Free practice · No sign-up required
15 questions with answer explanations. Choose an answer below to begin.
What is the primary purpose of a Kubernetes Namespace?
Understand core Kubernetes object organization concepts
0/15 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.
Learn by doing
Use official documentation and hands-on labs to work through topics you missed.
Application examples from the Kubernetes project for practicing manifests and application behavior in a cluster.
Try it: Use a disposable cluster. Read a simple application's manifests, predict which Pods its Service selects, then change a label and use kubectl to diagnose the resulting connectivity problem.
Source is free. A local cluster uses your computer; hosted clusters may incur charges.
Guided tutorials for learning Kubernetes behavior and building practical skills beyond multiple-choice recall.
Try it: Complete a basic application tutorial. Repeat the task without the walkthrough, then explain the difference between declared configuration and observed cluster state.
Documentation is free. Your chosen cluster environment may have costs.
Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.
What is the primary purpose of a Kubernetes Namespace?
To partition cluster resources and scope objects for different teams or projects
To increase the maximum number of nodes in the cluster
To store persistent data for stateful applications
To define the physical hardware layout of worker nodes
Correct answer
To partition cluster resources and scope objects for different teams or projects
Namespaces provide a way to divide cluster resources and object scope, helping organize environments and avoid naming collisions. They do not offer strong security isolation by themselves.
Which object is best suited for storing non-confidential configuration data for applications?
Secret
ConfigMap
Volume
ServiceAccount
Correct answer
ConfigMap
ConfigMaps are designed to hold non-sensitive configuration data such as environment variables and configuration files. Secrets should be used for sensitive information like passwords.
What does a Kubernetes Service of type ClusterIP do?
Exposes the service on a static port of each node's IP
Exposes the service only to other cluster-internal workloads
Forwards traffic from the internet directly to the pod
Creates a load balancer in all supported cloud providers
Correct answer
Exposes the service only to other cluster-internal workloads
ClusterIP is the default service type and provides a stable internal IP address accessible only within the cluster. It is not routable from outside the cluster.
Which practice helps ensure that only approved container images are deployed in a cluster?
Using a private registry without authentication
Implementing an admission controller with image policy checks
Allowing all images via wildcard in deployment specs
Deploying images directly via the kubelet API
Correct answer
Implementing an admission controller with image policy checks
Admission controllers can validate and enforce policies, such as allowing only images from approved registries or with specific signatures. This reduces the risk of running unauthorized or malicious images.
What is a common use case for a Kubernetes Pod Security Standard 'restricted' profile?
Allowing any container to run as root for legacy support
Enforcing the least privilege by disallowing privilege escalation and restricting capabilities
Permitting host namespace sharing for debugging
Enabling unrestricted access to the host filesystem
Correct answer
Enforcing the least privilege by disallowing privilege escalation and restricting capabilities
The restricted profile implements strong security defaults, including preventing privilege escalation and limiting Linux capabilities. It is intended for production workloads with strict security requirements.
Which resource should you inspect to verify the identity of a service account used by a pod?
Node
Secret
PersistentVolume
Ingress
Correct answer
Secret
Service account tokens are stored in Secrets mounted into pods. Inspecting the associated Secret allows you to verify the service account identity and its token.
What is the main security benefit of using Network Policies?
They increase the number of available IP addresses in the cluster
They restrict communication between pod endpoints based on rules
They automatically encrypt all data at rest
They replace the need for firewalls in the cloud provider
Correct answer
They restrict communication between pod endpoints based on rules
Network Policies define how groups of pods are allowed to communicate with each other and other network endpoints. This limits lateral movement within the cluster.
Which component of the Kubernetes API server validates and enforces resource quotas?
Scheduler
Controller Manager
Admission Controller
etcd
Correct answer
Admission Controller
Admission controllers are plugins that govern and enforce policies on the cluster. Resource quota validation is performed by an admission controller before objects are persisted.
What is a recommended practice for managing RBAC permissions?
