KCSAテスト問題練習試そう！2026年に更新された62問あります [Q27-Q50]

KCSAテスト問題練習試そう！2026年に更新された62問あります

更新された2026年03月プレミアムKCSA試験エンジンPDFで今すぐダウンロード！無料更新された62問あります

質問 # 27
What is the reasoning behind considering the Cloud as the trusted computing base of a Kubernetes cluster?

• A. A vulnerability in the Cloud layer has a negligible impact on containers due to Linux isolation mechanisms.
• B. A Kubernetes cluster can only be trusted if the underlying Cloud provider is certified against international standards.
• C. The Cloud enforces security controls at the Kubernetes cluster level, so application developers can focus on applications only.
• D. A Kubernetes cluster can only be as secure as the security posture of its Cloud hosting.

正解：D

解説：
* The4C's of Cloud Native Security(Cloud, Cluster, Container, Code) model starts withCloudas the base layer.
* If the Cloud (infrastructure layer) is compromised, every higher layer (Cluster, Container, Code) inherits that compromise.
* Exact extract (Kubernetes Security Overview):
* "The 4C's of Cloud Native security are Cloud, Clusters, Containers, and Code. You can think of the 4C's as a layered approach. A Kubernetes cluster can only be as secure as the cloud infrastructure it is deployed on."
* This means the cloud is part of thetrusted computing baseof a Kubernetes cluster.
References:
Kubernetes Docs - Security Overview (4C's): https://kubernetes.io/docs/concepts/security/overview/#the-
4cs-of-cloud-native-security

質問 # 28
By default, in a Kubeadm cluster, which authentication methods are enabled?

• A. X509 Client Certs, Webhook Authentication, and Service Account Tokens
• B. OIDC, Bootstrap tokens, and Service Account Tokens
• C. X509 Client Certs, Bootstrap Tokens, and Service Account Tokens
• D. X509 Client Certs, OIDC, and Service Account Tokens

正解：C

解説：
* In akubeadm cluster, by default the API server enables several authentication mechanisms:
* X509 Client Certs: Used for authenticating kubelets, admins, and control-plane components.
* Bootstrap Tokens: Temporary credentials used for node bootstrap/joining clusters.
* Service Account Tokens: Used by workloads in pods to authenticate with the API server.
* Exact extract (Kubernetes Docs - Authentication):
* "Kubernetes uses client certificates, bearer tokens, an authenticating proxy, or HTTP basic auth to authenticate API requests."
* "Bootstrap tokens are a simple bearer token that is meant to be used when creating new clusters or joining new nodes to an existing cluster."
* "Service accounts are special accounts that provide an identity for processes that run in a Pod." References:
Kubernetes Docs - Authentication: https://kubernetes.io/docs/reference/access-authn-authz/authentication/ Kubeadm - TLS Bootstrapping: https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/

質問 # 29
What is Grafana?

• A. A platform for monitoring and visualizing time-series data.
• B. A cloud-native security tool for scanning and detecting vulnerabilities in Kubernetes clusters.
• C. A cloud-native distributed tracing system for monitoring microservices architectures.
• D. A container orchestration platform for managing and scaling applications.

正解：A

解説：
* Grafana:An open-source analytics and visualization platform widely used with Prometheus, Loki, etc.
* Exact extract (Grafana Docs):"Grafana is the open-source analytics and monitoring solution for every database. It allows you to query, visualize, alert on, and understand your metrics no matter where they are stored."
* A is wrong:That describesJaeger(distributed tracing).
* B is wrong:That'sKubernetesitself.
* D is wrong:That'sTrivy/Aqua/Prismatype tools.
References:
Grafana Docs: https://grafana.com/docs/grafana/latest/

質問 # 30
Which of the following is a control for Supply Chain Risk Management according to NIST 800-53 Rev. 5?

