Skip to content

Compliance Frameworks: KCSA practice questions

Compliance frameworks give security work a common reference that auditors, customers and engineers can all read. They differ in scope and weight: some describe how an organization manages risk in general, some list detailed controls, some prescribe exact configuration values for one product, and some are industry requirements tied to contracts.

By Ibrahim Yesilay · Published · Updated

Independent community practice, not affiliated with or endorsed by CNCF or The Linux Foundation.

What Compliance Frameworks covers in KCSA

Compliance frameworks give security work a common reference that auditors, customers and engineers can all read. They differ in scope and weight: some describe how an organization manages risk in general, some list detailed controls, some prescribe exact configuration values for one product, and some are industry requirements tied to contracts. Choosing the right framework starts with knowing which of those jobs a document does.

The NIST Cybersecurity Framework is the broadest. NIST published version 2.0 on 26 February 2024 and organized its core around six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern is the newly added function and covers how an organization makes and carries out its cybersecurity strategy decisions; the earlier version had the other five. NIST also states that the scope of 2.0 goes beyond protecting critical infrastructure, so the framework is meant for organizations in general. The CSF tells you which outcomes to manage, not which Kubernetes flag to set.

NIST Special Publication 800-53 Revision 5 sits at the control level. Its abstract describes a catalog of security and privacy controls for information systems and organizations, intended to protect operations, assets, individuals, other organizations and the nation, and states that the controls are flexible and customizable and are implemented as part of an organization-wide risk process. It is the reference for controls in federal information systems, and a CSF outcome is typically met by selecting and tailoring controls from a catalog such as this one.

The CIS Kubernetes Benchmark is the most concrete. The Center for Internet Security produces it through a community consensus process as a set of secure configuration guidelines for Kubernetes, and separate benchmarks exist for managed services such as Amazon EKS, Azure AKS, Google GKE, Oracle OKE and Red Hat OpenShift. Because each recommendation is a checkable setting, a benchmark is what you audit a running cluster against, and scanners can evaluate it repeatedly. CIS publishes more than one hundred vendor-neutral benchmarks of this kind.

Industry standards apply because of the data you handle, not the platform you run. PCI DSS provides a baseline of technical and operational requirements for protecting payment account data and applies to entities that store, process or transmit cardholder data or sensitive authentication data, or that could affect the security of the cardholder data environment. A containerized workload that touches card data is in scope just as a virtual machine would be, which is why network segmentation, access control and logging inside the cluster matter to a PCI assessment.

A practical way to hold these together: the CSF frames the program, a control catalog such as 800-53 describes what must be in place, a benchmark such as CIS checks the cluster configuration, and sector standards such as PCI DSS define what is mandatory for regulated data.

Key points

  • NIST CSF 2.0 was published on 26 February 2024 and added Govern as a sixth function.
  • NIST SP 800-53 Rev. 5 is a catalog of security and privacy controls for information systems and organizations.
  • The CIS Kubernetes Benchmark is consensus-based configuration guidance, with separate versions for EKS, AKS, GKE, OKE and OpenShift.
  • PCI DSS applies to any entity that stores, processes or transmits cardholder data, containerized or not.

Three sample questions

12 KCSA questions on Compliance Frameworks, 12 with explanations. How practice works

Question 1

Which NIST Special Publication provides comprehensive guidelines on security and privacy controls specifically for federal information systems?
  1. A.NIST SP 800-53 Rev. 5
  2. B.NIST SP 800-190
  3. C.NIST SP 800-63
  4. D.NIST SP 800-171
  5. E.NIST SP 800-30

Correct answer: A

NIST SP 800-53 Rev. 5 is the primary publication that provides guidelines on security and privacy controls for federal information systems. It outlines a comprehensive set of controls that are crucial for protecting the confidentiality, integrity, and availability of federal information systems. NIST SP 800-190 focuses on cloud computing security, NIST SP 800-63 deals with digital identity guidelines, NIST SP 800-171 provides guidelines for protecting controlled unclassified information in nonfederal systems, and NIST SP 800-30 is about risk management.

Sources: NIST Special Publication 800-53 Rev. 5, NIST Cybersecurity Framework

Question 2

What is the primary purpose of the NIST Cybersecurity Framework (CSF)?
  1. A.A universal law for international data privacy
  2. B.A set of risk management guidelines to identify, protect, detect, respond to, and recover from cyber threats
  3. C.A standard for container registry licensing
  4. D.A government mandate exclusively for financial institutions
  5. E.A platform for automating software supply chain security

Correct answer: B

The NIST Cybersecurity Framework (CSF) is designed as a voluntary framework to help organizations manage and reduce cybersecurity risk. It provides a comprehensive set of guidelines and best practices structured around five core functions: Identify, Protect, Detect, Respond, and Recover. This framework is not a law or mandate but a flexible tool to improve cybersecurity posture across industries. The other options are incorrect because they either misrepresent the framework's scope or confuse it with unrelated standards or platforms.

Sources: NIST Cybersecurity Framework, NIST CSF Overview - CISA

Question 3

Which statement best describes the purpose of the CIS Kubernetes Benchmark?
  1. A.It is a proprietary software suite for securing virtual machines
  2. B.It offers prescriptive configuration guidelines for hardening Kubernetes clusters
  3. C.It focuses solely on threat modelling for Kubernetes
  4. D.It is primarily used for scanning container images for malware
  5. E.It provides guidelines for zero-trust network architecture

Correct answer: B

The CIS Kubernetes Benchmark provides detailed, consensus-based best practices for securely configuring Kubernetes clusters. It focuses on hardening the cluster components and configurations to reduce security risks. It is not a software tool, nor does it focus exclusively on threat modeling or container image scanning. While zero-trust principles may be relevant to Kubernetes security, the benchmark itself specifically addresses configuration hardening.

Sources: CIS Kubernetes Benchmark, Kubernetes Security Best Practices - CNCF

Practice this topic

Focus mode keeps every question on Compliance Frameworks until you leave it. 10 free guest answers, then a free account; no credit card.

Or open KCSA practice across all topics.

Sources

The explanation above was checked against these official documents.

Frequently asked questions

Is the NIST Cybersecurity Framework a Kubernetes hardening guide?

No. The CSF describes risk-management outcomes grouped into six functions. Concrete Kubernetes settings come from configuration guidance such as the CIS Kubernetes Benchmark, which is what a cluster is audited against.