Kubernetes Security Fundamentals

Which TWO mechanisms help secure Kubernetes Secrets against unauthorized access or exposure?

Which TWO tools or built-in Kubernetes features are used to secure container privileges and behaviors?

An administrator needs to restrict access so that a specific ServiceAccount in the production namespace can only list pods, but cannot delete or modify them. Which core Kubernetes API resource should be configured to achieve this using RBAC?

Which THREE methods can be used to inject Kubernetes Secrets into a running pod?

By default, how are Kubernetes Secrets stored in etcd when created without additional encryption-at-rest configurations?

Which THREE of the following are official Pod Security Standard enforcement levels recognized by Kubernetes?

Which TWO actions can be performed using Kubernetes RBAC rules?

You want to ensure that a newly created Role in namespace 'finance' cannot be modified or deleted by regular developers who have edit permissions. Which RBAC feature or design prevents unauthorized privilege escalation through Role manipulation?

Which THREE fields are required when defining a standard Kubernetes NetworkPolicy resource? (Choose THREE)

A security engineer wants to ensure that a pod cannot escalate its privileges to gain root access on the node. Which securityContext setting should be configured to prevent privilege escalation?

An administrator needs to store sensitive database credentials securely so that they can be mounted as environment variables inside a specific pod. Which Kubernetes object is designed for this purpose?

What is the purpose of the Pod Security Standards 'baseline' profile?

You want to write a NetworkPolicy that allows backend pods to communicate with an external database located outside the cluster at IP address '203.0.113.50'. Which NetworkPolicy section must you configure?

Which TWO statements accurately describe how Kubernetes admission controllers function? (Choose TWO)

An administrator needs to grant read-only access to Pods specifically within the 'development' namespace to a new user. Which RBAC configuration correctly scopes this permission?

You need to restrict network traffic so that only pods with the label 'tier=frontend' can communicate with pods labeled 'tier=backend' in the same namespace. Which Kubernetes resource should you create?

Which THREE components are involved when an external client authenticates to the Kubernetes API server using OpenID Connect (OIDC)? (Choose THREE)

Which TWO of the following statements are true regarding Kubernetes Secrets and their security posture by default?

Which THREE options represent valid ways to supply sensitive data to a container using Kubernetes native features? (Choose THREE)

Which TWO of the following are valid Kubernetes RBAC rule subjects that can be bound to roles or cluster roles?

You are auditing a cluster and find a pod that mounts the host's root filesystem directly into the container. Which Pod Security Standard rule does this violate?

You have configured a NetworkPolicy with an egress rule targeting a specific CIDR block. However, DNS resolution for external domain names fails from within the pods selected by this policy. What is the most likely cause?

A security auditor notices that a deployment running in the 'production' namespace is violating the Restricted Pod Security Standard because containers are running as root. How can you enforce compliance using Pod Security Admission?

An application pod requires access to the Kubernetes API to list other pods. To follow secure practices, you create a dedicated ServiceAccount and bind a custom Role to it. How should you configure the Pod specification to prevent the default service account token from being automatically mounted?

A cluster administrator needs to grant read-only access to pods within the 'development' namespace using Kubernetes RBAC. Which resource kind should be used to define the permissions?

A security team runs a multi-tenant cluster and wants a single, cluster-scoped policy that restricts which PersistentVolumeClaim StorageClasses each tenant namespace may use, rejecting any PVC that requests a non-approved StorageClass at admission time. They prefer a declarative, Kubernetes-native mechanism that requires no custom controller code. Which approach best meets this requirement?

An external identity provider (OIDC) is integrated with your Kubernetes cluster. You want to restrict a group named 'contractors' so they can only view pods in the 'staging' namespace. Which configuration correctly maps this requirement?

An application running in a pod needs to securely consume a database password without storing it in plaintext within the container image or deployment manifest. Which native Kubernetes resource is best suited for storing this sensitive key-value data?

Which TWO of the following actions are considered best practices for securing Kubernetes Secrets? (Choose TWO)

When configuring a MutatingWebhookConfiguration, you notice that mutating webhooks are executed before validating webhooks. Why is this execution order critical for security and consistency?

Your cluster uses the Pod Security admission controller with the 'restricted' profile enforced. A legacy application pod fails to start because it requires running as root (runAsNonRoot: false). How should you handle this securely without disabling the standard?

A platform team runs a shared Kubernetes cluster where each tenant namespace contains a ServiceAccount named 'builder'. CI pipelines in the 'ci' namespace authenticate as 'ci:builder' and need to create Deployments only in that same namespace. A security engineer must write a RoleBinding that grants the 'edit' ClusterRole to this identity without granting rights in any other namespace. Which subject entry should the RoleBinding contain?

