Kubernetes Container Orchestration Security and RBAC 5

Question 1

What does the Kubernetes API server do when it receives a request from a pod's ServiceAccount that lacks RBAC permissions?

Accepted Answer

Returns a 403 Forbidden response

Answer

When a request is authenticated but not authorized by RBAC, the API server returns HTTP 403 Forbidden.

Question 2

Which Kubernetes object should you use to restrict a pod from mounting the host's /etc/passwd file?

Accepted Answer

PodSecurityPolicy or PodSecurity admission

Answer

PodSecurityPolicy (or the newer PodSecurity admission controller) can restrict hostPath volume mounts and prevent access to sensitive host paths.

Question 3

What is the purpose of the 'imagePullSecrets' field in a Pod spec?

Accepted Answer

Provides credentials to pull images from a private container registry

Answer

imagePullSecrets references Secret objects containing credentials that the kubelet uses to authenticate with a private image registry.

Question 4

Which Linux capability should be dropped to prevent a container from performing raw packet manipulation?

Accepted Answer

CAP_NET_RAW

Answer

CAP_NET_RAW allows a process to use raw sockets for packet crafting; dropping it prevents network-based attacks like ARP spoofing.

Question 5

What is 'RBAC impersonation' in Kubernetes and what risk does it pose?

Accepted Answer

A privilege that allows a user to act as another user, group, or ServiceAccount

Answer

RBAC impersonation (the 'impersonate' verb) lets a user make API requests as another identity, which can be exploited for privilege escalation if misconfigured.

Kubernetes Container Orchestration Practice Test

Kubernetes Container Orchestration Practice Test

Kubernetes Container Orchestration Security and RBAC 5