Privilege Escalation KCSA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An attacker has gained root access to a worker node. The kubelet is configured with `--authorization-mode=AlwaysAllow`. What is the most direct path to cluster-admin?

   • AUse the node's cloud provider credentials to create a new cluster with admin access.
   • BRead the etcd database directly from the node to extract admin credentials.
   • CUse the kubelet's client certificate to authenticate to the API server and create a cluster-admin RoleBinding.
   • DModify the kubelet configuration to disable authentication and then use the API server.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A cluster administrator is reviewing pod security configurations. They find a pod with the following security context: `allowPrivilegeEscalation: true`, `privileged: false`, and `runAsUser: 0`. The pod runs a web server. What is the primary privilege escalation risk?

   • AThe container can access the host network because `runAsUser: 0` grants host-level networking.
   • BThe container is privileged, allowing direct host access.
   • CThe container can modify the host filesystem because it runs as root.
   • DThe container runs as root, and `allowPrivilegeEscalation: true` permits processes to gain more privileges than the parent process, increasing the risk of a container breakout.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a best practice to prevent privilege escalation in Kubernetes?

   • AUse the same service account for all pods to reduce complexity.
   • BGrant all service accounts cluster-admin permissions to simplify management.
   • CEnforce Pod Security Standards that restrict privileged containers and other dangerous settings.
   • DDisable all security policies to avoid breaking applications.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A cluster has a mix of workloads. The security team wants to enforce a 'baseline' Pod Security Standard on the `dev` namespace and a 'restricted' standard on the `prod` namespace. What is the recommended way to implement this?

   • AUse Pod Security Admission with namespace labels `pod-security.kubernetes.io/enforce=baseline` for `dev` and `pod-security.kubernetes.io/enforce=restricted` for `prod`.
   • BApply a single PodSecurityPolicy that is restrictive enough for both namespaces.
   • CConfigure the kubelet to reject privileged pods only in `prod`.
   • DUse a NetworkPolicy to block privileged pods in `prod`.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An attacker has compromised a node and obtained the kubelet client certificate. The kubelet is configured with `--authorization-mode=Webhook`. The webhook authorizer is configured to allow the kubelet to `create` pods and `get` nodes. What is the most significant privilege escalation path?

   • AThe attacker can modify the kubelet configuration to disable the webhook authorizer.
   • BThe attacker can create a pod that mounts the host filesystem and reads the node's cloud credentials.
   • CThe attacker can directly create a ClusterRoleBinding using the kubelet certificate.
   • DThe attacker can read all secrets in the cluster using the kubelet certificate.
   Reveal Solution Discussion Select an answer first