CKA Security 3 — Questions and Answers
Question 1: What is the purpose of the `seccomp` profile `RuntimeDefault` in a pod's SecurityContext?
- Disables all system calls
- Applies the container runtime's default syscall allowlist (Correct answer)
- Enables privileged mode syscalls
- Restricts network syscalls only
Correct answer: Applies the container runtime's default syscall allowlist
`RuntimeDefault` applies the container runtime's (e.g., containerd) built-in seccomp profile that blocks dangerous syscalls.
Question 2: Which RBAC verb is needed to allow a user to exec into a running pod?
- get
- exec (Correct answer)
- create
- update
Correct answer: exec
The `exec` verb on the `pods/exec` subresource is required to run `kubectl exec` against a pod.
Question 3: You want to audit all requests that resulted in a 403 response. Which audit policy level captures the request metadata including response code?
- None
- Metadata (Correct answer)
- Request
- RequestResponse
Correct answer: Metadata
The `Metadata` audit level records request metadata including verb, user, resource, and response code without capturing the body.
Question 4: A ClusterRole with `resourceNames: ["my-secret"]` restricts access to what?
- All secrets in the cluster
- Only the specific secret named my-secret (Correct answer)
- Secrets in the default namespace only
- Secrets with label name=my-secret
Correct answer: Only the specific secret named my-secret
`resourceNames` limits the role to operate only on the named resource instance, not all instances of that resource type.
Question 5: Which tool is built into Kubernetes to encrypt etcd data at rest for Secrets?
- HashiCorp Vault
- EncryptionConfiguration with a provider like AES-CBC (Correct answer)
- TLS termination at the API server
- RBAC policies
Correct answer: EncryptionConfiguration with a provider like AES-CBC
An EncryptionConfiguration file referenced by the API server's `--encryption-provider-config` flag encrypts etcd data at rest.
Question 6: What does `automountServiceAccountToken: false` on a pod spec do?
- Revokes the ServiceAccount's RBAC permissions
- Prevents the ServiceAccount token from being mounted into the pod (Correct answer)
- Deletes the ServiceAccount
- Disables network access for the pod
Correct answer: Prevents the ServiceAccount token from being mounted into the pod
Setting `automountServiceAccountToken: false` stops Kubernetes from projecting the token into `/run/secrets/kubernetes.io/serviceaccount/`, reducing attack surface.
Question 7: Which Kubernetes admission controller validates and mutates resources based on custom policies using webhooks?
- NamespaceLifecycle
- ValidatingAdmissionWebhook (Correct answer)
- NodeRestriction
- LimitRanger
Correct answer: ValidatingAdmissionWebhook
`ValidatingAdmissionWebhook` calls external webhook servers to accept or reject API requests based on custom policy logic.
CKA Security 3
What is the purpose of the `seccomp` profile `RuntimeDefault` in a pod's SecurityContext?