KCSA — Compliance & Security Frameworks — Practice Questions
Practice Questions — Compliance & Security Frameworks
These 10 multiple-choice questions cover the key concepts from the Compliance and Security Frameworks domain (10% of the KCSA exam). Topics include CIS Benchmarks, NIST standards, security audit tools, compliance automation, and regulatory requirements.
How to use these questions:
- Read each question carefully — watch for negative qualifiers like “NOT”
- Try to answer before expanding the answer section
- Use the elimination technique: cross off obviously wrong options first
- Read the full explanation for every question — even the ones you got right
- Track your score at the end
Questions
Q1: Which section of the CIS Kubernetes Benchmark covers Network Policies, RBAC, and Secret encryption?
A) Section 1 — Control Plane Components
B) Section 2 — etcd
C) Section 4 — Worker Nodes
D) Section 5 — Policies
Show Answer
Correct Answer: D) Section 5 — Policies
Section 5 of the CIS Kubernetes Benchmark covers cluster-wide policies including RBAC, Pod Security Standards, Network Policies, and Secret encryption. These are policy-level controls that apply across the cluster.
- A) Section 1 — Control Plane Components — Incorrect. Section 1 covers API server flags, controller manager, and scheduler configuration — not cluster-wide policies.
- B) Section 2 — etcd — Incorrect. Section 2 covers etcd-specific configuration like TLS, client authentication, and data directory permissions.
- C) Section 4 — Worker Nodes — Incorrect. Section 4 covers kubelet configuration, file permissions, and worker node hardening.
- D) Section 5 — Policies — Correct. This section covers RBAC least privilege, Pod Security Standards enforcement, Network Policy requirements, and Secret encryption at rest.
Domain: Compliance and Security Frameworks — CIS Kubernetes Benchmark
Q2: What does kube-bench do when it finds a CIS Benchmark violation?
A) Automatically remediates the violation and re-checks
B) Reports the violation with PASS/FAIL/WARN/INFO status — remediation is a separate step
C) Blocks the non-compliant resource from being deployed
D) Sends an alert to the cluster administrator and quarantines the affected node
Show Answer
Correct Answer: B) Reports the violation with PASS/FAIL/WARN/INFO status — remediation is a separate step
kube-bench is a reporting tool, not a remediation tool. It checks node configuration against the CIS Kubernetes Benchmark and produces a report. Fixing identified issues requires separate manual or automated action.
- A) Automatically remediates the violation and re-checks — Incorrect. kube-bench does NOT perform any remediation. It only identifies issues.
- B) Reports the violation with PASS/FAIL/WARN/INFO status — remediation is a separate step — Correct. kube-bench produces a detailed report categorizing each check as PASS, FAIL, WARN, or INFO. Remediation must be done separately.
- C) Blocks the non-compliant resource from being deployed — Incorrect. This describes an admission controller (like OPA/Gatekeeper), not kube-bench. kube-bench checks node configuration, not resource admission.
- D) Sends an alert to the cluster administrator and quarantines the affected node — Incorrect. kube-bench does not send alerts or quarantine nodes. It simply produces a report.
Domain: Compliance and Security Frameworks — CIS Kubernetes Benchmark
Q3: Which NIST publication specifically addresses container and orchestrator security?
A) NIST SP 800-53
B) NIST Cybersecurity Framework
C) NIST SP 800-190
D) NIST SP 800-171
Show Answer
Correct Answer: C) NIST SP 800-190
NIST SP 800-190 is the “Application Container Security Guide” — it specifically addresses security concerns and recommendations for images, registries, orchestrators, containers, and host operating systems.
- A) NIST SP 800-53 — Incorrect. SP 800-53 is a comprehensive security and privacy control catalog for federal information systems. It is broad and not container-specific.
- B) NIST Cybersecurity Framework — Incorrect. The CSF is a high-level, risk-based framework organized around Identify, Protect, Detect, Respond, and Recover. It is not container-specific.
- C) NIST SP 800-190 — Correct. This publication directly addresses the five areas of container security: images, registries, orchestrators, containers, and host OS.
- D) NIST SP 800-171 — Incorrect. SP 800-171 covers protecting Controlled Unclassified Information (CUI) in non-federal systems. It is not container-specific.
Domain: Compliance and Security Frameworks — NIST & Industry Standards
Q4: Which tool performs penetration testing on a Kubernetes cluster by simulating an attacker’s perspective?
A) kube-bench
B) kubesec
C) kube-hunter
D) Polaris
Show Answer
Correct Answer: C) kube-hunter
kube-hunter is a penetration testing tool developed by Aqua Security that actively probes a Kubernetes cluster for exploitable vulnerabilities from a network perspective — simulating what an attacker would see.
