CKA Security 3

Question 1

What is the purpose of the `seccomp` profile `RuntimeDefault` in a pod's SecurityContext?

Accepted Answer

Applies the container runtime's default syscall allowlist

Answer

`RuntimeDefault` applies the container runtime's (e.g., containerd) built-in seccomp profile that blocks dangerous syscalls.

Question 2

Which RBAC verb is needed to allow a user to exec into a running pod?

Accepted Answer

exec

Answer

The `exec` verb on the `pods/exec` subresource is required to run `kubectl exec` against a pod.

Question 3

You want to audit all requests that resulted in a 403 response. Which audit policy level captures the request metadata including response code?

Accepted Answer

Metadata

Answer

The `Metadata` audit level records request metadata including verb, user, resource, and response code without capturing the body.

Question 4

A ClusterRole with `resourceNames: ["my-secret"]` restricts access to what?

Accepted Answer

Only the specific secret named my-secret

Answer

`resourceNames` limits the role to operate only on the named resource instance, not all instances of that resource type.

Question 5

Which tool is built into Kubernetes to encrypt etcd data at rest for Secrets?

Accepted Answer

EncryptionConfiguration with a provider like AES-CBC

Answer

An EncryptionConfiguration file referenced by the API server's `--encryption-provider-config` flag encrypts etcd data at rest.

(CKA) Certified Kubernetes Administrator Practice Test