode delegates authorization decisions to an external service, not specifically for kubelets.
References:
Kubernetes Documentation - Node Authorization
CNCF Security Whitepaper - Access control: kubelet authorization and Node authorizer.
質問 # 51
Is it possible to restrict permissions so that a controller can only change the image of a deployment (without changing anything else about it, e.g., environment variables, commands, replicas, secrets)?
- A. Yes, by granting permission to the /image subresource.
- B. Yes, with a 'managed fields' annotation.
- C. Not with RBAC, but it is possible with an admission webhook.
- D. No, because granting access to the spec.containers.image field always grants access to the rest of the spec object.
正解：C
解説：
* RBAC in Kubernetesis coarse-grained: it controlsverbs(get, update, patch, delete) onresources(e.g., deployments), butnot individual fieldswithin a resource.
* There isno /image subresource for deployments(there is one for pods but only for ephemeral containers).
* Therefore,RBAC cannot restrict changes only to the image field.
* Admission Webhooks(mutating/validating)canenforce fine-grained policies (e.g., deny updates that change anything other than spec.containers[*].image).
* Exact extract (Kubernetes Docs - Admission Webhooks):
* "Admission webhooks can be used to enforce custom policies on objects being admitted." References:
Kubernetes Docs - RBAC: https://kubernetes.io/docs/reference/access-authn-authz/rbac/ Kubernetes Docs - Admission Webhooks: https://kubernetes.io/docs/reference/access-authn-authz
/extensible-admission-controllers/
質問 # 52
Which of the following represents a baseline security measure for containers?
- A. Implementing access control to restrict container access.
- B. Configuring persistent storage for containers.
- C. Configuring a static IP for each container.
- D. Run containers as the root user.
正解：A
解説：
* Access control (RBAC, least privilege, user restrictions)is abaseline container security best practice.
* Exact extract (Kubernetes Pod Security Standards - Baseline):
* "The baseline profile is designed to prevent known privilege escalations. It prohibits running privileged containers or containers as root."
* Other options clarified:
* B: Static IPs not a security measure.
* C: Persistent storage is functionality, not security.
* D: Running as root is explicitlyinsecure.
References:
Kubernetes Docs - Pod Security Standards (Baseline): https://kubernetes.io/docs/concepts/security/pod- security-standards/
質問 # 53
Why does the defaultbase64 encodingthat Kubernetes applies to the contents of Secret resources provide inadequate protection?
- A. Base64 encoding does not encrypt the contents of the Secret, only obfuscates it.
- B. Base64 encoding is vulnerable to brute-force attacks.
- C. Base64 encoding relies on a shared key which can be easily compromised.
- D. Base64 encoding is not supported by all Secret Stores.
正解：A
解説：
* Kubernetes stores Secret data asbase64-encoded stringsin etcd by default.
* Base64 is not encryption- it is a simple encoding scheme that merelyobfuscatesdata for transport and storage. Anyone with read access to etcd or the Secret manifest can easily decode the value back to plaintext.
* For actual protection, Kubernetes supportsencryption at rest(via encryption providers) and external Secret management (Vault, KMS, etc.).
References:
Kubernetes Documentation - Secrets
CNCF Security Whitepaper - Data protection section: highlights that base64 encoding does not protect data and encryption at rest is recommended.
質問 # 54
A user runs a command with kubectl to apply a change to a deployment. What is the first Kubernetes component that the request reaches?
- A. Kubernetes Scheduler
- B. Kubernetes API Server
- C. kubelet
- D. Kubernetes Controller Manager
正解：B
解説：
* Allkubectl requestsgo to theKubernetes API Server.
* The API server is thefront-end of the control planeand validates/authenticates requests before other components act.
* Exact extract (Kubernetes Docs - Components):
* "The API server is a component of the Kubernetes control plane that exposes the Kubernetes API. It is the front end for the Kubernetes control plane."
* Other options clarified:
* Controller Manager: reconciles state after API Server processes the request.
* Scheduler: assigns Pods to nodes after API Server accepts workload objects.
* kubelet: node agent, only communicates after API Server updates desired state.
References:
Kubernetes Docs - Components: https://kubernetes.io/docs/concepts/overview/components/
質問 # 55
What information is stored in etcd?
- A. Sensitive user data such as usernames and passwords.
- B. Application logs and monitoring data for auditing and troubleshooting purposes.
- C. Etcd manages the configuration data, state data, and metadata for Kubernetes.
- D. Pod data contained in Persistent Volume Claims (e.g. hostPath).
正解：C
解説：
* etcdis Kubernetes'key-value storeforcluster state.
* Stores: ConfigMaps, Secrets, Pod definitions, Deployments, RBAC policies, and metadata.
* Exact extract (Kubernetes Docs - etcd):
* "etcd is a consistent and highly-available key-value store used as Kubernetes' backing store for all cluster data."
* Clarifications:
* B: Logs/metrics are handled by logging/monitoring solutions, not etcd.
* C: Secrets may be stored here but encoded in base64, not specifically "usernames/passwords" as primary use.
* D: Persistent Volumes are external storage, not stored in etcd.
References:
Kubernetes Docs - etcd: https://kubernetes.io/docs/concepts/overview/components/#etcd
質問 # 56
How can a user enforce thePod Security Standardwithout third-party tools?
- A. It is only possible to enforce the Pod Security Standard with additional tools within the cloud native ecosystem.
- B. Use the PodSecurity admission controller.
- C. Through implementing Kyverno or OPA Policies.
- D. No additional measures have to be taken to enforce the Pod Security Standard.
正解：B
解説：
* ThePodSecurity admission controller(built-in as of Kubernetes v1.23+) enforces the Pod Security Standards (Privileged, Baseline, Restricted).
* Enforcement is namespace-scoped and configured throughnamespace labels.
* Incorrect options:
* (A) Kyverno/OPA are external policy tools (useful but not required).
* (C) Not true, PodSecurity admission provides native enforcement.
* (D) Enforcement requires explicit configuration, not automatic.
References:
Kubernetes Documentation - Pod Security Admission
CNCF Security Whitepaper - Policy enforcement and admission control.
質問 # 57
......
正真正銘のベスト材料はKCSAオンライン練習試験：https://jp.fast2test.com/KCSA-premium-file.html
最高品質のKCSA問題集と解釈が待ってます！今すぐ取得せよ：https://drive.google.com/open?id=1j2W05ALc8hPUyUmmo8iPL18D-RIwR0W3