Quiz Module 9 - Security and RBAC

Instructions

This quiz contains 30 multiple-choice questions.

---

Question 1

What does RBAC stand for in Kubernetes?

1. Role-Based Access Control

2. Resource-Based Access Control

3. Rule-Based Access Control

See explanation

Correct answer: Role-Based Access Control

Explanation: RBAC is the Kubernetes authorization mechanism that controls who can do what in the cluster through roles and bindings.

---

Question 2

What is a Role in RBAC?

1. A type of user

2. A collection of permissions that applies to a specific namespace

3. A type of Pod

4. A type of Service

See explanation

Correct answer: A collection of permissions that applies to a specific namespace

Explanation: A Role defines a set of permissions (verbs) on resources in a specific namespace. A ClusterRole applies to the entire cluster.

---

Question 3

What is a RoleBinding?

1. A type of Role

2. A resource that binds a Role to a user, group, or ServiceAccount in a namespace

3. A type of Pod

4. A type of Service

See explanation

Correct answer: A resource that binds a Role to a user, group, or ServiceAccount in a namespace

Explanation: A RoleBinding associates a Role (or ClusterRole) with subjects (users, groups, ServiceAccounts) in a specific namespace.

---

Question 4

What is the difference between a Role and a ClusterRole?

1. No difference

2. A Role applies to a namespace, a ClusterRole applies to the entire cluster

3. A ClusterRole applies to a namespace

4. They are identical

See explanation

Correct answer: A Role applies to a namespace, a ClusterRole applies to the entire cluster

Explanation: Roles are limited to a namespace, while ClusterRoles can define permissions on cluster-level resources (nodes, PVs, etc.).

---

Question 5

What is a ServiceAccount?

1. A user account

2. An identity for Pods running in the cluster

3. A type of Service

4. A type of Pod

See explanation

Correct answer: An identity for Pods running in the cluster

Explanation: A ServiceAccount provides an identity for Pods, enabling authentication and authorization when accessing the API Server.

---

Question 6

What are the main verbs (actions) in RBAC?

1. read, write, delete

2. get, list, create, update, patch, delete, watch

3. read, write, execute

4. view, edit, remove

See explanation

Correct answer: get, list, create, update, patch, delete, watch

Explanation: The main verbs in RBAC are get (read an object), list, create, update, patch (modify), delete, and watch (monitor changes).

---

Question 7

What is the command to view Roles?

1. kubectl get users

2. kubectl get roles

3. kubectl get permissions

4. kubectl list roles

See explanation

Correct answer: kubectl get roles

Explanation: kubectl get roles displays all Roles in the current namespace. Use -A for all namespaces.

---

Question 8

What is a ClusterRoleBinding?

1. A type of RoleBinding

2. A resource that binds a ClusterRole to a user, group, or ServiceAccount at the cluster level

3. A type of Pod

4. A type of Service

See explanation

Correct answer: A resource that binds a ClusterRole to a user, group, or ServiceAccount at the cluster level

Explanation: A ClusterRoleBinding associates a ClusterRole with subjects at the cluster level, granting them permissions across the entire cluster.

---

Question 9

What is the command to test a user's permissions?

1. kubectl test permissions

2. kubectl auth can-i [verb] [resource] --as=[user] or kubectl auth can-i --list

3. kubectl check permissions

4. kubectl verify permissions

See explanation

Correct answer: kubectl auth can-i [verb] [resource] --as=[user] or kubectl auth can-i --list

Explanation: kubectl auth can-i allows you to check if a user can perform a specific action. --list displays all permissions.

---

Question 10

What is a Pod Security Standard (PSS)?

1. A type of Pod

2. Predefined security policies (privileged, baseline, restricted) for Pods

3. A type of Service

4. A type of Secret

See explanation

Correct answer: Predefined security policies (privileged, baseline, restricted) for Pods

Explanation: Pod Security Standards define three levels of security for Pods: privileged (everything allowed), baseline (minimal restrictions), and restricted (maximum restrictions).

---

Question 11

What is the command to view ServiceAccounts?

