Using Least-Privilege Identity and Access Management CKS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A developer requests access to create pods in the 'dev' namespace. You create a RoleBinding that grants 'edit' access to the developer in that namespace. Later, you discover the developer can create RoleBindings in the 'dev' namespace. What is the likely cause?

   • AThe developer is a cluster-admin.
   • BThe developer used a service account with elevated permissions.
   • CThe 'edit' ClusterRole includes permissions to create RoleBindings, allowing the developer to grant themselves additional permissions.
   • DThe RoleBinding was created in the wrong namespace.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A pod needs to access the Kubernetes API to list pods in its own namespace. You want to grant this access without giving the pod any permissions outside that namespace. What should you do?

   • AUse the default service account and create a ClusterRoleBinding granting get/list on pods.
   • BCreate a ClusterRole with get/list on pods and bind it to the pod's namespace via a RoleBinding.
   • CCreate a dedicated service account, a Role in the namespace with get/list on pods, and a RoleBinding binding that Role to the service account. Set the pod's serviceAccountName to that account.
   • DSet the pod's serviceAccountName to a service account that has a ClusterRoleBinding granting get/list on pods.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the core purpose of the principle of least privilege in a Kubernetes cluster?

   • ATo ensure every user has the same level of access for simplicity
   • BTo grant each subject only the permissions required to perform its legitimate tasks
   • CTo restrict all access to cluster administrators only
   • DTo automatically revoke permissions after a set time period
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How does namespace design help with least-privilege access?

   • ANamespaces automatically restrict all access to resources within them
   • BNamespaces provide network isolation by default
   • CNamespaces are required for RBAC to work
   • DNamespaces allow you to group resources and apply RBAC policies per namespace, limiting access to only what is needed
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A DevOps team deploys a CronJob that needs to list and get Secrets in the 'prod' namespace. The team currently uses the default service account for the CronJob. You must ensure the job runs with minimal permissions. What should you do?

   • ACreate a ClusterRole granting get/list on secrets and bind it to the default service account in the 'prod' namespace.
   • BCreate a dedicated service account, bind a Role granting get/list on secrets in 'prod' to it via a RoleBinding, and set the CronJob's serviceAccountName to that account.
   • CSet the CronJob's serviceAccountName to 'default' and create a RoleBinding in 'prod' granting get/list on secrets to the default service account.
   • DModify the default service account in 'prod' to include the necessary permissions by adding a RoleBinding to it.
   Reveal Solution Discussion Select an answer first