KCSA Kubernetes Workload Security Quiz

1. What is a DaemonSet used for in Kubernetes security monitoring?

Running security agents on every node in the cluster

Managing pod replicas across namespaces

Storing sensitive data securely

Controlling ingress traffic

2. What is the primary benefit of using namespace isolation in Kubernetes security?

Separates resources and controls access between teams and applications

Increases pod performance

Reduces storage requirements

Simplifies container image management

3. Which container runtime provides enhanced security isolation through gVisor?

Containerd

Runsc

Runc

Cri-o

4. True or False: A ClusterRole can be bound to a ServiceAccount using a RoleBinding.

True

False

5. What does 'runAsNonRoot: true' enforce in a pod's securityContext?

Containers must run as a non-root user

Containers cannot access root directories

Containers cannot use sudo commands

Containers cannot mount host volumes

6. Which Kubernetes resource defines the set of permissions for a role?

RoleBinding

Role

ServiceAccount

ClusterRoleBinding

7. True or False: NetworkPolicy rules apply to traffic within the same pod.

True

False

8. What is the primary function of OPA (Open Policy Agent) in Kubernetes?

Enforce custom policies across cluster resources

Manage container networking

Monitor pod CPU usage

Schedule pods on nodes

9. Which feature allows you to run containers with a read-only root filesystem?

ReadOnlyRootFilesystem in securityContext

VolumeMount with readOnly flag

PersistentVolume with accessMode ReadOnlyOnce

StorageClass with readOnly parameter

10. True or False: Kubernetes Secrets are encrypted by default at rest in etcd.

True

False

11. What is the primary purpose of a Pod Security Policy (PSP) in Kubernetes?

Define security standards and constraints for pod specifications

Manage storage permissions for pods

Control external API access

Monitor pod performance metrics

12. Which image scanning tool is commonly integrated into Kubernetes clusters to detect vulnerabilities?

Trivy

Kubectl

Kube-proxy

Etcd

13. What does the 'allowPrivilegeEscalation' field in securityContext prevent?

Containers from gaining additional privileges beyond their initial set

Containers from accessing the host filesystem

Containers from using privileged mode

Containers from reading environment variables

14. True or False: A ServiceAccount token can be automatically mounted into every pod by default.

True

False

15. Which admission controller enforces Pod Security Standards in Kubernetes?

PodSecurityPolicy

PodSecurityStandards

ValidatingAdmissionWebhook

MutatingAdmissionWebhook

16. What is the purpose of a ClusterRole in Kubernetes RBAC?

Define permissions scoped to a specific namespace

Define permissions across the entire cluster

Manage pod replicas

Control service discovery

17. True or False: Running containers as the root user is a security best practice in Kubernetes.

True

False

18. Which field in a pod specification restricts the Linux capabilities available to a container?

SecurityContext.capabilities

PodSecurityPolicy.restrictions

ContainerSecurityPolicy.limits

SecurityContext.privileged

19. What does RBAC stand for in Kubernetes?

Role-Based Access Control

Resource-Based Authentication Control

Runtime-Based Authorization Cluster

Replica-Based Availability Configuration

20. Which Kubernetes object is used to control network traffic between pods?

ServiceAccount

NetworkPolicy

PodDisruptionBudget

ConfigMap

KCSA Kubernetes Workload Security Quiz

1. What is a DaemonSet used for in Kubernetes security monitoring?

2.

What first name or nickname would you like us to use?

2. What is the primary benefit of using namespace isolation in Kubernetes security?

3. Which container runtime provides enhanced security isolation through gVisor?

4. True or False: A ClusterRole can be bound to a ServiceAccount using a RoleBinding.

5. What does 'runAsNonRoot: true' enforce in a pod's securityContext?

6. Which Kubernetes resource defines the set of permissions for a role?

7. True or False: NetworkPolicy rules apply to traffic within the same pod.

8. What is the primary function of OPA (Open Policy Agent) in Kubernetes?

9. Which feature allows you to run containers with a read-only root filesystem?

10. True or False: Kubernetes Secrets are encrypted by default at rest in etcd.

11. What is the primary purpose of a Pod Security Policy (PSP) in Kubernetes?

12. Which image scanning tool is commonly integrated into Kubernetes clusters to detect vulnerabilities?

13. What does the 'allowPrivilegeEscalation' field in securityContext prevent?

14. True or False: A ServiceAccount token can be automatically mounted into every pod by default.

15. Which admission controller enforces Pod Security Standards in Kubernetes?

16. What is the purpose of a ClusterRole in Kubernetes RBAC?

17. True or False: Running containers as the root user is a security best practice in Kubernetes.

18. Which field in a pod specification restricts the Linux capabilities available to a container?

19. What does RBAC stand for in Kubernetes?

20. Which Kubernetes object is used to control network traffic between pods?