CKA RBAC and Security 2 — Questions and Answers
Question 1: A ClusterRole grants permissions across all namespaces. Which resource type is used to bind a ClusterRole to a user in a specific namespace only?
- ClusterRoleBinding
- RoleBinding (Correct answer)
- Role
- NamespaceBinding
Correct answer: RoleBinding
A RoleBinding in a specific namespace can reference a ClusterRole, but the permissions are limited to that namespace.
Question 2: Which command verifies what actions the service account 'my-sa' in namespace 'dev' can perform on pods?
- kubectl auth can-i list pods --as=system:serviceaccount:dev:my-sa (Correct answer)
- kubectl check-permissions pods --sa=my-sa -n dev
- kubectl rbac verify pods --serviceaccount=my-sa
- kubectl get rolebindings -n dev --serviceaccount=my-sa
Correct answer: kubectl auth can-i list pods --as=system:serviceaccount:dev:my-sa
kubectl auth can-i with --as flag impersonates the service account to check permissions.
Question 3: What does the 'escalate' verb in a Role allow a user to do?
- Grant cluster-admin to others
- Update a role to have higher permissions than the user themselves possess (Correct answer)
- Create ClusterRoles from Roles
- Bind roles without RoleBinding
Correct answer: Update a role to have higher permissions than the user themselves possess
The 'escalate' verb allows updating a role to include permissions the user does not currently hold, bypassing privilege escalation prevention.
Question 4: Which Kubernetes object stores credentials for accessing a private container registry?
- ConfigMap
- Secret of type kubernetes.io/service-account-token
- Secret of type kubernetes.io/dockerconfigjson (Correct answer)
- ServiceAccount
Correct answer: Secret of type kubernetes.io/dockerconfigjson
A Secret with type kubernetes.io/dockerconfigjson stores Docker registry credentials for pulling private images.
Question 5: A PodSecurityContext field 'runAsNonRoot: true' will cause the pod to fail to start if:
- The container image has no ENTRYPOINT
- The container's USER is set to 0 or root (Correct answer)
- The node does not support user namespaces
- The pod has no service account
Correct answer: The container's USER is set to 0 or root
Setting runAsNonRoot: true causes Kubernetes to reject containers that run as UID 0 (root).
Question 6: Which field in a Pod spec prevents a container from gaining more privileges than its parent process?
- readOnlyRootFilesystem
- allowPrivilegeEscalation: false (Correct answer)
- privileged: false
- capabilities: drop: ALL
Correct answer: allowPrivilegeEscalation: false
allowPrivilegeEscalation: false prevents the process from gaining additional privileges via setuid binaries or file capabilities.
Question 7: In Kubernetes RBAC, which of the following is a valid aggregate-to label that causes a ClusterRole to be merged into the 'view' default ClusterRole?
- rbac.authorization.kubernetes.io/aggregate-to-admin: 'true'
- rbac.authorization.kubernetes.io/aggregate-to-view: 'true' (Correct answer)
- kubernetes.io/aggregate-role: view
- rbac.kubernetes.io/view-aggregate: enabled
Correct answer: rbac.authorization.kubernetes.io/aggregate-to-view: 'true'
The label rbac.authorization.kubernetes.io/aggregate-to-view: 'true' causes a ClusterRole to be aggregated into the built-in view ClusterRole.
CKA RBAC and Security 2
A ClusterRole grants permissions across all namespaces.
Which resource type is used to bind a ClusterRole to a user in a specific namespace only?