Free practice · No sign-up required
15 questions with answer explanations. Choose an answer below to begin.
Which control plane component validates and configures cluster state?
Understand the role of API server in cluster operations and security
0/15 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.
Learn by doing
Use official documentation and hands-on labs to work through topics you missed.
Application examples from the Kubernetes project for practicing manifests and application behavior in a cluster.
Try it: Use a disposable cluster. Read a simple application's manifests, predict which Pods its Service selects, then change a label and use kubectl to diagnose the resulting connectivity problem.
Source is free. A local cluster uses your computer; hosted clusters may incur charges.
Guided tutorials for learning Kubernetes behavior and building practical skills beyond multiple-choice recall.
Try it: Complete a basic application tutorial. Repeat the task without the walkthrough, then explain the difference between declared configuration and observed cluster state.
Documentation is free. Your chosen cluster environment may have costs.
Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.
Which control plane component validates and configures cluster state?
etcd
kube-apiserver
kube-scheduler
cloud-controller-manager
Correct answer
kube-apiserver
The kube-apiserver exposes the Kubernetes API and is the primary control plane component for validating and applying configuration changes. It ensures only authorized and valid requests update the cluster state.
What is the purpose of a NetworkPolicy resource?
To define allowed communication between pods
To manage persistent storage access
To control image registry authentication
To schedule pods across nodes
Correct answer
To define allowed communication between pods
A NetworkPolicy specifies how groups of pods are allowed to communicate with each other and other network endpoints. It uses label selectors to define allowed ingress and egress traffic.
Which practice helps reduce the impact of a container breakout?
Running containers as root
Using the host network namespace
Enabling read-only root filesystems
Granting wide hostPath mounts
Correct answer
Enabling read-only root filesystems
Setting a read-only root filesystem prevents attackers from modifying application binaries or configuration inside the container. This limits persistence options in case of a container escape.
What does a PodSecurity admission controller enforce?
Pod creation based on security contexts and standards
Node resource allocation
Image vulnerability scanning
Secret encryption at rest
Correct answer
Pod creation based on security contexts and standards
PodSecurity admission controllers apply policies that restrict pod configurations based on security standards. They can enforce rules around run as non-root, read-only filesystems, and restricted capabilities.
Which RBAC element defines what actions can be performed on which resources?
Role or ClusterRole
ServiceAccount
Binding
TokenRequest
Correct answer
Role or ClusterRole
Roles and ClusterRoles contain rules that specify API groups, resources, and verbs (like get, list, create). Bindings associate these rules with users or service accounts.
Why should you avoid using the default service account for pods?
It typically has permissions that are broader than needed
It cannot mount persistent volumes
It prevents containers from starting
It disables network access
Correct answer
It typically has permissions that are broader than needed
The default service account is often bound to broader permissions than necessary. Using dedicated service accounts with minimal permissions limits the scope of compromised credentials.
What is a secure method to inject sensitive configuration into a container?
Using Kubernetes Secrets mounted as environment variables or volumes
Embedding secrets in container images
Storing secrets in ConfigMap without encryption
Hardcoding values in pod spec
Correct answer
Using Kubernetes Secrets mounted as environment variables or volumes
Kubernetes Secrets can be mounted as files or exposed as environment variables, keeping sensitive data out of image layers and source control. Ensure Secrets are encrypted at rest where possible.
Which feature helps ensure only signed images are deployed?
ImagePolicy webhook
Horizontal Pod Autoscaler
Ingress controller
CoreDNS
Correct answer
ImagePolicy webhook
An ImagePolicy webhook validates image references against policies, such as requiring image signatures or allowing only from approved registries. This prevents unauthorized or tampered images from running.
What is a recommended practice for etcd security?
Enable client certificate authentication and encryption at rest
Expose etcd directly to the public internet
Use the same certificate for all cluster components
Disable authentication for performance
Correct answer
Enable client certificate authentication and encryption at rest
etcd stores all cluster state and should be protected with client certificate authentication and encryption at rest. Limiting access to the API server and etcd members reduces attack surface.