• A. Incident Response
• B. Supply Chain Risk Management Plan
• C. System and Communications Protection
• D. Access Control

正解：B

解説：
* NIST SP 800-53 Rev. 5 introduces a dedicated family of controls calledSupply Chain Risk Management (SR).
* Within SR,SR-2 (Supply Chain Risk Management Plan)is a specific control.
* Exact extract from NIST 800-53 Rev. 5:
* "The organization develops and implements a supply chain risk management plan for the system, system component, or system service."
* While Access Control, System and Communications Protection, and Incident Response are control families, the correctsupply chain-specific controlis theSupply Chain Risk Management Plan (SR-2).
References:
NIST SP 800-53 Rev. 5 -Security and Privacy Controls for Information Systems and Organizations:
https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final

質問 # 31
What information is stored in etcd?

• A. Pod data contained in Persistent Volume Claims (e.g. hostPath).
• B. Sensitive user data such as usernames and passwords.
• C. Etcd manages the configuration data, state data, and metadata for Kubernetes.
• D. Application logs and monitoring data for auditing and troubleshooting purposes.

正解：C

解説：
* etcdis Kubernetes'key-value storeforcluster state.
* Stores: ConfigMaps, Secrets, Pod definitions, Deployments, RBAC policies, and metadata.
* Exact extract (Kubernetes Docs - etcd):
* "etcd is a consistent and highly-available key-value store used as Kubernetes' backing store for all cluster data."
* Clarifications:
* B: Logs/metrics are handled by logging/monitoring solutions, not etcd.
* C: Secrets may be stored here but encoded in base64, not specifically "usernames/passwords" as primary use.
* D: Persistent Volumes are external storage, not stored in etcd.
References:
Kubernetes Docs - etcd: https://kubernetes.io/docs/concepts/overview/components/#etcd

質問 # 32
A container image istrojanizedby an attacker by compromising the build server. Based on the STRIDE threat modeling framework, which threat category best defines this threat?

• A. Denial of Service
• B. Repudiation
• C. Tampering
• D. Spoofing

正解：C

解説：
* In STRIDE,Tamperingis the threat category forunauthorized modification of data or code/artifacts. A trojanized container image is, by definition, an attacker'smodificationof the build output (the image) after compromising the CI/build system-i.e., tampering with the artifact in the software supply chain.
* Why not the others?
* Spoofingis about identity/authentication (e.g., pretending to be someone/something).
* Repudiationis about denying having performed an action without sufficient audit evidence.
* Denial of Servicetargets availability (exhausting resources or making a service unavailable).The scenario explicitly focuses on analtered imageresulting from a compromised build server-this squarely maps toTampering.
Authoritative references (for verification and deeper reading):
* Kubernetes (official docs)- Supply Chain Security (discusses risks such as compromised CI/CD pipelines leading to modified/poisoned images and emphasizes verifying image integrity/signatures).
* Kubernetes Docs#Security#Supply chain securityandSecuring a cluster(sections on image provenance, signing, and verifying artifacts).
* CNCF TAG Security - Cloud Native Security Whitepaper (v2)- Threat modeling in cloud-native and software supply chain risks; describes attackers modifying build outputs (images/artifacts) via CI
/CD compromise as a form oftamperingand prescribes controls (signing, provenance, policy).
* CNCF TAG Security - Software Supply Chain Security Best Practices- Explicitly covers CI/CD compromise leading tomaliciously modified imagesand recommends SLSA, provenance attestation, and signature verification (policy enforcement via admission controls).
* Microsoft STRIDE (canonical reference)- DefinesTamperingasmodifying data or code, which directly fits a trojanized image produced by a compromised build system.

質問 # 33
What is the purpose of an egress NetworkPolicy?

• A. To control the incoming network traffic to a Kubernetes cluster.
• B. To control the outbound network traffic from a Kubernetes cluster.
• C. To control the outgoing network traffic from one or more Kubernetes Pods.
• D. To secure the Kubernetes cluster against unauthorized access.

