Courseiva
← CKAD
Full test
Application Environment, Configuration and Security →mediumMultiple ChoiceObjective-mapped

CKAD Practice Question: Application Environment, Configuration and Security

A Role named 'pod-reader' in namespace 'ns1' grants get, list, and watch on pods. Which RoleBinding correctly binds this role to a ServiceAccount 'sa1' in the same namespace?

⚠ Common exam trap

The trap here is that candidates often forget to include the ServiceAccount's namespace in the subjects list or mistakenly use 'kind: User' for a ServiceAccount, leading to a binding that either fails or applies to the wrong entity.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

roleRef: { apiGroup: rbac.authorization.k8s.io, kind: Role, name: pod-reader } subjects: - kind: ServiceAccount name: sa1 namespace: ns1

A RoleBinding in the same namespace as the Role and ServiceAccount must specify the Role's kind as 'Role' (not ClusterRole) and include the ServiceAccount's namespace in the subjects list. The roleRef references the 'pod-reader' Role with the correct apiGroup and kind, and the subject specifies the ServiceAccount 'sa1' in namespace 'ns1', which matches the Role's namespace, allowing the binding to grant the permissions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    roleRef: { apiGroup: rbac.authorization.k8s.io, kind: Role, name: pod-reader } subjects: - kind: ServiceAccount name: sa1 namespace: ns1

    Why this is correct

    This is correct because a RoleBinding in ns1 uses roleRef to bind the namespaced Role 'pod-reader' to ServiceAccount 'sa1' also in ns1. RoleBindings are namespaced, and both the Role and the ServiceAccount must reside in the same namespace as the binding for the permissions to apply. Here the subject kind is ServiceAccount, which matches the intended identity, so sa1 will receive the Role's permissions.

  • ✗

    roleRef: { apiGroup: rbac.authorization.k8s.io, kind: Role, name: pod-reader } subjects: - kind: User name: sa1

    Why it's wrong here

    This is incorrect because the subject kind is set to 'User' rather than 'ServiceAccount'. Kubernetes RBAC differentiates between human identities (User), groups (Group), and pod identities (ServiceAccount). By specifying kind: User, the binding grants access to a user literally named 'sa1', not to the ServiceAccount 'sa1', so the ServiceAccount will not inherit the pod-reader Role's permissions.

  • ✗

    roleRef: { apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: pod-reader } subjects: - kind: ServiceAccount name: sa1 namespace: ns1

    Why it's wrong here

    This is incorrect because roleRef points to a ClusterRole, but the 'pod-reader' role is defined as a namespaced Role in ns1. A RoleBinding can only reference a Role or ClusterRole; if it references a ClusterRole, that ClusterRole must exist and the permissions are scoped to the RoleBinding's namespace. Here the ClusterRole named 'pod-reader' does not exist, so the binding has no effect and does not grant the intended namespace-scoped permissions.

  • ✗

    roleRef: { apiGroup: rbac.authorization.k8s.io, kind: Role, name: pod-reader } subjects: - kind: ServiceAccount name: sa1 namespace: default

    Why it's wrong here

    This is incorrect because the subject specifies namespace 'default', but the ServiceAccount 'sa1' is actually created in ns1. ServiceAccounts are namespaced objects, and the subject's namespace must exactly match the ServiceAccount's namespace for the binding to apply. Referencing 'default' means the RoleBinding would attempt to bind to the ServiceAccount 'sa1' in the default namespace, which is a different identity, so the real sa1 in ns1 will not receive the pod-reader Role's permissions.

About these practice questions

One of 160 original CKAD practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.