KCNA Security and RBAC 5

Question 1

What is the purpose of Kubernetes Secrets in relation to security?

Accepted Answer

To store sensitive data like passwords and tokens separately from Pod specs

Answer

Kubernetes Secrets store sensitive information (passwords, tokens, keys) separately from application code and Pod specs to reduce exposure.

Question 2

Which securityContext field can be used to drop Linux capabilities from a container?

Accepted Answer

capabilities.drop

Answer

The `capabilities.drop` field in a container's securityContext specifies a list of Linux capabilities to remove from the container.

Question 3

What is the role of an Admission Controller in Kubernetes security?

Accepted Answer

Intercepts API requests after authentication/authorization to validate or mutate them

Answer

Admission controllers intercept API requests after authentication and authorization, and can validate, mutate, or reject requests before the object is persisted.

Question 4

Which RBAC verb allows a user to watch for real-time changes to a resource?

Accepted Answer

watch

Answer

The 'watch' verb in RBAC allows subjects to receive streaming updates when a resource changes, used by controllers and kubectl watch.

Question 5

What does the 'restricted' Pod Security Standard level require that 'baseline' does not?

Accepted Answer

Requires running as non-root and dropping all capabilities

Answer

The 'restricted' level enforces additional hardening including running as non-root, dropping ALL capabilities, and requiring seccomp profiles.

(KCNA) Kubernetes and Cloud Native Associate Practice Test

(KCNA) Kubernetes and Cloud Native Associate Practice Test

KCNA Security and RBAC 5