- A) kube-bench — Incorrect. kube-bench checks node configuration against CIS Benchmarks. It reads configuration files and process flags — it does not simulate attacks.
- B) kubesec — Incorrect. kubesec performs static risk analysis on Kubernetes YAML manifests. It scores manifest security risk without interacting with a live cluster.
- C) kube-hunter — Correct. kube-hunter can run in remote, internal, or network mode to discover security weaknesses from an attacker’s perspective, including API server exposure, information disclosure, and known CVEs.
- D) Polaris — Incorrect. Polaris validates Kubernetes resources against best practices (security, reliability, efficiency). It is a best practices checker, not a penetration tester.
Domain: Compliance and Security Frameworks — Kubernetes Security Audit
Q5: An organization wants to ensure that every Kubernetes manifest deployed to production meets its security policies. Which approach is most effective?
A) Schedule quarterly manual reviews of all deployed manifests
B) Use Policy-as-Code with admission controllers to enforce policies at deployment time
C) Send an email to the security team for approval before each deployment
D) Run kube-bench after each deployment to check compliance
Show Answer
Correct Answer: B) Use Policy-as-Code with admission controllers to enforce policies at deployment time
Policy-as-Code with admission controllers (OPA/Gatekeeper, Kyverno) automatically evaluates every resource against defined policies at admission time. Non-compliant resources are rejected before they enter the cluster, providing continuous, automated enforcement.
- A) Schedule quarterly manual reviews of all deployed manifests — Incorrect. Quarterly reviews create a 3-month window where non-compliant resources can exist in the cluster undetected. This does not scale.
- B) Use Policy-as-Code with admission controllers to enforce policies at deployment time — Correct. This ensures every resource is checked against policies automatically, in real-time, with no manual intervention needed.
- C) Send an email to the security team for approval before each deployment — Incorrect. Manual email-based approval does not scale, introduces delay, and is prone to human error.
- D) Run kube-bench after each deployment to check compliance — Incorrect. kube-bench checks cluster node configuration against CIS Benchmarks, not individual manifest compliance. It also only detects issues after deployment, rather than preventing them.
Domain: Compliance and Security Frameworks — Compliance Automation
Q6: What distinguishes Kyverno from OPA/Gatekeeper as a policy engine?
A) Kyverno uses Rego while Gatekeeper uses YAML for policies
B) Kyverno can only validate resources while Gatekeeper can also mutate them
C) Kyverno policies are written in YAML (Kubernetes-native) while Gatekeeper uses Rego
D) Kyverno does not support audit mode for existing resources
Show Answer
Correct Answer: C) Kyverno policies are written in YAML (Kubernetes-native) while Gatekeeper uses Rego
The key differentiator is the policy language. Kyverno uses YAML, which is the same language Kubernetes administrators already know. OPA/Gatekeeper uses Rego, a dedicated query language that requires learning a new syntax.
- A) Kyverno uses Rego while Gatekeeper uses YAML for policies — Incorrect. This is reversed. Gatekeeper uses Rego; Kyverno uses YAML.
- B) Kyverno can only validate resources while Gatekeeper can also mutate them — Incorrect. Kyverno supports validate, mutate, AND generate actions. Both tools support mutation.
- C) Kyverno policies are written in YAML (Kubernetes-native) while Gatekeeper uses Rego — Correct. This is the primary distinction. Kyverno’s YAML-based approach lowers the learning curve for teams already familiar with Kubernetes manifests.
- D) Kyverno does not support audit mode for existing resources — Incorrect. Kyverno does support background scanning of existing resources and produces PolicyReport resources for compliance visibility.
Domain: Compliance and Security Frameworks — Compliance Automation
Q7: Under GDPR, what is the maximum time allowed for notifying the supervisory authority after discovering a personal data breach?
A) 24 hours
B) 48 hours
C) 72 hours
D) 7 days
Show Answer
Correct Answer: C) 72 hours
GDPR Article 33 requires that data controllers notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms.
- A) 24 hours — Incorrect. While some national regulations may have 24-hour requirements, GDPR specifies 72 hours.
- B) 48 hours — Incorrect. 48 hours is not the GDPR requirement.
- C) 72 hours — Correct. GDPR Article 33 states: “not later than 72 hours after having become aware of it.” This makes timely detection through tools like Falco and centralized alerting critical.
- D) 7 days — Incorrect. 7 days is too long for GDPR. The regulation requires notification within 72 hours.
