KCSA Kubernetes Hardening Concepts Quiz

1. Which Kubernetes component enforces API request policies before persistence?

Kubelet

Kube-scheduler

API server admission controllers

Etcd

2. What is the difference between a ClusterRole and a Role in RBAC?

ClusterRole is cluster-wide; Role is namespace-scoped

Role is more powerful than ClusterRole

ClusterRole applies only to system namespaces

They are identical and interchangeable

3. Which Kubernetes feature prevents pods from using host networking?

Setting hostNetwork: false in pod spec

Using a NetworkPolicy with egress rules

Creating a PodDisruptionBudget

Assigning resource limits

4. What does the 'fsGroup' setting in SecurityContext do?

Defines the user ID for the container process

Sets the GID for mounted volumes and files

Restricts file system access to specific paths

Enables file encryption at rest

5. Which tool is commonly used for scanning Kubernetes manifests for security misconfigurations?

Kubectl logs

Kubesec or similar policy engines

Docker ps

Helm list

6. What is the primary benefit of using a non-root user in containers?

Reduces attack surface if container is compromised

Improves container performance

Enables faster image builds

Allows access to all host resources

7. Which Kubernetes API group contains RBAC resources like Role and RoleBinding?

Rbac.authorization.k8s.io

Policy.k8s.io

Networking.k8s.io

Security.k8s.io

8. What does a NetworkPolicy's 'ingress' rule control?

Outbound traffic from pods

Inbound traffic to pods

DNS resolution for pods

Pod scheduling across nodes

9. Which practice helps prevent supply chain attacks in container deployments?

Using only images from untrusted registries

Signing and verifying container image provenance

Running all containers as root

Disabling all security policies

10. What does running a container with 'privileged: true' do?

Grants the container root privileges and access to host devices

Allows the container to use more CPU resources

Increases the container memory limit

Enables automatic pod restart on failure

11. Which Kubernetes resource enforces network communication rules between pods and external traffic?

NetworkPolicy

SecurityContext

PodSecurityPolicy

ServiceAccount

12. What is the purpose of a RoleBinding in RBAC?

Define what actions are allowed on resources

Assign a Role to a user or service account

Encrypt communication between components

Restrict pod scheduling to specific nodes

13. Which Kubernetes resource defines permissions for API operations (get, create, delete)?

ClusterRole

NetworkPolicy

ServiceAccount

Namespace

14. What does 'allowPrivilegeEscalation: false' prevent in a container?

The container from accessing the host network

A process from gaining more privileges than its parent

The container from writing to the filesystem

The container from reading environment variables

15. Which setting in a SecurityContext makes the root filesystem read-only?

Immutable: true

ReadOnlyRootFilesystem: true

AllowPrivilegeEscalation: false

FsGroup: 1000

16. What is the recommended approach to scan container images for vulnerabilities?

Scan only in production environments

Scan during the CI/CD pipeline before pushing to registry

Scan manually once per year

Rely on the container runtime to detect issues

17. Which Kubernetes admission controller validates incoming API requests against policies?

ValidatingAdmissionWebhook

MutatingAdmissionWebhook

PodPreset

ResourceQuota

18. What does a Pod Security Policy (PSP) control in a Kubernetes cluster?

The number of pods allowed per namespace

Security standards for pod creation and execution

Network traffic between services

Container image registry access

19. Which SecurityContext setting prevents a container from running as root?