CDP Container & Kubernetes Security Flashcards

Kubernetes Role-Based Access Control (RBAC) is used to:

Answer: Define which users and service accounts can perform actions on cluster resources

RBAC binds permissions (Roles/ClusterRoles) to subjects (users, groups, service accounts) to enforce least-privilege access in the cluster.

What is the risk of storing secrets in environment variables in Kubernetes pods?

Answer: They may be exposed in pod logs, crash dumps, or to processes with cluster access

Environment variables are accessible to all processes in a container and can appear in logs or diagnostic output, increasing accidental exposure risk.

Container image signing and verification using tools like Cosign or Notary helps ensure:

Answer: Only trusted, unmodified images are deployed in the cluster

Image signing creates a cryptographic attestation that verifies the image was built by a trusted source and has not been tampered with.

An admission controller in Kubernetes is best described as:

Answer: A webhook that intercepts and validates or mutates API requests before they are persisted

Admission controllers enforce security policies (e.g., blocking privileged containers) at the API server level before objects are created or modified.

Which attack technique involves exploiting a vulnerability inside a container to gain access to the host operating system?

Answer: Container escape

Container escape exploits weaknesses in the container runtime or kernel to break out of the container namespace and compromise the host.

Enabling audit logging in Kubernetes provides security value by:

Answer: Recording all requests to the API server for forensic investigation and anomaly detection

Kubernetes audit logs capture who did what and when in the cluster, supporting incident investigation and compliance requirements.