CKA Security Practices 5

Question 1

What is the function of Kubernetes Audit Policy levels `None`, `Metadata`, `Request`, and `RequestResponse`?

Accepted Answer

They control how much detail is logged for matched audit events

Answer

Audit Policy levels determine what information is captured for each event: None omits it, Metadata logs only headers, Request adds the body, and RequestResponse also logs the response.

Question 2

Which securityContext field drops Linux capabilities from a container?

Accepted Answer

capabilities.drop

Answer

The capabilities.drop field removes specific Linux capabilities from a container, reducing its attack surface even if it runs as root.

Question 3

When should you use `imagePullPolicy: Always` from a security perspective?

Accepted Answer

When using mutable tags like `latest` to ensure the most recent image is pulled

Answer

Always pulling ensures that mutable tags always resolve to the latest image, preventing stale or potentially compromised cached images from running.

Question 4

What is the primary security risk of binding a ServiceAccount to the `cluster-admin` ClusterRole?

Accepted Answer

It grants full unrestricted access to all cluster resources, violating least privilege

Answer

Binding cluster-admin to a ServiceAccount gives any pod using it complete control over the entire cluster, making it a critical security risk.

Question 5

Which Kubernetes feature allows you to validate and mutate resources before they are persisted to etcd?

Accepted Answer

Admission Webhooks

Answer

Admission Webhooks (MutatingAdmissionWebhook and ValidatingAdmissionWebhook) intercept API requests to modify or validate resources before they are stored.

(CKA) Certified Kubernetes Associate Practice Test

(CKA) Certified Kubernetes Associate Practice Test

CKA Security Practices 5