Privilege Escalation KCSA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A service account `app-sa` is used by an application. The application needs to list pods and read logs. The current ClusterRole grants `get`, `list`, `watch` on `pods` and `get` on `pods/log`. A security review recommends using a Role instead of a ClusterRole. What is the primary benefit of this change?

   • AIt limits the permissions to a single namespace, reducing the blast radius if the token is compromised.
   • BIt automatically rotates the service account token.
   • CIt prevents the service account from being used outside the cluster.
   • DIt grants the service account permission to create new roles.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A pod's service account token is exposed in a public GitHub repository. The token belongs to a service account with `get`, `list`, `watch` on `pods` and `get` on `secrets` in the `default` namespace. What is the most effective immediate mitigation?

   • ARevoke the service account token and rotate any secrets that were accessible.
   • BRestart all pods in the `default` namespace.
   • CDelete the service account and recreate it with the same name.
   • DChange the RBAC permissions to remove `get` on secrets.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary goal of a container breakout attack?

   • ATo gain access to the host node's operating system and potentially other containers or the cluster.
   • BTo modify the container's environment variables to change its behavior.
   • CTo crash the container runtime so that the container stops running.
   • DTo steal the container image from the registry.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a common vector for privilege escalation in a Kubernetes cluster?

   • AA container process exploiting a kernel vulnerability to gain root access on the host node.
   • BA cluster administrator rotating the certificate authority (CA) key.
   • CA user viewing the Kubernetes dashboard without authentication.
   • DA pod using a ConfigMap to store environment variables.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A developer service account `ci-builder` is used by a CI/CD pipeline to deploy applications. The current ClusterRole grants `*` on `pods`, `deployments`, and `services`. A security review finds that the pipeline only needs to create and update deployments in the `dev` namespace. What is the best way to reduce the RBAC risk?

   • ACreate a Role in the `dev` namespace with `get`, `list`, `watch`, `create`, and `update` on `deployments` and bind it to `ci-builder`.
   • BCreate a new ClusterRole with `get`, `list`, `watch`, `create`, and `update` on `deployments` and bind it to `ci-builder`.
   • CBind the existing ClusterRole to a new service account and use that for the pipeline.
   • DKeep the ClusterRole but change the verbs from `*` to `get`, `list`, `create`, and `update`.
   Reveal Solution Discussion Select an answer first