Domain: Compliance and Security Frameworks — Regulatory & Data Protection
Q8: Which PCI DSS requirement is most directly addressed by Kubernetes Network Policies?
A) Requirement 3 — Protect stored account data
B) Requirement 1 — Install and maintain network security controls
C) Requirement 8 — Identify users and authenticate access
D) Requirement 10 — Log and monitor all access
Show Answer
Correct Answer: B) Requirement 1 — Install and maintain network security controls
PCI DSS Requirement 1 focuses on network security controls including firewalls and network segmentation. Kubernetes Network Policies provide namespace-level and pod-level network segmentation, which directly maps to this requirement.
- A) Requirement 3 — Protect stored account data — Incorrect. Requirement 3 is about encrypting stored cardholder data. This maps to encryption at rest (etcd encryption, encrypted PVs), not Network Policies.
- B) Requirement 1 — Install and maintain network security controls — Correct. Network Policies implement network segmentation within the cluster, controlling which pods can communicate with each other — a core network security control.
- C) Requirement 8 — Identify users and authenticate access — Incorrect. Requirement 8 is about authentication and identity management. This maps to OIDC, X.509 certificates, and RBAC.
- D) Requirement 10 — Log and monitor all access — Incorrect. Requirement 10 is about audit logging. This maps to Kubernetes API audit logging and centralized log management.
Domain: Compliance and Security Frameworks — Regulatory & Data Protection
Q9: Which SOC 2 Trust Service Criterion is most concerned with whether a system is operational and usable as committed?
A) Security
B) Availability
C) Processing Integrity
D) Confidentiality
Show Answer
Correct Answer: B) Availability
The Availability Trust Service Criterion evaluates whether the system is operational and accessible as committed or agreed upon. In Kubernetes, this maps to high availability configuration, resource management, monitoring, and disaster recovery.
- A) Security — Incorrect. Security focuses on protecting the system against unauthorized access. While important for availability, it is a distinct criterion.
- B) Availability — Correct. Availability specifically addresses whether the system is operational and usable. Kubernetes controls include replica counts, resource limits, health checks, pod disruption budgets, and multi-zone deployments.
- C) Processing Integrity — Incorrect. Processing Integrity focuses on whether system processing is complete, valid, accurate, and timely. This maps to admission controllers and validation webhooks.
- D) Confidentiality — Incorrect. Confidentiality focuses on protecting confidential information. This maps to encryption and access control.
Domain: Compliance and Security Frameworks — NIST & Industry Standards
Q10: In the CIS Kubernetes Benchmark, what is the difference between “Scored” and “Not Scored” recommendations?
A) Scored recommendations are mandatory; Not Scored recommendations are optional
B) Scored recommendations can be objectively verified through automated checks; Not Scored recommendations require manual review
C) Scored recommendations apply to production clusters; Not Scored recommendations apply only to development clusters
D) Scored recommendations are Level 1; Not Scored recommendations are Level 2
Show Answer
Correct Answer: B) Scored recommendations can be objectively verified through automated checks; Not Scored recommendations require manual review
The distinction is about verifiability, not importance. Scored recommendations have clear, automatable pass/fail criteria (e.g., “Is --anonymous-auth set to false?”). Not Scored recommendations require human judgment and context to evaluate.
- A) Scored recommendations are mandatory; Not Scored recommendations are optional — Incorrect. Both types are important recommendations. Not Scored does not mean optional or unimportant.
- B) Scored recommendations can be objectively verified through automated checks; Not Scored recommendations require manual review — Correct. Tools like kube-bench can automatically verify Scored recommendations. Not Scored recommendations appear as WARN because they require human interpretation.
- C) Scored recommendations apply to production clusters; Not Scored recommendations apply only to development clusters — Incorrect. Both types apply to all clusters. The distinction is about verifiability, not environment.
- D) Scored recommendations are Level 1; Not Scored recommendations are Level 2 — Incorrect. Both Level 1 and Level 2 profiles contain Scored and Not Scored recommendations. These are orthogonal categories.
Domain: Compliance and Security Frameworks — CIS Kubernetes Benchmark
Q11: Which of the following is a key benefit of using GitOps for compliance?
A) GitOps eliminates the need for any admission controllers
B) Git provides an immutable audit trail of all changes, including who changed what and when
C) GitOps automatically encrypts all Secrets stored in etcd
D) Git repositories are inherently PCI DSS compliant
Show Answer
Correct Answer: B) Git provides an immutable audit trail of all changes, including who changed what and when
GitOps uses Git as the single source of truth for infrastructure and application configuration. The Git commit history provides a complete, immutable record of every change — who made it, when, why (commit message), and who approved it (pull request review). This naturally satisfies audit trail requirements.
