Quiz Module 9 - Security and RBAC

Instructions

This quiz contains 30 multiple-choice questions.

---

Question 1

What does RBAC stand for in Kubernetes?

1. Role-Based Access Control

2. Resource-Based Access Control

3. Rule-Based Access Control

Show explanation

Correct answer: Role-Based Access Control

Explanation: RBAC is the Kubernetes authorization mechanism that controls who can do what in the cluster through roles and bindings.

---

Question 2

What is a Role in RBAC?

1. A type of user

2. A collection of permissions that applies to a specific namespace

3. A type of Pod

4. A type of Service

Show explanation

Correct answer: A collection of permissions that applies to a specific namespace

Explanation: A Role defines a set of permissions (verbs) on resources within a specific namespace. A ClusterRole applies to the entire cluster.

---

Question 3

What is a RoleBinding?

1. A type of Role

2. A resource that binds a Role to a user, group, or ServiceAccount within a namespace

3. A type of Pod

4. A type of Service

Show explanation

Correct answer: A resource that binds a Role to a user, group, or ServiceAccount within a namespace

Explanation: A RoleBinding associates a Role (or ClusterRole) with subjects (users, groups, ServiceAccounts) within a specific namespace.

---

Question 4

What is the difference between a Role and a ClusterRole?

1. No difference

2. A Role applies to a namespace, a ClusterRole applies to the entire cluster

3. A ClusterRole applies to a namespace

4. They are identical

Show explanation

Correct answer: A Role applies to a namespace, a ClusterRole applies to the entire cluster

Explanation: Roles are limited to a namespace, while ClusterRoles can define permissions on cluster-level resources (nodes, PVs, etc.).

---

Question 5

What is a ServiceAccount?

1. A user account

2. An identity for Pods running in the cluster

3. A type of Service

4. A type of Pod

Show explanation

Correct answer: An identity for Pods running in the cluster

Explanation: A ServiceAccount provides an identity for Pods, enabling authentication and authorization when accessing the API Server.

---

Question 6

What are the main verbs (actions) in RBAC?

1. read, write, delete

2. get, list, create, update, patch, delete, watch

3. read, write, execute

4. view, edit, remove

Show explanation

Correct answer: get, list, create, update, patch, delete, watch

Explanation: The main verbs in RBAC are get (read an object), list (list), create, update, patch (modify), delete, and watch (monitor changes).

---

Question 7

What is the command to view Roles?

1. kubectl get users

2. kubectl get roles

3. kubectl get permissions

4. kubectl list roles

Show explanation

Correct answer: kubectl get roles

Explanation: kubectl get roles displays all Roles in the current namespace. Use -A for all namespaces.

---

Question 8

What is a ClusterRoleBinding?

1. A type of RoleBinding

2. A resource that binds a ClusterRole to a user, group, or ServiceAccount at the cluster level

3. A type of Pod

4. A type of Service

Show explanation

Correct answer: A resource that binds a ClusterRole to a user, group, or ServiceAccount at the cluster level

Explanation: A ClusterRoleBinding associates a ClusterRole with subjects at the cluster level, granting them permissions across the entire cluster.

---

Question 9

What is the command to test a user's permissions?

1. kubectl test permissions

2. kubectl auth can-i [verb] [resource] --as=[user] or kubectl auth can-i --list

3. kubectl check permissions

4. kubectl verify permissions

Show explanation

Correct answer: kubectl auth can-i [verb] [resource] --as=[user] or kubectl auth can-i --list

Explanation: kubectl auth can-i allows you to check if a user can perform a specific action. --list displays all permissions.

---

Question 10

What is a Pod Security Standard (PSS)?

1. A type of Pod

2. Predefined security policies (privileged, baseline, restricted) for Pods

3. A type of Service

4. A type of Secret

Show explanation

Correct answer: Predefined security policies (privileged, baseline, restricted) for Pods

Explanation: Pod Security Standards define three security levels for Pods: privileged (everything allowed), baseline (minimal restrictions), and restricted (maximum restrictions).

---

Question 11

What is the command to view ServiceAccounts?

1. kubectl get users

2. kubectl get serviceaccounts

3. kubectl get accounts

4. kubectl list serviceaccounts

Show explanation

Correct answer: kubectl get serviceaccounts

Explanation: kubectl get serviceaccounts (or sa) displays all ServiceAccounts in the current namespace.

---

Question 12

What is a Network Policy?