You are reviewing admission webhook configurations and notice that timeoutSeconds is set to 3 seconds for a critical validation webhook. If the webhook server takes 4 seconds to respond, what does the API server do when failurePolicy is 'Ignore'?

A security engineer wants to apply Pod Security Standards globally across an entire namespace using the modern built-in admission mechanism. Which approach should be used?

Which TWO components are involved in configuring and processing admission webhooks in a Kubernetes cluster?

An application pod requires read access to secrets in the 'production' namespace. You need to bind a pre-existing ClusterRole named 'secret-reader' to a service account named 'app-sa' in that namespace. Which RBAC resource accomplishes this?

A CI/CD pipeline service account needs permission to create Deployments and Services across multiple namespaces, but should not have cluster-admin privileges. What is the most secure way to grant these permissions?

You are troubleshooting a custom controller that fails to read ConfigMaps in the 'kube-system' namespace despite having a ClusterRole bound via a ClusterRoleBinding. What is the most likely reason for this failure?

You are deploying a ValidatingWebhookConfiguration to inspect incoming pod creations. What happens if the webhook fails and the 'failurePolicy' in the webhook configuration is set to 'Fail'?

An application pod needs to access the Kubernetes API server securely. How does Kubernetes authenticate the pod by default when it communicates with the API server?

An administrator wishes to inspect which admission controllers are currently enabled in a running Kubernetes cluster. Where is this typically configured in a stacked control plane?

Which TWO mechanisms are used by Kubernetes admission controllers to enforce security policies during the API request lifecycle?

An application pod needs to mount a Secret as environment variables. Which section of the Pod manifest should be configured to achieve this securely?

Which TWO components are core parts of the Kubernetes authorization architecture? (Choose TWO)

A security engineer configures a ValidatingWebhookConfiguration to intercept pod creations. The webhook service goes down due to a network partition. What happens to incoming pod creation requests by default if the webhook 'failurePolicy' is set to 'Fail'?

Which THREE conditions must be met for a RoleBinding to successfully grant permissions to a ServiceAccount?

An enterprise cluster requires that all incoming NetworkPolicies must default to denying all traffic unless explicitly allowed. A developer creates a namespace but forgets to apply any policies. What is the default behavior of Kubernetes regarding inter-pod traffic within a namespace when no NetworkPolicies are present?

A cluster operator is enforcing the Pod Security Standards "restricted" profile across a namespace. A developer attempts to deploy a container running as root (runAsUser: 0). What will happen during the admission phase?

What is the primary function of the 'automountServiceAccountToken: false' setting in a Pod specification?

A developer accidentally committed plain-text database passwords into a public Git repository. The password was stored in a Kubernetes Secret manifest. What immediate remediation step should be taken regarding the Secret?

An administrator wants to ensure that no container in a specific namespace runs with a root User ID (UID 0). Which security context setting should be enforced?

Which TWO statements are true regarding Kubernetes NetworkPolicy default behaviors?

Which RBAC verb allows a user to delete an existing resource in a Kubernetes namespace?

Under the Pod Security Standards, a developer attempts to deploy a pod with 'privileged: true' in a namespace labeled with 'pod-security.kubernetes.io/enforce=baseline'. What will happen?

Which TWO entities can be assigned RBAC permissions in a Kubernetes cluster? (Choose TWO)

An administrator wants to prevent users from creating pods that mount the host network ('hostNetwork: true'). Which tool or feature is best suited to enforce this restriction natively across the cluster?

You want to enable encryption at rest for Kubernetes Secrets in your cluster using an external KMS (Key Management Service) provider. Which component on the control plane reads the EncryptionConfiguration file and handles this encryption?

A cluster administrator needs to intercept and reject any resource creation requests that do not include a mandatory security-context label. Which admission controller type should be implemented?

Which of the following describes a recommended security practice when managing Kubernetes Secrets?

Your team is storing sensitive database credentials in Kubernetes Secrets. A security review reveals that base64 encoding does not provide encryption at rest. What mechanism should you enable to ensure Secrets are encrypted when stored in etcd?

Which TWO types of selectors can be used within a Kubernetes NetworkPolicy ingress rule to specify allowed traffic sources?

An auditor notices that a secret is mounted as a volume in a pod. Where is this secret stored on the worker node filesystem by default?

You have deployed a NetworkPolicy in a namespace that selects backend pods, defining an 'ingress' rule with a 'from' block. No other NetworkPolicies exist in the namespace. What is the default behavior for traffic from pods not matched by the 'from' selector?

You are auditing a Kubernetes cluster and notice that a specific ServiceAccount has been granted the 'impersonate' verb on users. What security risk does this permission introduce?