KCNA Security and RBAC 2

Question 1

Which Kubernetes object binds a ClusterRole to a user across all namespaces?

Accepted Answer

ClusterRoleBinding

Answer

A ClusterRoleBinding grants the permissions defined in a ClusterRole to a subject across all namespaces in the cluster.

Question 2

What is the default behavior for a Pod that does not specify a ServiceAccount?

Accepted Answer

The 'default' ServiceAccount in its namespace is used

Answer

When a Pod does not specify a ServiceAccount, it automatically uses the 'default' ServiceAccount in its namespace.

Question 3

Which field in a Pod spec controls whether the ServiceAccount token is auto-mounted?

Accepted Answer

automountServiceAccountToken

Answer

The `automountServiceAccountToken` field in the Pod spec (or ServiceAccount spec) controls whether the token is automatically mounted.

Question 4

In Kubernetes RBAC, what does a 'verb' represent in a PolicyRule?

Accepted Answer

The action allowed on a resource (e.g., get, list, delete)

Answer

Verbs in RBAC PolicyRules represent HTTP-method-like actions such as get, list, watch, create, update, patch, and delete.

Question 5

Which admission controller is responsible for enforcing Pod Security Standards?

Accepted Answer

PodSecurity

Answer

The PodSecurity admission controller, introduced in Kubernetes 1.22, enforces Pod Security Standards at the namespace level.

(KCNA) Kubernetes and Cloud Native Associate Practice Test