KCSA Kubernetes Security Fundamentals Practice Question
A CI/CD pipeline service account needs permission to create Deployments and Services across multiple namespaces, but should not have cluster-admin privileges. What is the most secure way to grant these permissions?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define a ClusterRole with the required verbs and resources, then create a RoleBinding for that ClusterRole in each target namespace.
Create a ClusterRole with the necessary rules for Deployments and Services, and bind it to the service account in each target namespace using RoleBindings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Define a ClusterRole with the required verbs and resources, then create a RoleBinding for that ClusterRole in each target namespace.
Why this is correct
This allows a single ClusterRole definition to be reused across multiple namespaces via namespaced RoleBindings, limiting scope.
- ✗
Place the service account in the kube-system namespace.
Why it's wrong here
Namespace placement does not automatically grant broader permissions without an explicit RBAC binding.
- ✗
Grant the service account permissions at the node level using kubeconfig overrides.
Why it's wrong here
Kubernetes authorization is managed via API server RBAC objects, not node-level overrides.
- ✗
Create a ClusterRoleBinding linking the default cluster-admin ClusterRole to the service account.
Why it's wrong here
cluster-admin grants full cluster access, which violates least privilege.
About these practice questions
This KCSA question is part of Courseiva's 319-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.