Which admission controller helps prevent privilege escalation?
PodSecurity
NodeRestriction
AlwaysPullImages
ServiceAccount
Correct answer
NodeRestriction
The NodeRestriction admission controller limits what kubelet can do, including preventing pods from escalating privileges on the node. It enforces constraints like preventing host path mounts unless allowed.
What is the primary benefit of using a dedicated Kubernetes namespace for sensitive workloads?
It enables logical isolation for applying role-based access controls and network policies
It automatically encrypts all data at rest
It removes the need for network policies
It increases node compute capacity
Correct answer
It enables logical isolation for applying role-based access controls and network policies
Namespaces provide a scope for RBAC and network policy enforcement, allowing finer control over who can access and communicate with resources. They do not inherently encrypt data or add compute.
Which configuration helps protect API server access?
Using short-lived client certificates and restricting source IPs
Allowing unauthenticated anonymous requests
Disabling audit logging
Enabling insecure port without firewall rules
Correct answer
Using short-lived client certificates and restricting source IPs
Protecting the API server involves using short-lived certificates, enabling authentication, and restricting network access. Disabling audit logging or allowing unauthenticated access weakens security posture.
What is a secure alternative to running pods in the host network namespace?
Using a hostPath volume for all application data
Letting containers share the host PID namespace
Using a dedicated network namespace with controlled ingress/egress
Mapping all host devices into the pod
Correct answer
Using a dedicated network namespace with controlled ingress/egress
Sharing the host network namespace exposes the pod to the host network stack and increases risk. Using the default pod network with NetworkPolicy allows controlled communication while isolating traffic.
Which action helps detect unauthorized changes to critical system components?
Periodically reviewing audit logs
Disabling role-based access control
Using the latest unstable Kubernetes version
Allowing all egress traffic
Correct answer
Periodically reviewing audit logs
Audit logs record actions taken within the cluster and are essential for detecting suspicious activity or policy violations. Regular review supports timely incident response.
What is the primary function of the Kubernetes API server audit log?
To record all requests to the API server for security analysis
To store application container logs
To manage etcd backup operations
To schedule workloads across nodes
Correct answer
To record all requests to the API server for security analysis
The audit log records all requests to the API server, providing a critical security mechanism for monitoring and forensic analysis.
Recall the answer before opening each card.
kube-apiserver. It exposes the Kubernetes API and is the primary component for validating and applying configuration changes securely.
To define allowed communication between pods using label selectors for ingress and egress traffic, enabling micro-segmentation.
Enabling a read-only root filesystem prevents attackers from modifying binaries or configuration, limiting persistence.
It enforces pod creation based on security contexts and standards (privileged, baseline, restricted) to restrict risky configurations.
Role or ClusterRole. They contain rules specifying API groups, resources, and verbs like get, list, create.
It typically has broader permissions than needed, so using dedicated service accounts with minimal privileges limits compromise scope.
Use Kubernetes Secrets mounted as environment variables or volumes, avoiding embedding in images or source control.
ImagePolicy webhook validates images against policies like requiring signatures or approved registries.
Enable client certificate authentication and encryption at rest, and restrict network access to only necessary components.
NodeRestriction limits kubelet capabilities, preventing pods from escalating privileges on the node.
Logical isolation for applying RBAC and network policies, enabling finer control over access and communication.
Using short-lived client certificates and restricting source IPs reduces the attack surface.
Use a dedicated pod network with NetworkPolicy for controlled ingress/egress, avoiding host stack exposure.
Periodically reviewing audit logs records all API requests, enabling detection of suspicious activity.
To record all requests to the API server for security analysis, monitoring, and forensic investigation.
It prevents writing to the filesystem, stopping attackers from modifying binaries or dropping persistence mechanisms.
ClusterRole applies cluster-wide to any resource, including non-namespaced ones like nodes, and can be used in any namespace via RoleBinding.
The pod can access host network services and potentially sniff traffic or bypass network policies, increasing compromise risk.
