CKA Security 5

Question 1

Which flag on the API server enables RBAC authorization mode?

Accepted Answer

--authorization-mode=RBAC

Answer

Setting `--authorization-mode=RBAC` (often alongside Node and Webhook) activates role-based access control on the API server.

Question 2

An AppArmor profile is applied to a container using which mechanism in Kubernetes?

Accepted Answer

An annotation on the pod: `container.apparmor.security.beta.kubernetes.io/<name>`

Answer

AppArmor profiles are applied via pod annotations in the format `container.apparmor.security.beta.kubernetes.io/: `.

Question 3

What is the correct way to rotate a compromised cluster CA certificate without downtime?

Accepted Answer

Use kubeadm certs renew all and restart control plane components

Answer

`kubeadm certs renew all` regenerates all control-plane certificates and the kubelet client certificate using the existing CA.

Question 4

Which Kubernetes audit policy level records both the request body and the full response body?

Accepted Answer

RequestResponse

Answer

`RequestResponse` is the most verbose audit level, capturing request and response bodies — useful for sensitive resource changes.

Question 5

A pod needs to read a Secret value without mounting it as a file. Which approach injects it as an environment variable?

Accepted Answer

secretKeyRef in the env block

Answer

Using `secretKeyRef` in a container's `env` block injects a specific Secret key as an environment variable.

(CKA) Certified Kubernetes Administrator Practice Test