正解：C

解説：
* NetworkPolicycontrols network trafficat the Pod level.
* Ingress rules:controlincomingconnections to Pods.
* Egress rules:controloutgoingconnectionsfrom Pods.
* Exact extract (Kubernetes Docs - Network Policies):
* "An egress rule controls outgoing connections from Pods that match the policy."
* Clarifying wrong answers:
* A/B: Too broad (cluster-level); policies apply per Pod/Namespace.
* C: Security against unauthorized access is broader than egress policies.
References:
Kubernetes Docs - Network Policies: https://kubernetes.io/docs/concepts/services-networking/network- policies/

質問 # 34
A cluster is failing to pull more recent versions of images from k8s.gcr.io. Why may this be?

• A. The authentication credentials for accessing k8s.gcr.io are incorrectly scoped.
• B. There is a bug in the container runtime or the image pull process.
• C. There is a network connectivity issue between the cluster and k8s.gcr.io.
• D. The container image registry k8s.gcr.io has been deprecated.

正解：D

解説：
* k8s.gcr.iowas the historic Kubernetes image registry.
* It has beendeprecatedand replaced withregistry.k8s.io.
* Exact extract (Kubernetes Blog):
* "The k8s.gcr.io image registry will be frozen from April 3, 2023 and fully deprecated. All Kubernetes project images are now served from registry.k8s.io."
* Pulling newer versions from k8s.gcr.io fails because the registry no longer receives updates.
References:
Kubernetes Blog - Image Registry Update: https://kubernetes.io/blog/2023/02/06/k8s-gcr-io-freeze- announcement/

質問 # 35
On a client machine, what directory (by default) contains sensitive credential information?

• A. $HOME/.config/kubernetes/
• B. /opt/kubernetes/secrets/
• C. $HOME/.kube
• D. /etc/kubernetes/

正解：C

解説：
* Thekubectlclient uses configuration from$HOME/.kube/configby default.
* This file contains: cluster API server endpoint, user certificates, tokens, or kubeconfigs #sensitive credentials.
* Exact extract (Kubernetes Docs - Configure Access to Clusters):
* "By default, kubectl looks for a file named config in the $HOME/.kube directory. This file contains configuration information including user credentials."
* Other options clarified:
* A: /etc/kubernetes/ exists on nodes (control plane) not client machines.
* C: /opt/kubernetes/secrets/ is not a standard path.
* D: $HOME/.config/kubernetes/ is not where kubeconfig is stored by default.
References:
Kubernetes Docs - Configure Access to Clusters: https://kubernetes.io/docs/concepts/configuration/organize- cluster-access-kubeconfig/

質問 # 36
In the event that kube-proxy is in a CrashLoopBackOff state, what impact does it have on the Pods running on the same worker node?

• A. The Pod's resource utilization increases significantly.
• B. The Pod's security context restrictions cannot be enforced.
• C. The Pods cannot communicate with other Pods in the cluster.
• D. The Pod cannot mount persistent volumes through CSI drivers.

正解：C

解説：
* kube-proxy:manages cluster network routing rules (via iptables or IPVS). It enables Pods to communicate with Services and Pods across nodes.
* If kube-proxy fails (CrashLoopBackOff), service IP routing and cluster-wide pod-to-pod networking breaks. Local Pod-to-Pod communication within the same node may still work, butcross-node communication fails.
* Exact extract (Kubernetes Docs - kube-proxy):
* "kube-proxy maintains network rules on nodes. These rules allow network communication to Pods from network sessions inside or outside of the cluster." References:
Kubernetes Docs - kube-proxy: https://kubernetes.io/docs/reference/command-line-tools-reference/kube- proxy/

質問 # 37
Which technology can be used to apply security policy for internal cluster traffic at the application layer of the network?

