CKA Security Practices 2 — Questions and Answers
Question 1: Which Kubernetes object enforces network-level traffic rules between pods?
- PodSecurityPolicy
- NetworkPolicy (Correct answer)
- ResourceQuota
- LimitRange
Correct answer: NetworkPolicy
NetworkPolicy resources define ingress and egress rules that control traffic flow between pods and namespaces.
Question 2: What does setting `automountServiceAccountToken: false` on a Pod achieve?
- Disables RBAC for the pod
- Prevents the service account token from being mounted into the pod (Correct answer)
- Deletes the service account
- Blocks all egress traffic from the pod
Correct answer: Prevents the service account token from being mounted into the pod
Setting automountServiceAccountToken: false prevents Kubernetes from automatically mounting the service account's API token as a volume inside the pod.
Question 3: Which admission controller enforces Pod Security Standards at the namespace level?
- PodSecurityPolicy
- PodSecurity (Correct answer)
- SecurityContextDeny
- NodeRestriction
Correct answer: PodSecurity
The PodSecurity admission controller (replacing PodSecurityPolicy) enforces Pod Security Standards via namespace labels.
Question 4: A container needs to write to `/proc` for legitimate monitoring. Which securityContext setting allows this?
- allowPrivilegeEscalation: true
- privileged: true (Correct answer)
- readOnlyRootFilesystem: false
- runAsNonRoot: false
Correct answer: privileged: true
Running a container as privileged gives it near-root access on the node, including write access to /proc, though this is a significant security risk.
Question 5: What is the purpose of a Kubernetes Secret of type `kubernetes.io/tls`?
- Store database passwords
- Hold TLS certificate and private key pairs (Correct answer)
- Manage OIDC tokens
- Configure mTLS between services
Correct answer: Hold TLS certificate and private key pairs
The kubernetes.io/tls Secret type stores a TLS certificate in tls.crt and the corresponding private key in tls.key fields.
Question 6: Which command verifies that a ClusterRole named `pod-reader` grants `get` on pods?
- kubectl get clusterrole pod-reader -o yaml
- kubectl auth can-i get pods --as=system:serviceaccount:default:sa
- kubectl describe clusterrole pod-reader
- Both A and C (Correct answer)
Correct answer: Both A and C
Both `kubectl get clusterrole pod-reader -o yaml` and `kubectl describe clusterrole pod-reader` display the rules defined in the ClusterRole.
Question 7: To restrict a ServiceAccount from accessing secrets cluster-wide, you should:
- Delete the ServiceAccount
- Ensure no ClusterRoleBinding grants it secrets access (Correct answer)
- Set automountServiceAccountToken: false
- Add a NetworkPolicy to the namespace
Correct answer: Ensure no ClusterRoleBinding grants it secrets access
Removing or not creating ClusterRoleBindings that grant secrets access to a ServiceAccount is the correct RBAC approach to restrict secret access.
CKA Security Practices 2
Which Kubernetes object enforces network-level traffic rules between pods?