Configure encryption provider in the API server with --encryption-provider-config to encrypt Secret data in etcd.
It blocks all ingress and egress traffic to selected pods until explicit allow rules are added, enforcing zero-trust networking.
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Connect the concepts
Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
The practice bank emphasizes that the kube-apiserver is the central component for validating and configuring cluster state. Protecting it requires short-lived client certificates and network restrictions. Etcd, which stores all cluster data, must be secured with client certificate authentication and encryption at rest. Audit logging records all API requests and is essential for detecting unauthorized changes. The NodeRestriction admission controller helps prevent privilege escalation on nodes. Understanding these components' security roles is critical.
The practice bank addresses reducing container breakout impact by enabling read-only root filesystems. This limits attackers from modifying binaries or configurations. PodSecurity admission controllers enforce standards like run-as-non-root and restricted capabilities. Avoiding host network namespace is recommended; using dedicated pod networks with NetworkPolicy provides controlled ingress/egress. These measures implement least privilege at the container and pod level.
The practice bank covers NetworkPolicy resources that define allowed communication between pods using label selectors. This enables micro-segmentation. For access control, Roles and ClusterRoles define actions on resources (verbs, resources, API groups). Default service accounts often have broader permissions than needed; dedicated service accounts limit blast radius. ImagePolicy webhook ensures only signed images from approved registries are deployed, enhancing supply chain security.
Sensitive configuration should be injected using Kubernetes Secrets mounted as environment variables or volumes, keeping data out of image layers. For monitoring, periodic review of audit logs detects unauthorized changes to critical components. The practice bank highlights that audit logging records all requests to the API server, providing a trail for security analysis. Namespace isolation via RBAC and network policies further contains sensitive workloads.
Study workflow
Enable client certificate authentication for etcd peers and clients. Encrypt etcd data at rest using the encryption provider configuration. Restrict network access to etcd to only the API server and etcd cluster members. Use firewalls or network policies to limit exposure.
Enable the PodSecurity admission controller in the API server. Define policies using the built-in profiles (privileged, baseline, restricted). Apply policies per namespace using labels like pod-security.kubernetes.io/enforce. Test with dry-run first.
Start with a default-deny-all policy for each namespace. Then create ingress and egress rules using podSelector and namespaceSelector. Specify ports and protocols. Use kubectl describe networkpolicy to verify. Test connectivity with temporary debugging pods.
Deploy a webhook server that validates image references against a policy. Configure the API server with an admission webhook configuration file. Require signatures via tools like cosign. Use the ImagePolicyWebhook admission controller to reject unsigned images.
Enable audit logging in the API server with --audit-policy-file and --audit-log-path. Define a policy that logs metadata for all requests or specific resources. Rotate logs using --audit-log-maxbackup and --audit-log-maxsize. Regularly review logs using centralized tools like Falco or ELK.
FAQ
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
A Role grants permissions within a specific namespace. A ClusterRole grants permissions cluster-wide, including non-namespaced resources (like nodes) and can be used across namespaces via RoleBinding. Both contain rules with verbs, resources, and API groups.
Running as root inside a container gives the process elevated privileges on the host in case of a breakout. Using a read-only root filesystem and running as non-root limits the damage an attacker can do. PodSecurity standards enforce runAsNonRoot.
NodeRestriction limits the kubelet's ability to modify node and pod objects. It prevents kubelets from setting node status to unschedulable or modifying pods not bound to itself. This reduces the attack surface if a node is compromised.
An ImagePolicy webhook validates container images before they are admitted into the cluster. It can enforce policies like requiring images to be signed, from a trusted registry, or have no critical vulnerabilities. This prevents deployment of malicious or tampered images.
Yes, by default all traffic is allowed if no NetworkPolicy selects the pod. To block all traffic, apply a NetworkPolicy that selects all pods and has no ingress or egress rules. This effectively isolates the pod until explicit rules are added.
Browse another free bank or use the study strategy guide to turn your misses into spaced review.
