KCNA Security and RBAC 5 — Questions and Answers
Question 1: What is the purpose of Kubernetes Secrets in relation to security?
- To define RBAC policies for sensitive data
- To store sensitive data like passwords and tokens separately from Pod specs (Correct answer)
- To encrypt etcd data at rest automatically
- To manage TLS certificates for the API server
Correct answer: To store sensitive data like passwords and tokens separately from Pod specs
Kubernetes Secrets store sensitive information (passwords, tokens, keys) separately from application code and Pod specs to reduce exposure.
Question 2: Which securityContext field can be used to drop Linux capabilities from a container?
- capabilities.remove
- capabilities.drop (Correct answer)
- capDrop
- removeCapabilities
Correct answer: capabilities.drop
The `capabilities.drop` field in a container's securityContext specifies a list of Linux capabilities to remove from the container.
Question 3: What is the role of an Admission Controller in Kubernetes security?
- Authenticates user credentials for API access
- Intercepts API requests after authentication/authorization to validate or mutate them (Correct answer)
- Manages network policies between Pods
- Encrypts Secrets before storing them in etcd
Correct answer: Intercepts API requests after authentication/authorization to validate or mutate them
Admission controllers intercept API requests after authentication and authorization, and can validate, mutate, or reject requests before the object is persisted.
Question 4: Which RBAC verb allows a user to watch for real-time changes to a resource?
- observe
- stream
- watch (Correct answer)
- subscribe
Correct answer: watch
The 'watch' verb in RBAC allows subjects to receive streaming updates when a resource changes, used by controllers and kubectl watch.
Question 5: What does the 'restricted' Pod Security Standard level require that 'baseline' does not?
- Prevents running privileged containers
- Requires running as non-root and dropping all capabilities (Correct answer)
- Disables host port access
- Prevents use of hostPath volumes
Correct answer: Requires running as non-root and dropping all capabilities
The 'restricted' level enforces additional hardening including running as non-root, dropping ALL capabilities, and requiring seccomp profiles.
Question 6: In Kubernetes RBAC, which built-in ClusterRole provides read-only access to most resources?
- system:viewer
- view (Correct answer)
- read-only
- system:reader
Correct answer: view
The built-in 'view' ClusterRole grants read-only access (get, list, watch) to most namespaced resources but not to Secrets or RBAC resources.
Question 7: What is the primary risk of using `hostPID: true` in a Pod spec?
- It prevents the Pod from scaling
- It allows the container to see and interact with all host processes (Correct answer)
- It grants the Pod cluster-admin RBAC permissions
- It exposes the Pod's network to the host
Correct answer: It allows the container to see and interact with all host processes
Setting `hostPID: true` allows a Pod to share the host's process ID namespace, enabling it to see and potentially signal all processes running on the node.
KCNA Security and RBAC 5
What is the purpose of Kubernetes Secrets in relation to security?