CKA Practice Question: Cluster Architecture, Installation and Configuration
An administrator creates a ServiceAccount named 'monitor' in the 'default' namespace. They want any pod using this ServiceAccount to be able to list pods cluster-wide. Which RBAC resource should be created and bound to this ServiceAccount?
⚠ Common exam trap
Test-takers frequently confuse namespace-scoped RoleBindings with cluster-scoped ClusterRoleBindings, assuming a RoleBinding can grant cluster-wide permissions if the Role is a ClusterRole, but the binding type determines the scope of the grant.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ClusterRole and ClusterRoleBinding
A ClusterRole is required because listing pods cluster-wide is a cluster-scoped operation, not limited to a single namespace. A ClusterRoleBinding is needed to bind the ClusterRole to the ServiceAccount 'monitor' at the cluster level, granting permissions across all namespaces. RoleBindings can only grant permissions within a single namespace, so they cannot achieve cluster-wide access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ClusterRole and RoleBinding in the default namespace
Why it's wrong here
While a ClusterRole defines cluster-wide permissions, binding it with a RoleBinding restricts those permissions strictly to the namespace where the RoleBinding is created. In this case, creating the RoleBinding in the default namespace limits the monitor service account's access solely to resources within default, failing to provide cluster-wide access.
- ✗
ClusterRole and RoleBinding in kube-system
Why it's wrong here
Utilizing a RoleBinding within the kube-system namespace to bind a ClusterRole localizes the granted permissions exclusively to kube-system. The monitor service account would be unable to view or manage resources in any other namespace, such as default or user-defined namespaces, defeating the requirement for cluster-wide monitoring capabilities.
- ✓
ClusterRole and ClusterRoleBinding
Why this is correct
To grant cluster-wide permissions to a ServiceAccount, you must pair a ClusterRole with a ClusterRoleBinding. Because a ClusterRoleBinding is a non-namespaced resource, it applies the permissions defined in the ClusterRole across all namespaces in the cluster, as well as to cluster-scoped resources like Nodes and PersistentVolumes.
- ✗
Role and RoleBinding in the default namespace
Why it's wrong here
Both Roles and RoleBindings are strictly namespace-scoped Kubernetes resources. Creating a Role and a corresponding RoleBinding in the default namespace confines the monitor service account's permissions entirely to default, making it impossible to access cluster-scoped resources or resources in other namespaces.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
One of 726 original CKA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.