Kubernetes Security Fundamentals

Under the Pod Security Standards, a developer attempts to deploy a pod with 'privileged: true' in a namespace labeled with 'pod-security.kubernetes.io/enforce=baseline'. What will happen?

You need to restrict network traffic so that only pods with the label 'tier=frontend' can communicate with pods labeled 'tier=backend' in the same namespace. Which Kubernetes resource should you create?

You are auditing a Kubernetes cluster and notice that a specific ServiceAccount has been granted the 'impersonate' verb on users. What security risk does this permission introduce?

An application pod requires read access to secrets in the 'production' namespace. You need to bind a pre-existing ClusterRole named 'secret-reader' to a service account named 'app-sa' in that namespace. Which RBAC resource accomplishes this?

You have deployed a NetworkPolicy in a namespace that selects backend pods, defining an 'ingress' rule with a 'from' block. No other NetworkPolicies exist in the namespace. What is the default behavior for traffic from pods not matched by the 'from' selector?

A security engineer wants to apply Pod Security Standards globally across an entire namespace using the modern built-in admission mechanism. Which approach should be used?

Your cluster uses the Pod Security admission controller with the 'restricted' profile enforced. A legacy application pod fails to start because it requires running as root (runAsNonRoot: false). How should you handle this securely without disabling the standard?

A cluster administrator needs to grant read-only access to pods within the 'development' namespace using Kubernetes RBAC. Which resource kind should be used to define the permissions?

Which RBAC verb allows a user to delete an existing resource in a Kubernetes namespace?

An administrator needs to store sensitive database credentials securely so that they can be mounted as environment variables inside a specific pod. Which Kubernetes object is designed for this purpose?

By default, how are Kubernetes Secrets stored in etcd when created without additional encryption-at-rest configurations?

You are deploying a ValidatingWebhookConfiguration to inspect incoming pod creations. What happens if the webhook fails and the 'failurePolicy' in the webhook configuration is set to 'Fail'?

You want to enable encryption at rest for Kubernetes Secrets in your cluster using an external KMS (Key Management Service) provider. Which component on the control plane reads the EncryptionConfiguration file and handles this encryption?

You want to write a NetworkPolicy that allows backend pods to communicate with an external database located outside the cluster at IP address '203.0.113.50'. Which NetworkPolicy section must you configure?

When configuring a MutatingWebhookConfiguration, you notice that mutating webhooks are executed before validating webhooks. Why is this execution order critical for security and consistency?

An administrator wants to prevent users from creating pods that mount the host network ('hostNetwork: true'). Which tool or feature is best suited to enforce this restriction natively across the cluster?

You are troubleshooting a custom controller that fails to read ConfigMaps in the 'kube-system' namespace despite having a ClusterRole bound via a ClusterRoleBinding. What is the most likely reason for this failure?

An auditor notices that a secret is mounted as a volume in a pod. Where is this secret stored on the worker node filesystem by default?

Which of the following describes a recommended security practice when managing Kubernetes Secrets?

You have configured a NetworkPolicy with an egress rule targeting a specific CIDR block. However, DNS resolution for external domain names fails from within the pods selected by this policy. What is the most likely cause?

What is the primary function of the 'automountServiceAccountToken: false' setting in a Pod specification?

An administrator wants to ensure that no container in a specific namespace runs with a root User ID (UID 0). Which security context setting should be enforced?

You are reviewing admission webhook configurations and notice that timeoutSeconds is set to 3 seconds for a critical validation webhook. If the webhook server takes 4 seconds to respond, what does the API server do when failurePolicy is 'Ignore'?

What is the purpose of the Pod Security Standards 'baseline' profile?

Which TWO of the following are valid Kubernetes RBAC rule subjects that can be bound to roles or cluster roles?

Which THREE of the following are official Pod Security Standard enforcement levels recognized by Kubernetes?

You want to ensure that a newly created Role in namespace 'finance' cannot be modified or deleted by regular developers who have edit permissions. Which RBAC feature or design prevents unauthorized privilege escalation through Role manipulation?

An application pod needs to access the Kubernetes API server securely. How does Kubernetes authenticate the pod by default when it communicates with the API server?

Which TWO components are involved in configuring and processing admission webhooks in a Kubernetes cluster?

Which TWO types of selectors can be used within a Kubernetes NetworkPolicy ingress rule to specify allowed traffic sources?

Which THREE methods can be used to inject Kubernetes Secrets into a running pod?

Which TWO actions can be performed using Kubernetes RBAC rules?

Which THREE fields are required when defining an egress rule in a Kubernetes NetworkPolicy?

Which TWO tools or built-in Kubernetes features are used to secure container privileges and behaviors?

Which TWO mechanisms help secure Kubernetes Secrets against unauthorized access or exposure?

Which THREE conditions must be met for a RoleBinding to successfully grant permissions to a ServiceAccount?

Which THREE features are enforced or verified by the Kubernetes 'restricted' Pod Security Standard profile?

Which TWO statements are true regarding Kubernetes NetworkPolicy default behaviors?

An administrator needs to grant read-only access to Pods specifically within the 'development' namespace to a new user. Which RBAC configuration correctly scopes this permission?

