CKA RBAC and Security 2

Question 1

A ClusterRole grants permissions across all namespaces. Which resource type is used to bind a ClusterRole to a user in a specific namespace only?

Accepted Answer

RoleBinding

Answer

A RoleBinding in a specific namespace can reference a ClusterRole, but the permissions are limited to that namespace.

Question 2

Which command verifies what actions the service account 'my-sa' in namespace 'dev' can perform on pods?

Accepted Answer

kubectl auth can-i list pods --as=system:serviceaccount:dev:my-sa

Answer

kubectl auth can-i with --as flag impersonates the service account to check permissions.

Question 3

What does the 'escalate' verb in a Role allow a user to do?

Accepted Answer

Update a role to have higher permissions than the user themselves possess

Answer

The 'escalate' verb allows updating a role to include permissions the user does not currently hold, bypassing privilege escalation prevention.

Question 4

Which Kubernetes object stores credentials for accessing a private container registry?

Accepted Answer

Secret of type kubernetes.io/dockerconfigjson

Answer

A Secret with type kubernetes.io/dockerconfigjson stores Docker registry credentials for pulling private images.

Question 5

A PodSecurityContext field 'runAsNonRoot: true' will cause the pod to fail to start if:

Accepted Answer

The container's USER is set to 0 or root

Answer

Setting runAsNonRoot: true causes Kubernetes to reject containers that run as UID 0 (root).

(CKA) Certified Kubernetes Associate Practice Test