CKA Security Practices 2

Question 1

Which Kubernetes object enforces network-level traffic rules between pods?

Accepted Answer

NetworkPolicy

Answer

NetworkPolicy resources define ingress and egress rules that control traffic flow between pods and namespaces.

Question 2

What does setting `automountServiceAccountToken: false` on a Pod achieve?

Accepted Answer

Prevents the service account token from being mounted into the pod

Answer

Setting automountServiceAccountToken: false prevents Kubernetes from automatically mounting the service account's API token as a volume inside the pod.

Question 3

Which admission controller enforces Pod Security Standards at the namespace level?

Accepted Answer

PodSecurity

Answer

The PodSecurity admission controller (replacing PodSecurityPolicy) enforces Pod Security Standards via namespace labels.

Question 4

A container needs to write to `/proc` for legitimate monitoring. Which securityContext setting allows this?

Accepted Answer

privileged: true

Answer

Running a container as privileged gives it near-root access on the node, including write access to /proc, though this is a significant security risk.

Question 5

What is the purpose of a Kubernetes Secret of type `kubernetes.io/tls`?

Accepted Answer

Hold TLS certificate and private key pairs

Answer

The kubernetes.io/tls Secret type stores a TLS certificate in tls.crt and the corresponding private key in tls.key fields.

(CKA) Certified Kubernetes Associate Practice Test

(CKA) Certified Kubernetes Associate Practice Test

CKA Security Practices 2