EX280 Security And SCC Practice Question
An application deployed in a secured namespace requires access to the Kubernetes API to query pod statuses. The administrator wants to follow the principle of least privilege. How should the administrator configure the ServiceAccount and RBAC?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a dedicated ServiceAccount, a Role granting get and list on pods, and a RoleBinding linking them in the namespace
To grant least privilege API access, create a dedicated ServiceAccount, bind a custom Role or ClusterRole with limited verbs (get, list, watch) on pods via a RoleBinding in that namespace.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a dedicated ServiceAccount, a Role granting get and list on pods, and a RoleBinding linking them in the namespace
Why this is correct
This restricts the ServiceAccount permissions strictly to the namespace and specific verbs required.
- ✗
Bind the cluster-admin ClusterRole to the default ServiceAccount in the namespace using a ClusterRoleBinding
Why it's wrong here
Binding cluster-admin grants full administrator access across the entire cluster, violating the principle of least privilege completely.
- ✗
Annotate the default ServiceAccount with rbac.authorization.k8s.io/authtype: reader
Why it's wrong here
Service accounts do not use RBAC auth-type annotations to grant permissions.
- ✗
Grant the system:openshift:scc:restricted ClusterRole to the ServiceAccount using a RoleBinding
Why it's wrong here
SCC cluster roles govern pod security constraints, not Kubernetes API RBAC permissions for querying resources like pods.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva writes every EX280 question from scratch — 509 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Red Hat exam blueprint
This EX280 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX280 exam.