hardMultiple Choice
CKS Practice Question: A ClusterRole named 'secret-reader' is defined…
A ClusterRole named 'secret-reader' is defined with rules to get, list, and watch secrets. A RoleBinding in namespace 'app' binds this ClusterRole to a service account. Which of the following best describes the permissions of the service account?
⚠ Common exam trap
Test-takers frequently confuse RoleBinding with ClusterRoleBinding, assuming that using a ClusterRole automatically grants cluster-wide permissions, when in fact the binding type determines the scope.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The service account can get, list, and watch secrets only in the 'app' namespace.
A RoleBinding in a specific namespace grants the permissions defined in the referenced ClusterRole, but only within that namespace. Since the RoleBinding is in the 'app' namespace, the service account receives the get, list, and watch permissions for secrets only within the 'app' namespace, not cluster-wide. This is the standard behavior of RoleBinding when binding to a ClusterRole.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The service account has no permissions because ClusterRole cannot be used with RoleBinding.
Why it's wrong here
A RoleBinding can indeed reference a ClusterRole; this is a standard way to reuse cluster-scoped role definitions for namespace-scoped grants. The binding combines the ClusterRole's rules with the RoleBinding's namespace scope, so the service account does receive permissions for that namespace. Hence, it is incorrect to say the service account has no permissions — the RoleBinding is fully valid and grants the ClusterRole's permissions within the app namespace.
- ✗
The service account can only get secrets in the 'app' namespace.
Why it's wrong here
The ClusterRole's rules include get, list, and watch verbs on secrets, so the RoleBinding imparts all three verbs, not just get. Additionally, the permissions are restricted to the app namespace by the RoleBinding, as a RoleBinding cannot grant access outside its own namespace. Consequently, saying the service account can 'only get secrets' is both an understatement and a misinterpretation of the binding's effect.
- ✗
The service account can get, list, and watch secrets in all namespaces.
Why it's wrong here
RoleBindings operate at the namespace level and cannot grant cluster-wide access; even when they reference a ClusterRole, the effective permissions are limited to the binding's namespace. To grant access across all namespaces, you would need a ClusterRoleBinding, which is cluster-scoped and applies the role globally. Since the binding here is a RoleBinding in the app namespace, the service account cannot access secrets in any other namespace.
- ✓
The service account can get, list, and watch secrets only in the 'app' namespace.
Why this is correct
A RoleBinding always confines the granted permissions to the namespace in which it is created, regardless of whether the referenced role is a Role or ClusterRole. Here, the RoleBinding resides in the app namespace and references the 'secret reader' ClusterRole, which permits get, list, and watch on secrets. Therefore, the service account receives exactly those verbs on secrets exclusively within the app namespace, making this statement correct.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 845 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.