CDP CDP Container & Kubernetes Security 2 — Questions and Answers
Question 1: Kubernetes Role-Based Access Control (RBAC) is used to:
- Allocate CPU resources to containers
- Define which users and service accounts can perform actions on cluster resources (Correct answer)
- Configure ingress routing rules
- Manage node auto-scaling policies
Correct answer: Define which users and service accounts can perform actions on cluster resources
RBAC binds permissions (Roles/ClusterRoles) to subjects (users, groups, service accounts) to enforce least-privilege access in the cluster.
Question 2: What is the risk of storing secrets in environment variables in Kubernetes pods?
- They cannot be used by the application
- They may be exposed in pod logs, crash dumps, or to processes with cluster access (Correct answer)
- They prevent the pod from restarting
- They consume excessive memory
Correct answer: They may be exposed in pod logs, crash dumps, or to processes with cluster access
Environment variables are accessible to all processes in a container and can appear in logs or diagnostic output, increasing accidental exposure risk.
Question 3: Container image signing and verification using tools like Cosign or Notary helps ensure:
- Images are compressed efficiently
- Only trusted, unmodified images are deployed in the cluster (Correct answer)
- Pods restart automatically on failure
- Network traffic between pods is encrypted
Correct answer: Only trusted, unmodified images are deployed in the cluster
Image signing creates a cryptographic attestation that verifies the image was built by a trusted source and has not been tampered with.
Question 4: An admission controller in Kubernetes is best described as:
- A load balancer for incoming HTTP traffic
- A webhook that intercepts and validates or mutates API requests before they are persisted (Correct answer)
- A tool for collecting container logs
- A scheduler that places pods on nodes
Correct answer: A webhook that intercepts and validates or mutates API requests before they are persisted
Admission controllers enforce security policies (e.g., blocking privileged containers) at the API server level before objects are created or modified.
Question 5: Which attack technique involves exploiting a vulnerability inside a container to gain access to the host operating system?
- Lateral movement
- Container escape (Correct answer)
- SQL injection
- DNS poisoning
Correct answer: Container escape
Container escape exploits weaknesses in the container runtime or kernel to break out of the container namespace and compromise the host.
Question 6: Enabling audit logging in Kubernetes provides security value by:
- Reducing API server latency
- Recording all requests to the API server for forensic investigation and anomaly detection (Correct answer)
- Compressing etcd snapshots automatically
- Balancing load across control-plane nodes
Correct answer: Recording all requests to the API server for forensic investigation and anomaly detection
Kubernetes audit logs capture who did what and when in the cluster, supporting incident investigation and compliance requirements.
CDP CDP Container & Kubernetes Security 2
Kubernetes Role-Based Access Control (RBAC) is used to: