Kubernetes Container Orchestration Security and RBAC 3

Question 1

What is the default behavior of a Kubernetes Secret in terms of encryption at rest?

Accepted Answer

Secrets are stored as base64-encoded data in etcd without encryption by default

Answer

By default, Kubernetes Secrets are only base64-encoded (not encrypted) in etcd; encryption at rest must be explicitly configured.

Question 2

Which admission controller must be enabled for PodSecurityPolicy enforcement?

Accepted Answer

PodSecurityPolicy

Answer

The PodSecurityPolicy admission controller must be enabled in the API server flags for PSPs to be enforced.

Question 3

What does the 'allowPrivilegeEscalation: false' setting do in a container's securityContext?

Accepted Answer

Prevents the container process from gaining more privileges than its parent

Answer

allowPrivilegeEscalation: false ensures a child process cannot gain more privileges than the process that started it.

Question 4

In Kubernetes RBAC, which verb allows a user to watch for changes to resources?

Accepted Answer

watch

Answer

The 'watch' verb allows a user to receive streaming notifications of changes to resources via a watch connection.

Question 5

What is a ServiceAccount token's primary purpose in Kubernetes?

Accepted Answer

Authenticating pods to the Kubernetes API server

Answer

ServiceAccount tokens are mounted into pods to allow them to authenticate to the Kubernetes API server.

Kubernetes Container Orchestration Practice Test