CPENT Cloud And Hybrid Infrastructure Security Practice Question
A penetration tester is evaluating a Kubernetes cluster utilizing Role-Based Access Control (RBAC) and notes that a custom role has the create verb on pods/exec resources. What security risk does this specific permission entail?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A user with this permission can execute arbitrary commands inside any running pod in the cluster, leading to potential node or cluster compromise.
The pods/exec permission allows a user to execute commands inside running pods, effectively granting arbitrary code execution in any pod where they can target execution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user can extract the master node's etcd database encryption keys.
Why it's wrong here
etcd keys require storage-level access, not pod exec.
- ✗
The user can modify the cluster's underlying cloud provider IAM policies.
Why it's wrong here
Kubernetes RBAC does not grant cloud IAM permissions directly.
- ✓
A user with this permission can execute arbitrary commands inside any running pod in the cluster, leading to potential node or cluster compromise.
Why this is correct
pods/exec permission provides interactive shell access to containers.
- ✗
The user can bypass network policies by altering iptables rules on the host node.
Why it's wrong here
Exec does not grant host-level iptables manipulation unless privileged.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
This CPENT question is part of Courseiva's 276-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CPENT practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CPENT exam.