• A. Ingress Controller
• B. Service Mesh
• C. Container Runtime
• D. Network Policy

正解：B

解説：
* Service Mesh (e.g., Istio, Linkerd, Consul):operates atLayer 7 (application layer), enforcing policies like mTLS, authorization, and routing between services.
* NetworkPolicy:works atLayer 3/4 (IP/port), not Layer 7.
* Ingress Controller:handles external traffic ingress, not internal service-to-service traffic.
* Container Runtime:responsible for running containers, not enforcing application-layer security.
Exact extract (Istio docs):
* "Istio provides security by enforcing authentication, authorization, and encryption of service-to- service communication." References:
Kubernetes Docs - Network Policies: https://kubernetes.io/docs/concepts/services-networking/network- policies/ Istio Security Docs: https://istio.io/latest/docs/concepts/security/

質問 # 38
In a Kubernetes cluster, what are the security risks associated with using ConfigMaps for storing secrets?

• A. ConfigMaps store sensitive information in etcd encoded in base64 format automatically, which does not ensure confidentiality of data.
• B. Storing secrets in ConfigMaps does not allow for fine-grained access control via RBAC.
• C. Storing secrets in ConfigMaps can expose sensitive information as they are stored in plaintext and can be accessed by unauthorized users.
• D. Using ConfigMaps for storing secrets might make applications incompatible with the Kubernetes cluster.

正解：C

解説：
* ConfigMaps are explicitly not for confidential data.
* Exact extract (ConfigMap concept):"A ConfigMap is an API object used to store non- confidential data in key-value pairs."
* Exact extract (ConfigMap concept):"ConfigMaps are not intended to hold confidential data. Use a Secret for confidential data."
* Why this is risky:data placed into a ConfigMap is stored as regular (plaintext) string values in the API and etcd (unless you deliberately use binaryData for base64 content you supply). That means if someone has read access to the namespace or to etcd/APIServer storage, they can view the values.
* Secrets vs ConfigMaps (to clarify distractor D):
* Exact extract (Secret concept):"By default, secret data is stored as unencrypted base64- encoded strings.You canenable encryption at restto protect Secrets stored in etcd."
* This base64 behavior applies toSecrets, not to ConfigMap data. Thus optionDis incorrect for ConfigMaps.
* About RBAC (to clarify distractor A):Kubernetesdoessupport fine-grained RBAC forboth ConfigMaps and Secrets; the issue isn't lack of RBAC but that ConfigMaps arenotdesigned for confidential material.
* About compatibility (to clarify distractor C):Using ConfigMaps for secrets doesn't make apps
"incompatible"; it's simplyinsecureand against guidance.
References:
Kubernetes Docs -ConfigMaps: https://kubernetes.io/docs/concepts/configuration/configmap/ Kubernetes Docs -Secrets: https://kubernetes.io/docs/concepts/configuration/secret/ Kubernetes Docs -Encrypting Secret Data at Rest: https://kubernetes.io/docs/tasks/administer-cluster
/encrypt-data/
Note: The citations above are from the official Kubernetes documentation and reflect the stated guidance that ConfigMaps are fornon-confidentialdata, while Secrets (with encryption at rest enabled) are forconfidential data, and that the 4C's map todefense in depth.

質問 # 39
Which of the following statements correctly describes a container breakout?

• A. A container breakout is the process of escaping a container when it reaches its resource limits.
• B. A container breakout is the process of escaping the container and gaining access to the Pod's network traffic.
• C. A container breakout is the process of escaping the container and gaining access to the cloud provider's infrastructure.
• D. A container breakout is the process of escaping the container and gaining access to the host operating system.

正解：D

解説：
* Container breakoutrefers to an attacker escaping container isolation and reaching thehost OS.
* Once the host is compromised, the attacker can accessother containers, Kubernetes nodes, or escalate further.
* Exact extract (Kubernetes Security Docs):
* "If an attacker gains access to a container, they may attempt a container breakout to gain access to the host system."
* Other options clarified:
* A: Network access inside a Pod # breakout.
* B: Resource exhaustion is aDoS, not a breakout.
* C: Cloud infrastructure compromise is possibleafterhost compromise, but not the definition of breakout.
References:
Kubernetes Security Concepts: https://kubernetes.io/docs/concepts/security/ CNCF Security Whitepaper (Threats section):https://github.com/cncf/tag-security

質問 # 40
A cluster administrator wants to enforce the use of a different container runtime depending on the application a workload belongs to.

