CKA Security 2

Question 1

Which admission controller enforces Pod Security Standards when you label a namespace with `pod-security.kubernetes.io/enforce: restricted`?

Accepted Answer

PodSecurity

Answer

The PodSecurity admission controller (GA in 1.25) enforces Pod Security Standards using namespace labels.

Question 2

A ServiceAccount token mounted in a pod by default has what scope of access in Kubernetes 1.24+?

Accepted Answer

No RBAC permissions unless explicitly granted

Answer

ServiceAccounts have no permissions by default; RBAC must explicitly grant them roles.

Question 3

What flag on a container's SecurityContext prevents privilege escalation via setuid binaries?

Accepted Answer

allowPrivilegeEscalation: false

Answer

`allowPrivilegeEscalation: false` sets the no_new_privs flag, blocking setuid/setgid escalation.

Question 4

Which kubeconfig field stores the cluster's certificate authority data used by kubectl to verify the API server?

Accepted Answer

certificate-authority-data

Answer

`certificate-authority-data` holds the base64-encoded CA bundle that kubectl uses to trust the API server's TLS certificate.

Question 5

An attacker exploits a container and tries to read `/run/secrets/kubernetes.io/serviceaccount/token`. What is this file?

Accepted Answer

A projected ServiceAccount JWT used to authenticate to the API server

Answer

Kubernetes mounts a projected ServiceAccount JWT at that path, which pods use to authenticate API requests.

(CKA) Certified Kubernetes Administrator Practice Test