CKA Practice Question: Cluster Architecture, Installation and Configuration
A ClusterRole named 'pod-reader' exists that grants get, list, and watch permissions on pods. You want to bind this ClusterRole to a user 'john' in the 'development' namespace only. Which resource should you create?
⚠ Common exam trap
Many exam-takers confuse ClusterRoleBinding with RoleBinding when binding a ClusterRole, forgetting that a ClusterRoleBinding grants cluster-wide access, while a RoleBinding scopes the ClusterRole's permissions to a single namespace.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RoleBinding 'john-pod-reader' in namespace 'development' referencing ClusterRole 'pod-reader' and user 'john'
A RoleBinding in a specific namespace can reference a ClusterRole to grant its permissions only within that namespace. Since the requirement is to bind the existing 'pod-reader' ClusterRole to user 'john' exclusively in the 'development' namespace, a RoleBinding named 'john-pod-reader' in the 'development' namespace is the correct resource. This allows the ClusterRole's pod read permissions to be scoped down to a single namespace.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
RoleBinding 'john-pod-reader' in namespace 'development' referencing ClusterRole 'pod-reader' and user 'john'
Why this is correct
This option correctly identifies the mechanism for granting namespace-specific permissions derived from a cluster-wide role. A RoleBinding created within the 'development' namespace, referencing the 'pod-reader' ClusterRole and the user 'john', effectively scopes the ClusterRole's permissions to only that specific namespace. This ensures 'john' can read pods exclusively within 'development', adhering to the principle of least privilege.
- ✗
Add user 'john' to the 'pod-reader' ClusterRole definition
Why it's wrong here
Kubernetes RBAC separates permission definitions from their assignment to subjects. ClusterRole objects, like Roles, are purely declarative policy documents that specify permissible actions on resources. They do not contain fields for users, groups, or service accounts. Attempting to embed a user directly into a ClusterRole definition would be syntactically invalid and fundamentally misinterprets the RBAC model, which relies on separate binding objects.
- ✗
Role 'pod-reader' in namespace 'development'
Why it's wrong here
The question explicitly states that a ClusterRole named 'pod-reader' already exists. Creating a new Role with the same name in the 'development' namespace would be redundant and would not leverage the pre-existing ClusterRole definition. Furthermore, a Role itself only defines permissions; it does not grant them to any subject. A binding object is always required to link a subject to a role.
- ✗
ClusterRoleBinding 'john-pod-reader' binding 'pod-reader' to user 'john'
Why it's wrong here
A ClusterRoleBinding grants the permissions defined in its referenced ClusterRole across the entire Kubernetes cluster. While it would successfully bind the 'pod-reader' ClusterRole to user 'john', it would provide 'john' with pod-reading capabilities in all namespaces, not just the 'development' namespace. This approach grants overly broad permissions, violating the principle of least privilege for a scenario likely requiring namespace-specific access.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKA question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.