• A. By manually modifying the container runtime for each workload after it has been created.
• B. By configuring amutating admission controllerwebhook that intercepts new workload creation requests and modifies the container runtime based on the application label.
• C. By configuring avalidating admission controllerwebhook that verifies the container runtime based on the application label and rejects requests that do not comply.
• D. By modifying the kube-apiserver configuration file to specify the desired container runtime for each application.

正解：B

解説：
* Kubernetes supports workload-specific runtimes viaRuntimeClass.
* Amutating admission controllercan enforce this automatically by:
* Intercepting workload creation requests.
* Modifying the Pod spec to set runtimeClassName based on labels or policies.
* Incorrect options:
* (A) Manual modification is not scalable or secure.
* (B) kube-apiserver cannot enforce per-application runtime policies.
* (C) A validating webhook can onlyreject, not modify, the runtime.
References:
Kubernetes Documentation - RuntimeClass
CNCF Security Whitepaper - Admission controllers for enforcing runtime policies.

質問 # 41
What mechanism can I use to block unsigned images from running in my cluster?

• A. Configuring Container Runtime Interface (CRI) to enforce image signing and validation.
• B. Using PodSecurityPolicy (PSP) to enforce image signing and validation.
• C. Using Pod Security Standards (PSS) to enforce validation of signatures.
• D. Enabling Admission Controllers to validate image signatures.

正解：D

解説：
* KubernetesAdmission Controllers(particularlyValidatingAdmissionWebhooks) can be used to enforce policies that validate image signatures.
* This is commonly implemented withtools like Sigstore/cosign, Kyverno, or OPA Gatekeeper.
* PodSecurityPolicy (PSP):deprecated and never supported image signature validation.
* Pod Security Standards (PSS):only apply to pod security fields (privilege, users, host access), not image signatures.
* CRI:while runtimes (containerd, CRI-O) may integrate with signature verification tools, enforcement in Kubernetes is generally done viaAdmission Controllersat the API layer.
Exact extract (Admission Controllers docs):
* "Admission webhooks can be used to enforce custom policies on the objects being admitted." (e.g., validating signatures).
References:
Kubernetes Docs - Admission Controllers: https://kubernetes.io/docs/reference/access-authn-authz
/admission-controllers/
Sigstore Project (cosign): https://sigstore.dev/
Kyverno ImageVerify Policy: https://kyverno.io/policies/pod-security/require-image-verification/

質問 # 42
Which of the following statements is true concerning the use ofmicroVMsover user-space kernel implementations for advanced container sandboxing?

• A. MicroVMs offer higher isolation than user-space kernel implementations at the cost of a higher per- instance memory footprint.
• B. MicroVMs provide reduced application compatibility and higher per-system call overhead than user- space kernel implementations.
• C. MicroVMs offer lower isolation and security compared to user-space kernel implementations.
• D. MicroVMs allow for easier container management and orchestration than user-space kernel implementation.

正解：A

解説：
* MicroVM-based runtimes(e.g., Firecracker, Kata Containers) use lightweight VMs to provide strong isolation between workloads.
* Compared touser-space kernel implementations(e.g., gVisor), microVMs generally:
* Offerhigher isolation and security(due to VM-level separation).
* Come with ahigher memory and resource overhead per instancethan user-space approaches.
* Incorrect options:
* (A) Orchestration is handled by Kubernetes, not inherently easier with microVMs.
* (C) Compatibility is typically better with microVMs, not worse.
* (D) Isolation is stronger, not weaker.
References:
CNCF Security Whitepaper - Workload isolation: microVMs vs. user-space kernel sandboxes.
Kata Containers Project - isolation trade-offs.

