CPENT Cloud And Hybrid Infrastructure Security Practice Question
A penetration tester is analyzing a Kubernetes deployment where a ClusterRole grants the verbs get, list, and watch on secrets, combined with a ClusterRoleBinding assigning this to a default service account in a public-facing namespace. How can an external attacker exploit this configuration?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
By exploiting an application vulnerability to obtain the service account token, then querying the Kubernetes API to dump all cluster-wide secrets.
If the namespace is exposed or pods running the default service account are compromised via an RCE vulnerability, the attacker can harvest sensitive application secrets across the entire cluster.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
By exploiting an application vulnerability to obtain the service account token, then querying the Kubernetes API to dump all cluster-wide secrets.
Why this is correct
Cluster-wide secret access permits harvesting sensitive credentials across namespaces.
- ✗
By executing a kernel-level exploit against the etcd database directly from outside the cluster.
Why it's wrong here
ClusterRoles govern Kubernetes API access, not direct network access to etcd.
- ✗
By generating a self-signed certificate authority to impersonate the kube-apiserver.
Why it's wrong here
Service accounts cannot generate cluster-level CAs without administrative privileges.
- ✗
By performing a DNS poisoning attack against CoreDNS to redirect authentication tokens.
Why it's wrong here
DNS poisoning does not grant Kubernetes RBAC privileges.
About these practice questions
One of 274 original CPENT practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CPENT practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CPENT exam.