1. kubectl get users

2. kubectl get serviceaccounts

3. kubectl get accounts

4. kubectl list serviceaccounts

See explanation

Correct answer: kubectl get serviceaccounts

Explanation: kubectl get serviceaccounts (or sa) displays all ServiceAccounts in the current namespace.

---

Question 12

What is a Network Policy?

1. A routing policy

2. A resource that defines network communication rules between Pods

3. A Service policy

4. A DNS configuration

See explanation

Correct answer: A resource that defines network communication rules between Pods

Explanation: Network Policies act as a cluster-level firewall, controlling inbound and outbound traffic to Pods based on selectors.

---

Question 13

What is the difference between a RoleBinding and a ClusterRoleBinding?

1. No difference

2. RoleBinding binds a Role in a namespace, ClusterRoleBinding binds a ClusterRole at the cluster level

3. ClusterRoleBinding binds a Role, RoleBinding binds a ClusterRole

4. They are identical

See explanation

Correct answer: RoleBinding binds a Role in a namespace, ClusterRoleBinding binds a ClusterRole at the cluster level

Explanation: RoleBindings are limited to a namespace, while ClusterRoleBindings apply to the entire cluster.

---

Question 14

What is an imagePullSecret?

1. A type of Secret

2. A Secret used by a Pod to authenticate to a private Docker registry

3. A type of ConfigMap

4. A type of Service

See explanation

Correct answer: A Secret used by a Pod to authenticate to a private Docker registry

Explanation: imagePullSecrets allow Pods to pull images from private registries by providing authentication credentials.

---

Question 15

What is the command to view ClusterRoles?

1. kubectl get roles

2. kubectl get clusterroles

3. kubectl get global-roles

4. kubectl list clusterroles

See explanation

Correct answer: kubectl get clusterroles

Explanation: kubectl get clusterroles displays all ClusterRoles that apply to the entire cluster.

---

Question 16

What is the principle of least privilege in RBAC?

1. Grant all privileges

2. Grant only the minimal permissions necessary to perform a task

3. Grant random permissions

4. Do not grant any permissions

See explanation

Correct answer: Grant only the minimal permissions necessary to perform a task

Explanation: The principle of least privilege is a security best practice that involves granting only the strictly necessary permissions, reducing the attack surface.

---

Question 17

What is the command to view RoleBindings?

1. kubectl get bindings

2. kubectl get rolebindings

3. kubectl get permissions

4. kubectl list rolebindings

See explanation

Correct answer: kubectl get rolebindings

Explanation: kubectl get rolebindings (or rb) displays all RoleBindings in the current namespace.

---

Question 18

What is a Pod Security Admission (PSA)?

1. A type of Pod

2. An Admission Controller that enforces Pod Security Standards on Pods

3. A type of Service

4. A type of Secret

See explanation

Correct answer: An Admission Controller that enforces Pod Security Standards on Pods

Explanation: Pod Security Admission is a built-in Admission Controller that automatically enforces Pod Security Standards (privileged, baseline, restricted) on Pods.

---

Question 19

What is the difference between allow, audit, and warn in Pod Security Standards?

1. No difference

2. allow permits, audit logs violations, warn warns but permits

3. warn permits, allow logs, audit warns

4. They are identical

See explanation

Correct answer: allow permits, audit logs violations, warn warns but permits

Explanation: allow permits compliant Pods, audit logs violations in the logs, warn displays a warning but still permits.

---

Question 20

What is a Network Policy with policyTypes: Ingress?

1. A Network Policy without rules

2. A Network Policy that controls only incoming traffic to selected Pods

3. A deprecated Network Policy

4. A Network Policy for outgoing traffic only

See explanation

Correct answer: A Network Policy that controls only incoming traffic to selected Pods

Explanation: policyTypes defines which types of traffic are controlled: Ingress (incoming), Egress (outgoing), or both.

---

Question 21

What is the command to create a ServiceAccount?

1. kubectl new serviceaccount

2. kubectl create serviceaccount [name]

3. kubectl add serviceaccount

4. kubectl make serviceaccount

See explanation

Correct answer: kubectl create serviceaccount [name]

Explanation: kubectl create serviceaccount creates a new ServiceAccount in the current namespace.

---

Question 22

What is a Role with resourceNames?

