CKA Security Practices 3 — Questions and Answers
Question 1: What does the `runAsUser: 1000` field in a securityContext do?
- Sets the file system group ID
- Sets the UID the container process runs as (Correct answer)
- Adds Linux capabilities to the container
- Defines the container's supplemental groups
Correct answer: Sets the UID the container process runs as
The runAsUser field specifies the UID that the container's main process will run as, overriding the image's default user.
Question 2: Which Pod Security Standard level prohibits running containers as root?
- Privileged
- Baseline
- Restricted (Correct answer)
- Default
Correct answer: Restricted
The Restricted Pod Security Standard requires containers to run as non-root and enforces the most stringent security controls.
Question 3: When using RBAC, what is the difference between a Role and a ClusterRole?
- Roles apply to all namespaces; ClusterRoles are namespace-scoped
- Roles are namespace-scoped; ClusterRoles apply cluster-wide including non-namespaced resources (Correct answer)
- Roles can only bind to users; ClusterRoles can bind to service accounts
- Roles are deprecated; ClusterRoles should always be used
Correct answer: Roles are namespace-scoped; ClusterRoles apply cluster-wide including non-namespaced resources
Roles are scoped to a single namespace while ClusterRoles are cluster-wide and can also grant access to non-namespaced resources like nodes.
Question 4: What is the effect of the `default-deny` NetworkPolicy pattern?
- Blocks DNS resolution for all pods
- Denies all ingress and egress by default, requiring explicit allow policies (Correct answer)
- Removes all existing NetworkPolicies
- Only applies to pods without labels
Correct answer: Denies all ingress and egress by default, requiring explicit allow policies
A default-deny NetworkPolicy selects all pods with an empty podSelector and defines no rules, which blocks all traffic unless other policies explicitly allow it.
Question 5: Which field in a Pod spec prevents a container from gaining more privileges than its parent process?
- privileged: false
- allowPrivilegeEscalation: false (Correct answer)
- runAsNonRoot: true
- readOnlyRootFilesystem: true
Correct answer: allowPrivilegeEscalation: false
Setting allowPrivilegeEscalation: false prevents processes inside the container from gaining more privileges than their parent, blocking setuid binaries.
Question 6: A developer wants to audit who accessed a specific Secret. Which Kubernetes feature provides this?
- Resource Quotas
- Audit Logging (Correct answer)
- PodSecurityAdmission
- RBAC authorization logs
Correct answer: Audit Logging
Kubernetes Audit Logging records API server requests including which user or service account accessed a Secret and when.
Question 7: What does `seccompProfile: type: RuntimeDefault` configure for a container?
- Disables all system calls for the container
- Applies the container runtime's default seccomp profile to filter system calls (Correct answer)
- Enables privileged mode for the container
- Sets the AppArmor profile to the runtime default
Correct answer: Applies the container runtime's default seccomp profile to filter system calls
RuntimeDefault applies the container runtime's built-in seccomp profile, which blocks commonly dangerous system calls without breaking most applications.
CKA Security Practices 3
What does the `runAsUser: 1000` field in a securityContext do?