Using Least-Privilege Identity and Access Management CKS Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the core principle of least-privilege permission assignment in Kubernetes RBAC?

   • AGrant permissions based on the user's seniority in the organization.
   • BGrant all permissions by default and remove them as needed.
   • CGrant the same permissions to all ServiceAccounts in a namespace.
   • DGrant only the minimum permissions required for a subject to perform its function.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which RBAC object should be used to grant a user permission to list pods across all namespaces in the cluster?

   • ARoleBinding
   • BServiceAccount
   • CClusterRole
   • DRole
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A pod only needs to read ConfigMaps in its namespace. Which RBAC configuration follows the least-privilege principle?

   • AA Role granting get, list, and watch on configmaps in the pod's namespace, bound to the pod's ServiceAccount.
   • BA ClusterRole granting all permissions on all resources, bound to the pod's ServiceAccount.
   • CA Role granting create, delete, and update on configmaps in the pod's namespace.
   • DA ClusterRole granting get, list, and watch on configmaps, bound cluster-wide.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the recommended practice regarding the default ServiceAccount in a namespace?

   • AUse it for all workloads to simplify configuration.
   • BDelete it from the namespace.
   • CDisable it or limit its permissions and avoid using it for workloads when least privilege is required.
   • DGrant it cluster-admin permissions for easier management.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of a Kubernetes ServiceAccount?

   • ATo manage node-level permissions for kubelet.
   • BTo provide an identity for a pod or workload to authenticate to the Kubernetes API.
   • CTo define network policies for pod-to-pod communication.
   • DTo store sensitive data such as passwords and API keys.
   Reveal Solution Discussion Select an answer first