Access Control CKS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   You are setting up authentication for a Kubernetes cluster. You want to use client certificates for a small group of administrators. What must you configure on the API server?

   • ASet --token-auth-file to a file containing the client certificates.
   • BSet --client-ca-file to the CA certificate that signed the client certificates.
   • CSet --authorization-mode=RBAC and create a Role for the administrators.
   • DSet --oidc-issuer-url to the URL of the CA.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How can you prevent Pods from automatically using the default service account in a namespace?

   • ADisable RBAC authorization in the cluster.
   • BSet automountServiceAccountToken: false in the Pod spec or in the service account definition.
   • CSet the namespace's default service account to 'none'.
   • DDelete the default service account from the namespace.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   Your Kubernetes API server is exposed on a public IP address. You want to restrict access to only your office's static IP range (203.0.113.0/24). What is the most effective way to achieve this?

   • ACreate a NetworkPolicy in the cluster that allows ingress to the API server Pod from 203.0.113.0/24.
   • BConfigure the API server with --client-ca-file and only issue certificates to office users.
   • CSet --authorization-mode=RBAC and create a Role that denies access to users from outside the office.
   • DConfigure a firewall rule (e.g., security group) to allow inbound traffic to port 6443 only from 203.0.113.0/24.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which statement correctly describes the relationship between a Role and a RoleBinding in Kubernetes RBAC?

   • AA Role defines permissions, and a RoleBinding grants those permissions to a subject within the same namespace.
   • BA Role and a RoleBinding both define permissions, but only the RoleBinding can be applied across namespaces.
   • CA Role grants permissions to a subject, and a RoleBinding defines the resources the subject can access.
   • DA RoleBinding defines permissions, and a Role grants those permissions to a subject.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A contractor has left the company. Their kubeconfig file, which contains a client certificate and a context for your production cluster, was not revoked. What is the most immediate action you should take to prevent the contractor from accessing the cluster?

   • AChange the context name in the kubeconfig file.
   • BRevoke the client certificate by adding it to the API server's revoked certificate list or by rotating the certificate authority.
   • CDisable the contractor's user account in the IdP.
   • DDelete the contractor's kubeconfig file from their laptop.
   Reveal Solution Discussion Select an answer first