CDP CDP Container & Kubernetes Security 2

Question 1

Kubernetes Role-Based Access Control (RBAC) is used to:

Accepted Answer

Define which users and service accounts can perform actions on cluster resources

Answer

RBAC binds permissions (Roles/ClusterRoles) to subjects (users, groups, service accounts) to enforce least-privilege access in the cluster.

Question 2

What is the risk of storing secrets in environment variables in Kubernetes pods?

Accepted Answer

They may be exposed in pod logs, crash dumps, or to processes with cluster access

Answer

Environment variables are accessible to all processes in a container and can appear in logs or diagnostic output, increasing accidental exposure risk.

Question 3

Container image signing and verification using tools like Cosign or Notary helps ensure:

Accepted Answer

Only trusted, unmodified images are deployed in the cluster

Answer

Image signing creates a cryptographic attestation that verifies the image was built by a trusted source and has not been tampered with.

Question 4

An admission controller in Kubernetes is best described as:

Accepted Answer

A webhook that intercepts and validates or mutates API requests before they are persisted

Answer

Admission controllers enforce security policies (e.g., blocking privileged containers) at the API server level before objects are created or modified.

Question 5

Which attack technique involves exploiting a vulnerability inside a container to gain access to the host operating system?

Accepted Answer

Container escape

Answer

Container escape exploits weaknesses in the container runtime or kernel to break out of the container namespace and compromise the host.

(CDP) Certified DevSecOps Professional Practice Test

(CDP) Certified DevSecOps Professional Practice Test

CDP CDP Container & Kubernetes Security 2