A pod needs to authenticate to the Kubernetes API to list pods in its own namespace. The team wants to avoid using the default service account. What should they do?

Use a security context to set the service account for the pod.

Create a new service account, bind it to a Role that allows list pods in the namespace, and set the pod's `serviceAccountName` to the new account.

Create a ClusterRoleBinding that grants list pods to the default service account.

Set the pod's `serviceAccountName` to `default` and rely on the default permissions.

A pod runs a container that needs to bind to a privileged port (e.g., port 80) but should not run as root. What should be configured in the security context?

Set `allowPrivilegeEscalation: false`.

Set `runAsNonRoot: true` and use a container image that can bind to port 80 without root privileges.

A security team wants to ensure that only images signed by their organization's key can be deployed to the cluster. They have a policy engine installed. What should they configure to enforce this?

Create a Secret to store the signing key and mount it in the kubelet.

Use a NetworkPolicy to block traffic from unsigned images.

Configure an admission controller to verify image signatures before allowing pod creation.

Set the `imagePullPolicy` to `Always` in the pod spec.

Kubernetes and Cloud Native Associate (KCNA)

Domain 1Objective 4

Security KCNA Practice Questions (Page 4)

Part of the Kubernetes Fundamentals domain, which accounts for 44% of the KCNA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~15–26 in this domain), expect 3–4 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

8concepts

44%of the exam

Questions 16–20

16application · medium
A pod needs to authenticate to the Kubernetes API to list pods in its own namespace. The team wants to avoid using the default service account. What should they do?
Select an answer first
17application · medium
A pod runs a container that needs to bind to a privileged port (e.g., port 80) but should not run as root. What should be configured in the security context?
Select an answer first
18application · medium
A security team wants to ensure that only images signed by their organization's key can be deployed to the cluster. They have a policy engine installed. What should they configure to enforce this?
Select an answer first
19foundation · easy
Which field in a NetworkPolicy spec defines the direction of traffic being controlled?
Select an answer first
20foundation · easy
Which field in a container's securityContext grants the container additional Linux capabilities beyond the default set?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCNA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCNA” is a trademark of its owner, used for identification only.

Security KCNA Practice Questions (Page 4)

Questions 16–20

A pod needs to authenticate to the Kubernetes API to list pods in its own namespace. The team wants to avoid using the default service account. What should they do?

A pod runs a container that needs to bind to a privileged port (e.g., port 80) but should not run as root. What should be configured in the security context?

A security team wants to ensure that only images signed by their organization's key can be deployed to the cluster. They have a policy engine installed. What should they configure to enforce this?

Which field in a NetworkPolicy spec defines the direction of traffic being controlled?

Which field in a container's securityContext grants the container additional Linux capabilities beyond the default set?

Keep studying — Kubernetes Fundamentals