CKA Security 4

Question 1

You need to grant a CI/CD pipeline read-only access to pods in only the `staging` namespace. Which combination is correct?

Accepted Answer

Role in staging + RoleBinding in staging

Answer

A Role scoped to `staging` combined with a RoleBinding in `staging` grants access limited to that namespace only.

Question 2

What does the `NodeRestriction` admission controller prevent?

Accepted Answer

Kubelets from modifying labels or resources outside their own node/pods

Answer

NodeRestriction limits the kubelet's API server write access to its own Node object and pods scheduled on it, preventing lateral movement.

Question 3

Which field in a CertificateSigningRequest (CSR) object specifies what the certificate will be used for?

Accepted Answer

spec.usages

Answer

`spec.usages` lists key usage extensions like `client auth` or `server auth` that restrict how the issued certificate can be used.

Question 4

A Pod Security Standard level that blocks host namespaces, privileged containers, and requires non-root is called:

Accepted Answer

Restricted

Answer

The `Restricted` Pod Security Standard enforces the most stringent hardening requirements including non-root, no privilege escalation, and seccomp.

Question 5

What happens to existing pods in a namespace when you change its Pod Security Standard enforcement label to `restricted`?

Accepted Answer

Existing pods are unaffected; only new or updated pods are evaluated

Answer

Admission control only applies to new admission requests; existing running pods are not re-evaluated when labels change.

(CKA) Certified Kubernetes Administrator Practice Test