1. A Role without restrictions

2. A Role that limits permissions to specific resources by name

3. A deprecated Role

4. A Role for all resources

See explanation

Correct answer: A Role that limits permissions to specific resources by name

Explanation: resourceNames allows restricting permissions to specific resources by their name, offering granular control.

---

Question 23

What is the best practice for ServiceAccounts?

1. Use the default ServiceAccount for all Pods

2. Create a dedicated ServiceAccount for each application with minimal permissions

3. Do not use ServiceAccounts

4. Share a ServiceAccount among all applications

See explanation

Correct answer: Create a dedicated ServiceAccount for each application with minimal permissions

Explanation: Each application should have its own ServiceAccount with only the necessary permissions, following the principle of least privilege.

---

Question 24

What is a Network Policy with from and to?

1. A Network Policy without rules

2. A Network Policy that specifies allowed sources (from) and destinations (to) for traffic

3. A deprecated Network Policy

4. A Network Policy for all Pods

See explanation

Correct answer: A Network Policy that specifies allowed sources (from) and destinations (to) for traffic

Explanation: from defines allowed sources for incoming traffic, to defines allowed destinations for outgoing traffic.

---

Question 25

What is the command to view ClusterRoleBindings?

1. kubectl get rolebindings

2. kubectl get clusterrolebindings

3. kubectl get global-bindings

4. kubectl list clusterrolebindings

See explanation

Correct answer: kubectl get clusterrolebindings

Explanation: kubectl get clusterrolebindings displays all ClusterRoleBindings that apply to the entire cluster.

---

Question 26

What is a Role with apiGroups?

1. A Role without restrictions

2. A Role that specifies the Kubernetes API groups to which the permissions apply

3. A deprecated Role

4. A Role for all API groups

See explanation

Correct answer: A Role that specifies the Kubernetes API groups to which the permissions apply

Explanation: apiGroups allows specifying which API groups are concerned (e.g., "", "apps", "networking.k8s.io").

---

Question 27

What is the difference between a Network Policy with and without rules?

1. No difference

2. Without rules, all traffic is blocked. With rules, only specified traffic is allowed.

3. Without rules, everything is allowed

4. They are identical

See explanation

Correct answer: Without rules, all traffic is blocked. With rules, only specified traffic is allowed.

Explanation: By default, Network Policies block all traffic. Rules explicitly define which traffic is allowed (whitelist approach).

---

Question 28

What is a Role with verbs: ["*"]?

1. A Role without permissions

2. A Role that grants all actions (get, list, create, update, patch, delete, watch)

3. A deprecated Role

4. A Role with a single permission

See explanation

Correct answer: A Role that grants all actions (get, list, create, update, patch, delete, watch)

Explanation: The wildcard "*" in verbs grants all possible actions on the specified resources, to be used with caution.

---

Question 29

What is the best practice for Network Policies?

1. Do not use Network Policies

2. Apply the principle of least privilege, allowing only necessary traffic

3. Allow all traffic

4. Use a single Network Policy for everything

See explanation

Correct answer: Apply the principle of least privilege, allowing only necessary traffic

Explanation: Network Policies should follow the principle of least privilege, allowing only strictly necessary traffic between Pods.

---

Question 30

What is the command to view a ServiceAccount's permissions?

1. kubectl get permissions serviceaccount

2. kubectl describe serviceaccount [name] and kubectl get rolebindings,clusterrolebindings to see the bindings

3. kubectl show permissions serviceaccount

4. kubectl list permissions serviceaccount

See explanation

Correct answer: kubectl describe serviceaccount [name] and kubectl get rolebindings,clusterrolebindings to see the bindings

Explanation: To view a ServiceAccount's permissions, examine the RoleBindings and ClusterRoleBindings that reference it, then the associated Roles/ClusterRoles.

---

Quiz Result

Congratulations on completing the Module 9 quiz!

Score:

• 25-30 correct answers: Excellent! You master security and RBAC.
• 20-24 correct answers: Very good! Review the concepts where you had difficulties.
• 15-19 correct answers: Good! Review the chapters on RBAC and security.
• Less than 15: Recommended to review the module before continuing.

---

Quiz created on: December 2024