Grant cluster-admin to all developers for convenience
Use RoleBindings and ClusterRoleBindings to grant least privilege
Assign permissions directly to user accounts in etcd
Avoid using roles and rely on built-in default permissions
Correct answer
Use RoleBindings and ClusterRoleBindings to grant least privilege
RoleBindings and ClusterRoleBindings allow you to grant specific permissions to users or groups following the principle of least privilege. Avoid broad admin rights for routine operations.
Which of the following helps protect API server access from unauthorized clients?
Disabling authentication for all requests
Using Transport Layer Security (TLS) for all API communications
Allowing all IP addresses in firewall rules
Exposing the API server on a public port without restrictions
Correct answer
Using Transport Layer Security (TLS) for all API communications
TLS ensures that communications with the API server are encrypted and that clients can verify the server identity. It is a fundamental security control for API access.
What does a Kubernetes Ingress resource typically manage?
Node maintenance and upgrades
HTTP and HTTPS routing to services within the cluster
Storage allocation for persistent volumes
Pod scheduling decisions
Correct answer
HTTP and HTTPS routing to services within the cluster
Ingress manages external access to cluster services, typically HTTP and HTTPS routing. It allows defining rules for hostnames, paths, and TLS termination.
Which strategy helps reduce the impact of node failures in a cluster?
Running all workloads on a single node
Using a single availability zone for all nodes
Spreading replicas across multiple nodes and zones
Disabling automated backups
Correct answer
Spreading replicas across multiple nodes and zones
High availability is improved by distributing replicas across multiple nodes and availability zones. This ensures workloads remain accessible if a node or zone fails.
What is the purpose of a Readiness Probe in a Kubernetes workload?
To measure the long-term resource usage of a container
To determine if a container is ready to serve traffic
To enforce security policies on the node
To replace liveness probes in all scenarios
Correct answer
To determine if a container is ready to serve traffic
Readiness Probes indicate whether a container is prepared to accept requests. If the probe fails, the pod is removed from service endpoints until it becomes ready.
Which control plane component is responsible for maintaining the desired state of the cluster?
kubelet
kube-proxy
controller manager
etcd
Correct answer
controller manager
The controller manager runs multiple control loops that watch the cluster state and make adjustments to move the current state toward the desired state. etcd stores the cluster state, while kubelet manages nodes.
Which mechanism ensures that a container cannot gain more privileges than its entry point defines?
Rootless container mode
AllowPrivilegeEscalation set to false
Read-only root filesystem
Pod Security Admission
Correct answer
AllowPrivilegeEscalation set to false
Setting allowPrivilegeEscalation to false prevents a process from gaining more privileges than its parent process, which is a key principle for least-privilege container execution.
Recall the answer before opening each card.
To partition cluster resources and scope objects for different teams or projects, avoiding naming collisions but not providing strong isolation.
ConfigMap, as it stores key-value configuration data like environment variables and config files without encryption.
Exposes the service only within the cluster via a stable internal IP, not accessible externally.
By implementing an admission controller with image policy checks, such as whitelisting registries or signature verification.
Enforcing least privilege by disallowing privilege escalation, restricting Linux capabilities, and blocking host namespace usage.
The Secret that contains the service account token mounted into the pod.
They restrict pod-to-pod communication based on rules, limiting lateral movement in case of a breach.
Admission Controller, which checks resource quota rules before persisting objects to etcd.
Use RoleBindings and ClusterRoleBindings to grant specific permissions following least privilege.
Using Transport Layer Security (TLS) for all API communications to encrypt and authenticate the server.
HTTP and HTTPS routing to services within the cluster, with rules for hostnames, paths, and TLS termination.
Spreading replicas across multiple nodes and zones to ensure workload availability during failures.
To determine when a container is ready to serve traffic; if it fails, the pod is removed from service endpoints.
The controller manager, which runs control loops to adjust the current state to match the desired state.
Setting allowPrivilegeEscalation to false in the security context.
ClusterIP, which gives a stable internal IP accessible only from within the cluster.
An identity for the pod to authenticate to the Kubernetes API server, stored in a Secret.
