Access Control CKS Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why is the principle of least privilege important in Kubernetes RBAC?

   • AIt reduces the attack surface by limiting the actions a compromised user or service account can perform.
   • BIt simplifies RBAC configuration by using the same permissions for all users.
   • CIt ensures that all users have full access to all resources for easier debugging.
   • DIt is required by Kubernetes to enable RBAC authorization mode.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the purpose of OIDC authentication in Kubernetes?

   • ATo replace RBAC authorization.
   • BTo provide anonymous access to the API server.
   • CTo encrypt all API server traffic.
   • DTo allow users to authenticate using an external identity provider, such as a corporate SSO system.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a valid method to restrict access to the Kubernetes API server?

   • ASetting the API server to listen on all network interfaces.
   • BUsing a firewall to allow only specific IP addresses to reach the API server port.
   • CRemoving all authentication methods.
   • DDisabling TLS on the API server.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A Pod in the 'backend' namespace runs a batch job that needs to authenticate to the Kubernetes API once at startup. The Pod's ServiceAccount token is long-lived. You want to reduce the risk of token theft. What is the most effective configuration change?

   • AConfigure the Pod to use a projected service account token with a short expiration time and set an audience.
   • BSet automountServiceAccountToken: false on the Pod and manually mount the token from a Secret.
   • CUse the 'default' ServiceAccount but set automountServiceAccountToken: false on the Pod.
   • DCreate a new ServiceAccount for the Pod and bind it to a Role with minimal permissions.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary difference between a ClusterRole and a Role in Kubernetes RBAC?

   • AA ClusterRole can grant permissions on cluster-scoped resources and across all namespaces, while a Role is limited to a single namespace.
   • BA ClusterRole can only be bound by a ClusterRoleBinding, while a Role can only be bound by a RoleBinding.
   • CA ClusterRole is used only for cluster-admin tasks, while a Role is used for application-level permissions.
   • DA ClusterRole grants permissions to all users in the cluster, while a Role grants permissions to a single user.
   Reveal Solution Discussion Select an answer first