KCNA Security and RBAC 3

Question 1

What is the purpose of the `securityContext` field at the container level in a Pod spec?

Accepted Answer

To set security settings like runAsUser and allowPrivilegeEscalation

Answer

The container-level `securityContext` sets security parameters such as runAsUser, runAsNonRoot, readOnlyRootFilesystem, and allowPrivilegeEscalation.

Question 2

Which command would you use to check what permissions a specific ServiceAccount has in Kubernetes?

Accepted Answer

kubectl auth can-i --as=system:serviceaccount::

Answer

The `kubectl auth can-i` command with the `--as` flag lets you impersonate a ServiceAccount to verify its permissions.

Question 3

What is a 'subject' in the context of Kubernetes RBAC?

Accepted Answer

A user, group, or ServiceAccount that a RoleBinding targets

Answer

In RBAC, subjects are the entities (users, groups, or ServiceAccounts) that are granted permissions via RoleBindings or ClusterRoleBindings.

Question 4

Which Kubernetes feature allows you to restrict egress and ingress traffic to/from Pods?

Accepted Answer

NetworkPolicy

Answer

NetworkPolicy resources define rules that control the allowed ingress and egress traffic for Pods based on labels and namespaces.

Question 5

What does the `runAsNonRoot: true` setting in a Pod's securityContext enforce?

Accepted Answer

Prevents the container from running if its image would run as root

Answer

Setting `runAsNonRoot: true` causes the kubelet to validate that the container does not run as UID 0 (root), rejecting it if it would.

(KCNA) Kubernetes and Cloud Native Associate Practice Test