Exam KCSA Topic 3 Question 28 Discussion

Actual exam question for Linux Foundation's KCSA exam
Question #: 28
Topic #: 3

An attacker has access to the network segment that the cluster is on.
What happens when a compromised Pod attempts to connect to the API server?

A. The compromised Pod is automatically isolated from the network to prevent any connections to the API server. B. The compromised Pod is allowed to connect to the API server without any restrictions. C. The compromised Pod attempts to connect to the API server, but its requests may be blocked due to network policies. D. The compromised Pod connects to the API server and is granted elevated privileges by default.

Suggested Answer: C Vote an answer

* By default,Pods can connect to the API server(since ServiceAccount tokens are mounted).
* However, whether they succeed in acting depends on:
* Network Policies(may block egress).
* RBAC(controls permissions).
* Exact extract (Kubernetes Docs - API Access):
* "Pods authenticate to the API server using the service account token mounted into the Pod.
Authorization is then enforced by RBAC. NetworkPolicies may further restrict access."
* Clarifications:
* A: No default automatic isolation.
* B: Not always unrestricted; policies may apply.
* D: Pods get minimal default privileges, not automatic elevation.
References:
Kubernetes Docs - API Access to Pods: https://kubernetes.io/docs/concepts/security/service-accounts/ Kubernetes Docs - Network Policies: https://kubernetes.io/docs/concepts/services-networking/network- policies/

by Henry at Aug 18, 2026, 11:04 AM

Limited Time Offer

15%

Off

Get Premium KCSA Questions as Interactive Self Test Engine or PDF

Comments

0 Satisfied Customers

0 Shares

0 Demo Downloads

10 Years in Business