A security auditor notices that a deployment running in the 'production' namespace is violating the Restricted Pod Security Standard because containers are running as root. How can you enforce compliance using Pod Security Admission?

An application pod requires access to the Kubernetes API to list other pods. To follow secure practices, you create a dedicated ServiceAccount and bind a custom Role to it. How should you configure the Pod specification to prevent the default service account token from being automatically mounted?

An external identity provider (OIDC) is integrated with your Kubernetes cluster. You want to restrict a group named 'contractors' so they can only view pods in the 'staging' namespace. Which configuration correctly maps this requirement?

Your team is storing sensitive database credentials in Kubernetes Secrets. A security review reveals that base64 encoding does not provide encryption at rest. What mechanism should you enable to ensure Secrets are encrypted when stored in etcd?

You are troubleshooting a pod that fails to start because it attempts to run a container with privileges. The cluster enforces the 'baseline' Pod Security Standard. Which container configuration will cause the Pod Security Admission controller to reject the pod?

You need to isolate a database pod so that only pods with the label 'tier=frontend' within the same namespace can connect to it on port 5432. Which NetworkPolicy resource configuration achieves this?

You need to ensure that a Secret containing database credentials cannot be read by anyone except the database application controller, even if they have broad RBAC read permissions in the namespace. Which feature should you consider?

An enterprise cluster requires that all incoming NetworkPolicies must default to denying all traffic unless explicitly allowed. A developer creates a namespace but forgets to apply any policies. What is the default behavior of Kubernetes regarding inter-pod traffic within a namespace when no NetworkPolicies are present?

An administrator wishes to inspect which admission controllers are currently enabled in a running Kubernetes cluster. Where is this typically configured in a stacked control plane?

A security engineer configures a ValidatingWebhookConfiguration to intercept pod creations. The webhook service goes down due to a network partition. What happens to incoming pod creation requests by default if the webhook 'failurePolicy' is set to 'Fail'?

A CI/CD pipeline service account needs permission to create Deployments and Services across multiple namespaces, but should not have cluster-admin privileges. What is the most secure way to grant these permissions?

An application pod needs to mount a Secret as environment variables. Which section of the Pod manifest should be configured to achieve this securely?

An administrator wishes to create a NetworkPolicy that allows incoming traffic from any pod in any namespace, provided those pods have the label 'environment=production'. How should the NetworkPolicy 'ingress' rule be structured?

You need to grant a monitoring tool permission to perform HTTP GET requests against health endpoints across all pods in the cluster, but no other API access. How should you define the RBAC rules?

You are auditing a cluster and find a pod that mounts the host's root filesystem directly into the container. Which Pod Security Standard rule does this violate?

A developer accidentally committed plain-text database passwords into a public Git repository. The password was stored in a Kubernetes Secret manifest. What immediate remediation step should be taken regarding the Secret?

Which TWO of the following actions are considered best practices for securing Kubernetes Secrets? (Choose TWO)

Which TWO components are core parts of the Kubernetes authorization architecture? (Choose TWO)

Which TWO entities can be assigned RBAC permissions in a Kubernetes cluster? (Choose TWO)

When configuring Pod Security Standards on a namespace, which THREE security restrictions are enforced by the 'restricted' profile that are NOT enforced by the 'baseline' profile? (Choose THREE)

Which THREE fields are required when defining a standard Kubernetes NetworkPolicy resource? (Choose THREE)

Which THREE options represent valid ways to supply sensitive data to a container using Kubernetes native features? (Choose THREE)

Which TWO statements accurately describe how Kubernetes admission controllers function? (Choose TWO)

Which THREE components are involved when an external client authenticates to the Kubernetes API server using OpenID Connect (OIDC)? (Choose THREE)

An administrator needs to restrict access so that a specific ServiceAccount in the production namespace can only list pods, but cannot delete or modify them. Which core Kubernetes API resource should be configured to achieve this using RBAC?

A cluster operator is enforcing the Pod Security Standards "restricted" profile across a namespace. A developer attempts to deploy a container running as root (runAsUser: 0). What will happen during the admission phase?

An application running in a pod needs to securely consume a database password without storing it in plaintext within the container image or deployment manifest. Which native Kubernetes resource is best suited for storing this sensitive key-value data?

A cluster administrator needs to intercept and reject any resource creation requests that do not include a mandatory security-context label. Which admission controller type should be implemented?

A security engineer wants to ensure that a pod cannot escalate its privileges to gain root access on the node. Which securityContext setting should be configured to prevent privilege escalation?

Which TWO of the following statements are true regarding Kubernetes Secrets and their security posture by default?

An auditor notices that default ServiceAccounts in newly created namespaces are automatically mounting their API tokens into pods, creating an unnecessary attack surface. How can an administrator permanently disable automatic token mounting for all new service accounts in a specific namespace?

An administrator is hardening a Kubernetes cluster against container breakout vulnerabilities and node compromise. Which THREE security practices should be implemented?

Which TWO mechanisms are used by Kubernetes admission controllers to enforce security policies during the API request lifecycle?