質問 # 43
A user runs a command with kubectl to apply a change to a deployment. What is the first Kubernetes component that the request reaches?

• A. kubelet
• B. Kubernetes Controller Manager
• C. Kubernetes Scheduler
• D. Kubernetes API Server

正解：D

解説：
* Allkubectl requestsgo to theKubernetes API Server.
* The API server is thefront-end of the control planeand validates/authenticates requests before other components act.
* Exact extract (Kubernetes Docs - Components):
* "The API server is a component of the Kubernetes control plane that exposes the Kubernetes API. It is the front end for the Kubernetes control plane."
* Other options clarified:
* Controller Manager: reconciles state after API Server processes the request.
* Scheduler: assigns Pods to nodes after API Server accepts workload objects.
* kubelet: node agent, only communicates after API Server updates desired state.
References:
Kubernetes Docs - Components: https://kubernetes.io/docs/concepts/overview/components/

質問 # 44
Which other controllers are part of the kube-controller-manager inside the Kubernetes cluster?

• A. Pod, Service, and Ingress controller
• B. Job controller, CronJob controller, and DaemonSet controller
• C. Replication controller, Endpoints controller, Namespace controller, and ServiceAccounts controller
• D. Namespace controller, ConfigMap controller, and Secret controller

正解：C

解説：
* kube-controller-managerruns a set of controllers that regulate the cluster's state.
* Exact extract (Kubernetes Docs):"The kube-controller-manager runs controllers that are core to Kubernetes. Examples of controllers are: Node controller, Replication controller, Endpoints controller, Namespace controller, and ServiceAccounts controller."
* Why D is correct:All listed are actual controllers within kube-controller-manager.
* Why others are wrong:
* A:Job and CronJob controllers are managed by kube-controller-manager, but DaemonSet controller is managed by the kube-scheduler/deployment logic.
* B:Pod, Service, Ingress controllers are not part of kube-controller-manager.
* C:ConfigMap and Secret do not have dedicated controllers.
References:
Kubernetes Docs - kube-controller-manager: https://kubernetes.io/docs/reference/command-line-tools- reference/kube-controller-manager/

質問 # 45
A container running in a Kubernetes cluster has permission to modify host processes on the underlying node.
What combination of privileges and capabilities is most likely to have led to this privilege escalation?

• A. There is no combination of privileges and capabilities that permits this.
• B. hostPath and AUDIT_WRITE
• C. hostNetwork and NET_RAW
• D. hostPID and SYS_PTRACE

正解：D

解説：
* hostPID:When enabled, the container shares the host's process namespace # container can see and potentially interact with host processes.
* SYS_PTRACE capability:Grants the container the ability to trace, inspect, and modify other processes (e.g., via ptrace).
* Combination of hostPID + SYS_PTRACE allows a container toattach to and modify host processes, which is a direct privilege escalation.
* Other options explained:
* hostPath + AUDIT_WRITE:hostPath exposes filesystem paths but does not inherently allow process modification.
* hostNetwork + NET_RAW:grants raw socket access but only for networking, not host process modification.
* A:Incorrect - such combinationsdo exist(like B).
References:
Kubernetes Docs - Configure a Pod to use hostPID: https://kubernetes.io/docs/tasks/configure-pod-container
/share-process-namespace/
Linux Capabilities man page: https://man7.org/linux/man-pages/man7/capabilities.7.html

質問 # 46
What kind of organization would need to be compliant with PCI DSS?

• A. Government agencies that collect personally identifiable information.
• B. Retail stores that only accept cash payments.
• C. Merchants that process credit card payments.
• D. Non-profit organizations that handle sensitive customer data.

