CKA Security Practices 3

Question 1

What does the `runAsUser: 1000` field in a securityContext do?

Accepted Answer

Sets the UID the container process runs as

Answer

The runAsUser field specifies the UID that the container's main process will run as, overriding the image's default user.

Question 2

Which Pod Security Standard level prohibits running containers as root?

Accepted Answer

Restricted

Answer

The Restricted Pod Security Standard requires containers to run as non-root and enforces the most stringent security controls.

Question 3

When using RBAC, what is the difference between a Role and a ClusterRole?

Accepted Answer

Roles are namespace-scoped; ClusterRoles apply cluster-wide including non-namespaced resources

Answer

Roles are scoped to a single namespace while ClusterRoles are cluster-wide and can also grant access to non-namespaced resources like nodes.

Question 4

What is the effect of the `default-deny` NetworkPolicy pattern?

Accepted Answer

Denies all ingress and egress by default, requiring explicit allow policies

Answer

A default-deny NetworkPolicy selects all pods with an empty podSelector and defines no rules, which blocks all traffic unless other policies explicitly allow it.

Question 5

Which field in a Pod spec prevents a container from gaining more privileges than its parent process?

Accepted Answer

allowPrivilegeEscalation: false

Answer

Setting allowPrivilegeEscalation: false prevents processes inside the container from gaining more privileges than their parent, blocking setuid binaries.

(CKA) Certified Kubernetes Associate Practice Test

(CKA) Certified Kubernetes Associate Practice Test

CKA Security Practices 3