CKA RBAC and Security 3

Question 1

A NetworkPolicy selects pods with label 'app=backend' and has an empty ingress rule (ingress: []). What is the effect?

Accepted Answer

All ingress traffic is denied

Answer

An empty ingress array in a NetworkPolicy denies all incoming traffic to the selected pods.

Question 2

What does the 'impersonate' verb in a ClusterRole allow?

Accepted Answer

Act as another user, group, or service account via --as flag

Answer

The impersonate verb grants the ability to impersonate users, groups, or service accounts, used with kubectl --as.

Question 3

Which Kubernetes Secret type is automatically created and mounted into pods for service account authentication?

Accepted Answer

kubernetes.io/service-account-token

Answer

kubernetes.io/service-account-token secrets hold the JWT token used by pods to authenticate to the API server as a service account.

Question 4

A CKA candidate needs to restrict a pod to only use Linux capabilities CAP_NET_BIND_SERVICE. Which securityContext configuration achieves this?

Accepted Answer

capabilities: {add: [NET_BIND_SERVICE], drop: [ALL]}

Answer

Dropping ALL capabilities first and then adding only NET_BIND_SERVICE follows the principle of least privilege.

Question 5

Which command creates a Role named 'pod-reader' that can only get, list, and watch pods in namespace 'staging'?

Accepted Answer

kubectl create role pod-reader --verb=get,list,watch --resource=pods -n staging

Answer

kubectl create role with --verb and --resource flags creates a namespaced Role with the specified permissions.

(CKA) Certified Kubernetes Associate Practice Test