By configuring the API server with a TLS certificate and key, and using HTTPS for all client connections.
All pod-to-pod traffic is allowed by default, with no restrictions on communication.
It prevents a process from gaining more privileges than its parent, enforcing least privilege at the container level.
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Connect the concepts
Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
The practice bank emphasizes that Namespaces provide logical separation for multi-tenant clusters, but they do not offer strong isolation on their own. Questions test the ability to distinguish between default service behaviors (ClusterIP) and external access patterns (Ingress). ConfigMaps and Secrets are correctly identified for non-sensitive and sensitive data respectively, highlighting the importance of proper data classification. Understanding these basics is critical for organizing cluster resources securely.
A key security practice tested is controlling which images can run in the cluster. The correct answer uses an admission controller with image policy checks, which validates images against a registry whitelist or signature requirements. Pod Security Standards are also featured, particularly the 'restricted' profile that enforces least privilege by disallowing privilege escalation and limiting capabilities. These mechanisms help prevent the deployment of malicious or misconfigured containers.
Network Policies are identified as the primary tool for restricting pod-to-pod communication, thereby limiting lateral movement in case of a compromise. RBAC best practices are reinforced by recommending RoleBindings and ClusterRoleBindings with least privilege rather than broad admin rights. The importance of TLS for protecting API server communications is also highlighted, ensuring that unauthorized clients cannot intercept or tamper with traffic.
High availability is addressed by recommending that replicas be spread across multiple nodes and zones to reduce the impact of node failures. Readiness Probes are correctly associated with indicating when a container is ready to serve traffic, while the controller manager is identified as the component responsible for maintaining the desired cluster state. Service account tokens stored in Secrets allow verification of pod identity, which is crucial for auditing and access control.
Study workflow
Create two test Namespaces (e.g., dev and prod). Deploy a simple ConfigMap in each. Use kubectl get namespaces and kubectl describe configmap to verify isolation. Then test ClusterIP Service connectivity by running a temporary pod and curl to the service IP.
Enable the PodSecurity admission controller in a test cluster. Define a Policy that enforces the 'restricted' profile. Attempt to create a pod with privileged: true or hostPID: true to see the denial. Also test image policy checks by setting up an ImagePolicyWebhook with a whitelist of approved registries.
Deploy two sets of pods (frontend and backend) with labels. Create a NetworkPolicy that allows only frontend to backend traffic on port 80. Use curl from a frontend pod to verify success, and from a backend pod to verify denial. Test ingress and egress rules separately.
Create a service account for a CI/CD pipeline. Define a Role that grants only get and list on pods and deployments. Bind the Role to the SA in a specific Namespace. Test by using the SA's token to access the API. Then try a forbidden action like delete to confirm denial.
Deploy a deployment with 3 replicas. Add a ReadinessProbe that checks a file. On one node, cordon and drain it. Observe that pods are rescheduled to other nodes. Then simulate a failing ReadinessProbe by removing the file; confirm the pod is removed from service endpoints.
FAQ
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
ConfigMaps store non-confidential data like configuration files or environment variables. Secrets store sensitive data such as passwords or tokens and are base64 encoded but not automatically encrypted at rest. For true encryption, use an encryption provider or external secret management.
Network Policies implement micro-segmentation by controlling ingress and egress traffic between pods. They limit lateral movement if a pod is compromised, reducing the blast radius. Without a policy, all pod-to-pod traffic is allowed by default.
The restricted profile enforces strict security defaults, including disallowing privilege escalation, dropping all capabilities except those required, and preventing the use of host namespaces. It is designed for production workloads where security is paramount.
Each pod has a projected service account token mounted as a volume. You can inspect the associated Secret (or TokenRequest) using kubectl describe secret or kubectl get token. The token's payload contains the service account name and expiration.
The controller manager runs controllers that regulate the cluster state, such as the replication controller, node controller, and endpoints controller. Each controller watches the API server for differences between desired and current state and makes corrective changes (e.g., creating pods if replicas are down).
Browse another free bank or use the study strategy guide to turn your misses into spaced review.