正解：C

解説：
* PCI DSS (Payment Card Industry Data Security Standard):applies to any entity thatstores, processes, or transmits cardholder data.
* Exact extract (PCI DSS official summary):
* "PCI DSS applies to all entities that store, process or transmit cardholder data (CHD) and
/or sensitive authentication data (SAD)."
* Therefore,merchants who process credit card paymentsmust comply.
* Why others are wrong:
* A: No card payments, so no PCI scope.
* B: This falls underFISMA / NIST 800-53, not PCI DSS.
* C: Non-profits may handle sensitive data, but PCI only applies if they processcredit cards.
References:
PCI Security Standards Council - PCI DSS Summary: https://www.pcisecuritystandards.org/pci_security/

質問 # 47
What is the purpose of the Supplier Assessments and Reviews control in the NIST 800-53 Rev. 5 set of controls for Supply Chain Risk Management?

• A. To conduct regular audits of suppliers' financial performance.
• B. To establish contractual agreements with suppliers.
• C. To identify potential suppliers for the organization.
• D. To evaluate and monitor existing suppliers for adherence to security requirements.

正解：D

解説：
* In NIST SP 800-53 Rev. 5,SR-6: Supplier Assessments and Reviewsrequires evaluating and monitoring suppliers' security and risk practices.
* Exact extract (NIST SP 800-53 Rev. 5, SR-6):
* "The organization assesses and monitors suppliers to ensure they are meeting the security requirements specified in contracts and agreements."
* This is aboutongoing monitoringof supplier adherence, not financial audits, not contract creation, and not supplier discovery.
References:
NIST SP 800-53 Rev. 5, Control SR-6 (Supplier Assessments and Reviews): https://csrc.nist.gov/publications
/detail/sp/800-53/rev-5/final

質問 # 48
In Kubernetes, what isPublic Key Infrastructure (PKI)used for?

• A. To manage certificates and ensure secure communication in a Kubernetes cluster.
• B. To manage networking in a Kubernetes cluster.
• C. To monitor and analyze performance metrics of a Kubernetes cluster.
• D. To automate the scaling of containers in a Kubernetes cluster.

正解：A

解説：
* Kubernetes usesPKI certificatesextensively to secure communication between control plane components (API server, etcd, kube-scheduler, kube-controller-manager) and with kubelets.
* Certificates enablemutual TLS authentication and encryptionacross components.
* PKI does not handle scaling, networking, or monitoring.
References:
Kubernetes Documentation - Certificates
CNCF Security Whitepaper - Cluster communication security and the role of PKI.

質問 # 49
Which of the following statements best describes the role of the Scheduler in Kubernetes?

• A. The Scheduler is responsible for ensuring the security of the Kubernetes cluster and its components.
• B. The Scheduler is responsible for assigning Pods to nodes based on resource availability and other constraints.
• C. The Scheduler is responsible for monitoring and managing the health of the Kubernetes cluster.
• D. The Scheduler is responsible for managing the deployment and scaling of applications in the Kubernetes cluster.

正解：B

解説：
* TheKubernetes Schedulerassigns Pods to nodes based on:
* Resource requests & availability (CPU, memory, GPU, etc.)
* Constraints (affinity, taints, tolerations, topology, policies)
* Exact extract (Kubernetes Docs - Scheduler):
* "The scheduler is a control plane process that assigns Pods to Nodes. Scheduling decisions take into account resource requirements, affinity/anti-affinity, constraints, and policies."
* Other options clarified:
* A: Monitoring cluster health is theController Manager's/kubelet's job.
* B: Security is enforced throughRBAC, admission controllers, PSP/PSA, not the scheduler.
* C: Deployment scaling is handled by theController Manager(Deployment/ReplicaSet controller).
References:
Kubernetes Docs - Scheduler: https://kubernetes.io/docs/concepts/scheduling-eviction/kube-scheduler/

質問 # 50
......

正真正銘のKCSA問題集には100%合格率練習テスト問題集：https://www.goshiken.com/Linux-Foundation/KCSA-mondaishu.html

Linux Foundation KCSAリアル試験問題保証付き更新された問題集にはGoShiken：https://drive.google.com/open?id=1JEuIF4XnZd_YBuGyeOrbKgUljYXNfUjN