CertGrid CertGrid
Troubleshooting·Kubernetes and Cloud Native Security Associate

Commonly Confused KCSA Concepts

Multiple-choice security questions are built on distinctions: two things that sound the same and behave differently. This guide takes the six that the KCSA pool leans on hardest and settles each one against a live cluster, so the answer is a measurement rather than a memory.

Working at Exam Speed Guide 41 of 42 Intermediate

Every pair here is default behaviour on a stock kubeadm cluster. Nothing depends on this cluster's CNI or on anything installed.

The cka5001 cluster: one control plane and 3 schedulable workers, on Cilium.
Server NameIP AddressOSRolesCPURAMHDD
CKA5001192.168.0.41Ubuntu 26.04 LTSControl Plane Node (tainted NoSchedule)2 Core4 GB50 GB
CKA5001-NODE01192.168.0.42Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA5001-NODE02192.168.0.43Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA5001-NODE03192.168.0.44Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB

This guide includes

Use this shortly before the exam. This matters because multiple-choice security questions are built on pairs that sound alike and behave differently - and every pair here is default behaviour you can check rather than memorise.

Before you start

  1. view against edit, on the resource that matters

  2. The other half of the same difference

  3. A resourceName that works on one verb and not the other

  4. Request equals limit, and still not Guaranteed

  5. baseline against restricted, on the identical Pod

  6. The status code that is not the one you expect

Official sources

← All KCSA guides