Using Least-Privilege Identity and Access Management CKS Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is a best practice for designing namespaces to support least privilege?

   • AUse a single namespace for all workloads to simplify management
   • BGrant users cluster-admin role so they can access any namespace
   • CCreate separate namespaces for different teams or applications and bind least-privilege Roles within each
   • DUse the default namespace for all resources to avoid configuration overhead
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A microservice needs to read and write ConfigMaps in its namespace, but only during initialization. After startup, it should not have any API access. You need to design a secure solution. What should you do?

   • AUse a single service account with a Role that allows get/list/watch on ConfigMaps, and set the pod's serviceAccountName to it.
   • BUse an initContainer with a dedicated service account that has a Role allowing get/list/watch on ConfigMaps, and run the main container with a service account that has no permissions.
   • CUse a service account with a ClusterRole that allows get/list/watch on ConfigMaps.
   • DGrant the main container's service account full access to ConfigMaps and rely on the application to stop using it after initialization.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which audit log level records the request and response metadata but not the request or response body?

   • AMetadata
   • BRequest
   • CNone
   • DRequestResponse
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   Your organization has a multi-tenant cluster where each tenant has its own namespace. You need to ensure that tenants cannot access or modify resources outside their namespace, including the ability to create RoleBindings that could escalate privileges. What is the most effective control?

   • AUse NetworkPolicies to isolate tenant traffic.
   • BGrant each tenant a ClusterRole with limited permissions.
   • CUse the default service account for all tenants.
   • DUse a Role and RoleBinding for each tenant that grants only the necessary permissions, and do not grant any RBAC-related permissions (e.g., create rolebindings) to tenants.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company runs multiple applications in a single cluster. Each application team should only be able to access its own namespace. You need to design an RBAC strategy that enforces this isolation. What should you do?

   • ACreate a single namespace for all teams and use NetworkPolicies to restrict access.
   • BCreate a separate namespace per team, define a Role for each namespace with the necessary permissions, and bind it to the team's users via a RoleBinding in that namespace.
   • CCreate a ClusterRole per team and bind it via a ClusterRoleBinding to each team's users.
   • DCreate a Role per team in the default namespace and bind it to the team's users.
   Reveal Solution Discussion Select an answer first