CKA Security 2 — Questions and Answers
Question 1: Which admission controller enforces Pod Security Standards when you label a namespace with `pod-security.kubernetes.io/enforce: restricted`?
- PodSecurityPolicy
- PodSecurity (Correct answer)
- SecurityContextDeny
- NodeRestriction
Correct answer: PodSecurity
The PodSecurity admission controller (GA in 1.25) enforces Pod Security Standards using namespace labels.
Question 2: A ServiceAccount token mounted in a pod by default has what scope of access in Kubernetes 1.24+?
- Cluster-wide read access
- Namespace-wide admin access
- No RBAC permissions unless explicitly granted (Correct answer)
- Full access to its own namespace
Correct answer: No RBAC permissions unless explicitly granted
ServiceAccounts have no permissions by default; RBAC must explicitly grant them roles.
Question 3: What flag on a container's SecurityContext prevents privilege escalation via setuid binaries?
- readOnlyRootFilesystem: true
- runAsNonRoot: true
- allowPrivilegeEscalation: false (Correct answer)
- privileged: false
Correct answer: allowPrivilegeEscalation: false
`allowPrivilegeEscalation: false` sets the no_new_privs flag, blocking setuid/setgid escalation.
Question 4: Which kubeconfig field stores the cluster's certificate authority data used by kubectl to verify the API server?
- client-certificate-data
- certificate-authority-data (Correct answer)
- server-tls-data
- insecure-skip-tls-verify
Correct answer: certificate-authority-data
`certificate-authority-data` holds the base64-encoded CA bundle that kubectl uses to trust the API server's TLS certificate.
Question 5: An attacker exploits a container and tries to read `/run/secrets/kubernetes.io/serviceaccount/token`. What is this file?
- The node's kubelet bootstrap token
- A projected ServiceAccount JWT used to authenticate to the API server (Correct answer)
- The etcd encryption key
- A TLS client certificate for the kubelet
Correct answer: A projected ServiceAccount JWT used to authenticate to the API server
Kubernetes mounts a projected ServiceAccount JWT at that path, which pods use to authenticate API requests.
Question 6: Which Kubernetes object can restrict egress traffic from pods in a namespace to only port 5432 on a specific database pod?
- PodSecurityPolicy
- NetworkPolicy (Correct answer)
- LimitRange
- ResourceQuota
Correct answer: NetworkPolicy
NetworkPolicy objects control pod-level ingress and egress traffic using label selectors and port rules.
Question 7: When using `kubectl certificate approve`, what signer must be used for a kubelet serving certificate CSR?
- kubernetes.io/kube-apiserver-client
- kubernetes.io/kubelet-serving (Correct answer)
- kubernetes.io/legacy-unknown
- kubernetes.io/etcd-client
Correct answer: kubernetes.io/kubelet-serving
The `kubernetes.io/kubelet-serving` signer is used for kubelet serving certificates that authenticate the kubelet's HTTPS endpoint.
CKA Security 2
Which admission controller enforces Pod Security Standards when you label a namespace with `pod-security.kubernetes.io/enforce: restricted`?