CKA RBAC and Security 3 — Questions and Answers
Question 1: A NetworkPolicy selects pods with label 'app=backend' and has an empty ingress rule (ingress: []). What is the effect?
- All ingress traffic is allowed
- All ingress traffic is denied (Correct answer)
- Only DNS traffic is allowed
- The policy has no effect
Correct answer: All ingress traffic is denied
An empty ingress array in a NetworkPolicy denies all incoming traffic to the selected pods.
Question 2: What does the 'impersonate' verb in a ClusterRole allow?
- Run commands as another container user
- Act as another user, group, or service account via --as flag (Correct answer)
- Change the service account of a running pod
- Override RBAC checks for specific resources
Correct answer: Act as another user, group, or service account via --as flag
The impersonate verb grants the ability to impersonate users, groups, or service accounts, used with kubectl --as.
Question 3: Which Kubernetes Secret type is automatically created and mounted into pods for service account authentication?
- kubernetes.io/basic-auth
- kubernetes.io/tls
- kubernetes.io/service-account-token (Correct answer)
- Opaque
Correct answer: kubernetes.io/service-account-token
kubernetes.io/service-account-token secrets hold the JWT token used by pods to authenticate to the API server as a service account.
Question 4: A CKA candidate needs to restrict a pod to only use Linux capabilities CAP_NET_BIND_SERVICE. Which securityContext configuration achieves this?
- capabilities: {add: [NET_BIND_SERVICE], drop: [ALL]} (Correct answer)
- capabilities: {allow: [NET_BIND_SERVICE]}
- securityContext: capabilityPolicy: NET_BIND_SERVICE
- privileged: false, allowedCapabilities: [NET_BIND_SERVICE]
Correct answer: capabilities: {add: [NET_BIND_SERVICE], drop: [ALL]}
Dropping ALL capabilities first and then adding only NET_BIND_SERVICE follows the principle of least privilege.
Question 5: Which command creates a Role named 'pod-reader' that can only get, list, and watch pods in namespace 'staging'?
- kubectl create role pod-reader --verb=get,list,watch --resource=pods -n staging (Correct answer)
- kubectl create clusterrole pod-reader --verb=get,list,watch --resource=pods -n staging
- kubectl create role pod-reader --permissions=get,list,watch --resource=pods --namespace=staging
- kubectl apply role pod-reader --verbs=get,list,watch --resources=pods -n staging
Correct answer: kubectl create role pod-reader --verb=get,list,watch --resource=pods -n staging
kubectl create role with --verb and --resource flags creates a namespaced Role with the specified permissions.
Question 6: When automountServiceAccountToken is set to false on a Pod spec, what happens?
- The pod cannot use any secrets
- The service account token is not mounted into the pod's filesystem (Correct answer)
- The service account is deleted
- The pod runs without a service account
Correct answer: The service account token is not mounted into the pod's filesystem
Setting automountServiceAccountToken: false prevents the default service account token from being mounted at /var/run/secrets/kubernetes.io/serviceaccount/.
Question 7: Which built-in ClusterRole provides read-only access to most resources across all namespaces but cannot view Secrets?
- cluster-reader
- view (Correct answer)
- readonly
- basic-user
Correct answer: view
The 'view' ClusterRole grants read access to most resources but explicitly excludes Secrets to prevent credential exposure.
CKA RBAC and Security 3
A NetworkPolicy selects pods with label 'app=backend' and has an empty ingress rule (ingress: []).
What is the effect?