CKAD Practice Question: Application Environment, Configuration and Security
A pod uses a ServiceAccount 'my-sa' with a RoleBinding that grants get and list on pods. The pod makes an API call to list pods in its own namespace. Which RBAC resource is necessary?
⚠ Common exam trap
CNCF often tests the distinction between RoleBinding and ClusterRoleBinding, trapping candidates who think a ClusterRoleBinding is required when the operation is namespace-scoped, or who forget that a Role alone is not a binding.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A RoleBinding that binds the Role to the ServiceAccount
The pod uses a ServiceAccount 'my-sa' and the API call is to list pods in its own namespace. A RoleBinding binds a Role (which contains the rules) to a ServiceAccount within a specific namespace, granting the permissions only in that namespace. Since the operation is namespace-scoped and the Role already has the necessary get and list rules, a RoleBinding is the minimal and correct RBAC resource to associate the Role with the ServiceAccount.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A Role with the appropriate rules
Why it's wrong here
A Role merely defines a set of allowed verbs on resources; it has no subject and is inert by itself. Until a RoleBinding (or ClusterRoleBinding) explicitly names the ServiceAccount as its subject, the ServiceAccount receives none of the permissions defined in the Role. Thus, while a Role is a necessary part of the RBAC puzzle, it grants nothing without a binding.
- ✗
A ClusterRoleBinding that binds the ClusterRole to the ServiceAccount
Why it's wrong here
A ClusterRoleBinding attaches the referenced ClusterRole to the ServiceAccount across all namespaces in the cluster. For a pod that only needs permissions within its own namespace, this is far too broad and violates the principle of least privilege. Moreover, a ClusterRoleBinding is a cluster-scoped resource, so it cannot be used to grant namespace-scoped access narrowly; a namespaced RoleBinding would be the appropriate mechanism here.
- ✓
A RoleBinding that binds the Role to the ServiceAccount
Why this is correct
This is the correct RBAC combination: the Role defines the allowed actions within a specific namespace, and the RoleBinding, also namespaced, names the ServiceAccount as its subject, thereby granting those permissions only to that account and only within that namespace. Any pod that uses this ServiceAccount inherits the bound permissions, and the access is scoped exactly as needed, following least privilege.
- ✗
A ClusterRole with the same rules
Why it's wrong here
A ClusterRole with the same rules is still only a rule definition—it needs a binding to connect it to a subject before it has any effect. Although a RoleBinding can legitimately reference a ClusterRole and grant its rules within a single namespace, the ClusterRole alone grants the ServiceAccount nothing; an explicit binding is required. For namespace-scoped needs, an equivalent Role is usually simpler and more direct than introducing a ClusterRole.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 160-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.