Security Questions
Practice questions for Security topic in Kubernetes and Cloud Native Associate. 24 questions covering this domain.
A developer should be able to read Pods only within one namespace, not across the whole cluster. Which RBAC combination is the best fit?
A security team wants to restrict which Pods may communicate with a payment service. Which Kubernetes feature is designed for this?
A namespace enforces the Restricted Pod Security Standard. Which Pod setting would violate that policy for a Linux workload?
A cluster adopts Pod Security Standards. An application Pod needs to mount the host network namespace for performance reasons. Under which Pod Securit...
Which Kubernetes API resource defines a set of permissions (verbs on resources) that can be granted to users or service accounts within a namespace?
A container in production is observed making outbound calls to unexpected external endpoints. The security team wants to prevent future containers in ...
A team wants Pods to meet the Restricted Pod Security Standard. Which option matches that profile?
A support engineer needs broad read only access but must not be able to read Secrets. Which default ClusterRole best matches that requirement?
A RoleBinding in the dev namespace references a ClusterRole named edit. What scope does that grant?
A namespace is enforcing the Baseline Pod Security Standard. Which Pod setting would violate that policy immediately?
A Pod spec explicitly sets seccompProfile to Unconfined in a Baseline namespace. Which statement is correct?
A vendor manifest requests a privileged container under Baseline enforcement. What is the expected outcome?
A cluster uses Pod Security Standards to enforce restricted policies in a namespace. An existing Pod violates the policy (e.g., runs as root) but cont...
A SecurityPolicy denies all egress traffic from a namespace. However, DNS queries from Pods fail to resolve. What misconfiguration allows DNS queries ...
A team uses RBAC to grant a ServiceAccount permission to create Pods in a namespace. They notice the ServiceAccount can also delete Pods. What RBAC me...
A ServiceAccount is used by a Pod. The Pod's token is auto-mounted into /var/run/secrets/kubernetes.io/serviceaccount/token. What happens if the Servi...
A cluster is configured with RBAC. A Pod mounts a ServiceAccount token and uses it to access the Kubernetes API. The Pod attempts to create another Po...
How are Kubernetes Secrets stored in etcd by default unless an administrator enables extra protection?
Why is granting a developer permission to create Pods in a namespace security-sensitive even if the developer cannot list Secrets directly?
A security review flags a privileged troubleshooting Pod running on a worker node. Which official concern makes this especially sensitive?
Sign in to see all 24 questions
Create a free account to browse the questions included with the free plan.