- A) GitOps eliminates the need for any admission controllers — Incorrect. GitOps and admission controllers are complementary. GitOps ensures the desired state is in Git; admission controllers enforce policies at the cluster level. Both are needed for defense-in-depth.
- B) Git provides an immutable audit trail of all changes, including who changed what and when — Correct. Git’s commit history, pull request reviews, and branch protection rules provide comprehensive audit evidence that auditors can verify.
- C) GitOps automatically encrypts all Secrets stored in etcd — Incorrect. GitOps does not handle etcd encryption. That requires EncryptionConfiguration on the API server. GitOps also requires additional tooling (like Sealed Secrets or SOPS) to handle secrets in Git.
- D) Git repositories are inherently PCI DSS compliant — Incorrect. Using Git does not make you PCI DSS compliant. PCI DSS compliance requires meeting all 12 requirements across the entire cardholder data environment.
Domain: Compliance and Security Frameworks — Compliance Automation
Q12: In a managed Kubernetes environment (e.g., EKS, GKE, AKS), which CIS Benchmark sections are primarily the cloud provider’s responsibility?
A) Section 4 (Worker Nodes) and Section 5 (Policies)
B) Section 1 (Control Plane Components) and Section 2 (etcd)
C) Section 3 (Control Plane Configuration) and Section 5 (Policies)
D) All sections are the customer’s responsibility
Show Answer
Correct Answer: B) Section 1 (Control Plane Components) and Section 2 (etcd)
In managed Kubernetes, the cloud provider manages the control plane (API server, controller manager, scheduler) and etcd. Customers cannot directly configure API server flags or etcd settings. The provider is responsible for hardening these components.
- A) Section 4 (Worker Nodes) and Section 5 (Policies) — Incorrect. Worker nodes and policies are the customer’s responsibility in managed Kubernetes. You manage node images, kubelet configuration, RBAC, and Network Policies.
- B) Section 1 (Control Plane Components) and Section 2 (etcd) — Correct. The cloud provider manages the control plane and etcd in managed Kubernetes. You cannot access or modify API server flags or etcd configuration directly.
- C) Section 3 (Control Plane Configuration) and Section 5 (Policies) — Incorrect. Section 3 (authentication/authorization configuration) is a shared responsibility — the provider manages some backends, but you configure RBAC. Section 5 is fully your responsibility.
- D) All sections are the customer’s responsibility — Incorrect. This is only true for self-managed Kubernetes. In managed Kubernetes, the shared responsibility model applies.
Domain: Compliance and Security Frameworks — CIS Kubernetes Benchmark
Self-Assessment Scoring Guide
Count your correct answers and use the table below to evaluate your readiness for the Compliance and Security Frameworks domain.
| Score | Rating | Recommendation |
|---|---|---|
| 11-12 | Excellent | You have a strong grasp of compliance and security frameworks. Review any missed questions and move on. |
| 9-10 | Good | You understand most concepts well. Review the specific topics where you missed questions. |
| 7-8 | Fair | You have a reasonable foundation but need more study. Re-read the sections for topics you missed. |
| 4-6 | Needs Improvement | Review the entire chapter, paying special attention to: CIS Benchmark structure, tool purposes, and regulation requirements. |
| 0-3 | Significant Review Needed | Start from the beginning of this chapter. Focus on understanding each framework’s purpose before memorizing details. |
Topic Coverage Map
| Question | Topic | Key Concept |
|---|---|---|
| Q1 | CIS Benchmark | Benchmark section structure |
| Q2 | CIS Benchmark / kube-bench | kube-bench is reporting-only, not remediation |
| Q3 | NIST Standards | NIST SP 800-190 = container security guide |
| Q4 | Security Audit Tools | kube-hunter = penetration testing |
| Q5 | Compliance Automation | Policy-as-Code with admission controllers |
| Q6 | Policy Engines | Kyverno (YAML) vs Gatekeeper (Rego) |
| Q7 | GDPR | 72-hour breach notification requirement |
| Q8 | PCI DSS | Network Policies → Requirement 1 (network security) |
| Q9 | SOC 2 | Availability Trust Service Criterion |
| Q10 | CIS Benchmark | Scored vs Not Scored = verifiability |
| Q11 | Compliance Automation | GitOps = immutable audit trail |
| Q12 | CIS Benchmark / Managed K8s | Provider handles Sections 1-2; customer handles Sections 4-5 |
Return to: Compliance & Security Frameworks — Overview
