KCNA Security and RBAC 2 — Questions and Answers
Question 1: Which Kubernetes object binds a ClusterRole to a user across all namespaces?
- RoleBinding
- ClusterRoleBinding (Correct answer)
- PolicyBinding
- NamespaceRoleBinding
Correct answer: ClusterRoleBinding
A ClusterRoleBinding grants the permissions defined in a ClusterRole to a subject across all namespaces in the cluster.
Question 2: What is the default behavior for a Pod that does not specify a ServiceAccount?
- No ServiceAccount is assigned
- The 'default' ServiceAccount in its namespace is used (Correct answer)
- The cluster admin ServiceAccount is used
- Pod creation is rejected
Correct answer: The 'default' ServiceAccount in its namespace is used
When a Pod does not specify a ServiceAccount, it automatically uses the 'default' ServiceAccount in its namespace.
Question 3: Which field in a Pod spec controls whether the ServiceAccount token is auto-mounted?
- serviceAccountMount
- tokenProjection
- automountServiceAccountToken (Correct answer)
- mountServiceToken
Correct answer: automountServiceAccountToken
The `automountServiceAccountToken` field in the Pod spec (or ServiceAccount spec) controls whether the token is automatically mounted.
Question 4: In Kubernetes RBAC, what does a 'verb' represent in a PolicyRule?
- The namespace where the rule applies
- The type of API resource targeted
- The action allowed on a resource (e.g., get, list, delete) (Correct answer)
- The subject granted the permission
Correct answer: The action allowed on a resource (e.g., get, list, delete)
Verbs in RBAC PolicyRules represent HTTP-method-like actions such as get, list, watch, create, update, patch, and delete.
Question 5: Which admission controller is responsible for enforcing Pod Security Standards?
- RBAC
- PodSecurityPolicy (deprecated)
- PodSecurity (Correct answer)
- SecurityContextDeny
Correct answer: PodSecurity
The PodSecurity admission controller, introduced in Kubernetes 1.22, enforces Pod Security Standards at the namespace level.
Question 6: What does the 'privileged' Pod Security Standard level allow?
- Only non-root containers
- The most restricted set of policies
- Unrestricted policies, equivalent to no policy (Correct answer)
- Policies that allow most capabilities except host networking
Correct answer: Unrestricted policies, equivalent to no policy
The 'privileged' level is intentionally unrestricted and allows known privilege escalations, equivalent to running without any pod security enforcement.
Question 7: Which Kubernetes resource type is used to define reusable RBAC permissions that can be scoped to a single namespace?
- ClusterRole
- Role (Correct answer)
- RoleTemplate
- PolicySet
Correct answer: Role
A Role defines a set of permissions within a specific namespace and cannot grant access to cluster-scoped resources.
KCNA Security and RBAC 2
Which Kubernetes object binds a ClusterRole to a user across all namespaces?