KCNA Security and RBAC 4

Question 1

Which Kubernetes component is responsible for authenticating requests to the API server?

Accepted Answer

kube-apiserver

Answer

The kube-apiserver handles authentication of all API requests using configured authenticator plugins (certificates, tokens, OIDC, etc.).

Question 2

What is the Kubernetes API group for RBAC resources like Role and RoleBinding?

Accepted Answer

rbac.authorization.k8s.io

Answer

RBAC resources (Role, ClusterRole, RoleBinding, ClusterRoleBinding) belong to the `rbac.authorization.k8s.io` API group.

Question 3

What happens when `allowPrivilegeEscalation: false` is set in a container's securityContext?

Accepted Answer

The container cannot gain more privileges than its parent process

Answer

Setting `allowPrivilegeEscalation: false` prevents a process from gaining more privileges than its parent, blocking setuid and sudo-like escalations.

Question 4

Which Pod Security Standard level is recommended for most workloads requiring some relaxation but still security-conscious?

Accepted Answer

baseline

Answer

The 'baseline' level prevents known privilege escalations while being minimally restrictive, making it suitable for most general workloads.

Question 5

In Kubernetes, what are 'non-resource URLs' in RBAC context?

Accepted Answer

API endpoints not tied to a Kubernetes resource object, such as /healthz

Answer

Non-resource URLs are API server endpoints like /healthz, /metrics, and /version that don't correspond to a Kubernetes API resource object.

(KCNA) Kubernetes and Cloud Native Associate Practice Test