You need to ensure that no pod in the cluster can be created with the 'privileged: true' security context. You have already configured RBAC so that only cluster admins can create pods. What should you do to enforce this requirement at the API server level?

Set 'automountServiceAccountToken: false' on all pods.

Create a NetworkPolicy that blocks traffic from privileged pods.

Enable the 'PodSecurity' admission controller and apply a 'restricted' Pod Security Standard to all namespaces.

Modify the RBAC roles to deny the 'create' verb on pods for all users.

You are migrating a legacy application to Kubernetes. The application requires a privileged container to access a host device. Your security team has mandated that all new namespaces must enforce the 'restricted' Pod Security Standard. However, this legacy application cannot run under the 'restricted' standard. What is the best approach?

Disable the PodSecurity admission controller for the entire cluster.

Apply the 'restricted' standard to all namespaces and use an admission controller to allow the legacy pods.

Modify the legacy application to run without privileged mode.

Place the legacy application in a separate namespace that is labeled with the 'privileged' Pod Security Standard, and keep all other namespaces at 'restricted'.

What is the role of an admission controller?

To intercept requests and validate or mutate them

You have a batch job that needs to read a Kubernetes Secret via the API server. You want to give this job a dedicated identity that has only the permissions to read that specific Secret. You have created a ServiceAccount named 'secret-reader' and a Role that grants 'get' on the Secret. What else must you do?

Set 'automountServiceAccountToken: true' in the job's pod spec.

Add the 'secret-reader' ServiceAccount to the 'system:masters' group.

Create a RoleBinding in the same namespace as the Secret, binding the 'secret-reader' ServiceAccount to the Role.

Create a ClusterRoleBinding binding the 'secret-reader' ServiceAccount to the Role.

Certified Kubernetes Application Developer (CKAD)

Domain 4Objective 2

Kubernetes Security CKAD Practice Questions (Page 1)

Part of the Application Environment, Configuration and Security domain, which accounts for 25% of the CKAD exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 3–5 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

12concepts

25%of the exam

Questions 1–5

1application · medium
You need to ensure that no pod in the cluster can be created with the 'privileged: true' security context. You have already configured RBAC so that only cluster admins can create pods. What should you do to enforce this requirement at the API server level?
Select an answer first
2expert · hard
You are migrating a legacy application to Kubernetes. The application requires a privileged container to access a host device. Your security team has mandated that all new namespaces must enforce the 'restricted' Pod Security Standard. However, this legacy application cannot run under the 'restricted' standard. What is the best approach?
Select an answer first
3foundation · easy
What is the role of an admission controller?
Select an answer first
4application · medium
You have a batch job that needs to read a Kubernetes Secret via the API server. You want to give this job a dedicated identity that has only the permissions to read that specific Secret. You have created a ServiceAccount named 'secret-reader' and a Role that grants 'get' on the Secret. What else must you do?
Select an answer first
5foundation · easy
Which Pod Security Standard is the most restrictive?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKAD” is a trademark of its owner, used for identification only.

Kubernetes Security CKAD Practice Questions (Page 1)

Questions 1–5

You need to ensure that no pod in the cluster can be created with the 'privileged: true' security context. You have already configured RBAC so that only cluster admins can create pods. What should you do to enforce this requirement at the API server level?

What is the role of an admission controller?

Which Pod Security Standard is the most restrictive?

Keep studying — Application Environment, Configuration and Security