Using Least-Privilege Identity and Access Management CKS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a common RBAC misconfiguration that can lead to privilege escalation?

   • ACreating a ClusterRole with get and list permissions on pods
   • BUsing a RoleBinding to bind a Role to a service account
   • CGranting a user read-only access to their own namespace
   • DGranting a user the ability to create pods in the kube-system namespace
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of a RoleBinding?

   • ATo create a new service account
   • BTo restrict access to a namespace
   • CTo grant a Role's permissions to a user, group, or service account within a namespace
   • DTo define a set of permissions for a namespace
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which RBAC permission could allow a user to escalate privileges by creating a binding to a privileged role?

   • AThe ability to view audit logs
   • BThe ability to list pods in a namespace
   • CThe ability to create RoleBindings or ClusterRoleBindings
   • DThe ability to delete deployments
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the difference between a Role and a ClusterRole?

   • AA Role grants permissions to users, while a ClusterRole grants permissions to service accounts
   • BA Role is used for pods, while a ClusterRole is used for nodes
   • CA Role is namespaced, while a ClusterRole is cluster-scoped
   • DA Role is read-only, while a ClusterRole allows write operations
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which Kubernetes object defines a set of permissions for a specific namespace?

   • ARole
   • BClusterRole
   • CRoleBinding
   • DServiceAccount
   Reveal Solution Discussion Select an answer first