Using Least-Privilege Identity and Access Management CKS Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   Your cluster has audit logging enabled, but you notice that some API requests are not being logged. You need to ensure that all requests from service accounts are logged, especially those that could indicate privilege escalation. What should you do?

   • AUse 'kubectl auth can-i' to check permissions.
   • BReview the audit policy to ensure it captures the relevant verbs and resources, and set the level to 'RequestResponse' for sensitive operations.
   • CEnable audit logging on all nodes.
   • DIncrease the log rotation frequency.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In RBAC, what does the 'verb' field in a Role rule specify?

   • AThe API group of the resource
   • BThe name of the resource to access
   • CThe operation allowed, such as get, list, watch, create, update, or delete
   • DThe namespace in which the rule applies
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which field in a Role rule specifies the API group of the resource?

   • Averbs
   • Bresources
   • Cnamespaces
   • DapiGroups
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the purpose of creating a dedicated service account for a pod?

   • ATo replace the need for RBAC policies
   • BTo allow the pod to access the Kubernetes API without authentication
   • CTo automatically grant the pod cluster-admin privileges
   • DTo provide the pod with a unique identity that can be granted specific permissions
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   You are investigating a potential security incident where a service account may have been used to delete pods in a namespace. You need to confirm whether the deletion was performed by that service account and identify the exact time. What should you examine?

   • AThe pod's events to see if a deletion event is recorded.
   • BThe audit logs for delete pod requests, filtering by the service account's username.
   • CThe service account's token to see if it was used.
   • DThe RoleBinding to see if the service account has delete permissions.
   Reveal Solution Discussion Select an answer first