1. A routing policy

2. A resource that defines network communication rules between Pods

3. A Service policy

4. A DNS configuration

Show explanation

Correct answer: A resource that defines network communication rules between Pods

Explanation: Network Policies act as a cluster-level firewall, controlling incoming and outgoing Pod traffic based on selectors.

---

Question 13

What is the difference between a RoleBinding and a ClusterRoleBinding?

1. No difference

2. RoleBinding binds a Role within a namespace, ClusterRoleBinding binds a ClusterRole at the cluster level

3. ClusterRoleBinding binds a Role, RoleBinding binds a ClusterRole

4. They are identical

Show explanation

Correct answer: RoleBinding binds a Role within a namespace, ClusterRoleBinding binds a ClusterRole at the cluster level

Explanation: RoleBindings are limited to a namespace, while ClusterRoleBindings apply to the entire cluster.

---

Question 14

What is an imagePullSecret?

1. A type of Secret

2. A Secret used by a Pod to authenticate with a private Docker registry

3. A type of ConfigMap

4. A type of Service

Show explanation

Correct answer: A Secret used by a Pod to authenticate with a private Docker registry

Explanation: imagePullSecrets allow Pods to pull images from private registries by providing authentication credentials.

---

Question 15

What is the command to view ClusterRoles?

1. kubectl get roles

2. kubectl get clusterroles

3. kubectl get global-roles

4. kubectl list clusterroles

Show explanation

Correct answer: kubectl get clusterroles

Explanation: kubectl get clusterroles displays all ClusterRoles that apply to the entire cluster.

---

Question 16

What is the principle of least privilege in RBAC?

1. Grant all privileges

2. Grant only the minimum permissions necessary to accomplish a task

3. Grant random permissions

4. Grant no permissions

Show explanation

Correct answer: Grant only the minimum permissions necessary to accomplish a task

Explanation: The principle of least privilege is a security best practice that consists of granting only the strictly necessary permissions, reducing the attack surface.

---

Question 17

What is the command to view RoleBindings?

1. kubectl get bindings

2. kubectl get rolebindings

3. kubectl get permissions

4. kubectl list rolebindings

Show explanation

Correct answer: kubectl get rolebindings

Explanation: kubectl get rolebindings (or rb) displays all RoleBindings in the current namespace.

---

Question 18

What is a Pod Security Admission (PSA)?

1. A type of Pod

2. An Admission Controller that enforces Pod Security Standards on Pods

3. A type of Service

4. A type of Secret

Show explanation

Correct answer: An Admission Controller that enforces Pod Security Standards on Pods

Explanation: Pod Security Admission is a built-in Admission Controller that automatically enforces Pod Security Standards (privileged, baseline, restricted) on Pods.

---

Question 19

What is the difference between enforce, audit, and warn in Pod Security Standards?

1. No difference

2. enforce blocks non-compliant Pods, audit records violations, warn warns but allows

3. warn allows, enforce records, audit warns

4. They are identical

Show explanation

Correct answer: enforce blocks non-compliant Pods, audit records violations, warn warns but allows

Explanation: enforce blocks non-compliant Pods, audit records violations in logs, warn displays a warning but still allows the Pod.

---

Question 20

What is a Network Policy with policyTypes: Ingress?

1. A Network Policy without rules

2. A Network Policy that controls only incoming traffic to the selected Pods

3. A deprecated Network Policy

4. A Network Policy for outgoing traffic only

Show explanation

Correct answer: A Network Policy that controls only incoming traffic to the selected Pods

Explanation: policyTypes defines which types of traffic are controlled: Ingress (incoming), Egress (outgoing), or both.

---

Question 21

What is the command to create a ServiceAccount?

1. kubectl new serviceaccount

2. kubectl create serviceaccount [name]

3. kubectl add serviceaccount

4. kubectl make serviceaccount

Show explanation

Correct answer: kubectl create serviceaccount [name]

Explanation: kubectl create serviceaccount creates a new ServiceAccount in the current namespace.

---

Question 22

What is a Role with resourceNames?

1. A Role without restrictions

2. A Role that limits permissions to specific resources by name

3. A deprecated Role

4. A Role for all resources

Show explanation

Correct answer: A Role that limits permissions to specific resources by name

Explanation: resourceNames allows restricting permissions to specific resources by their name, providing granular control.

---

Question 23

What is the best practice for ServiceAccounts?

1. Use the default ServiceAccount for all Pods

2. Create a dedicated ServiceAccount for each application with minimal permissions

3. Do not use ServiceAccounts

4. Share a ServiceAccount across all applications

Show explanation

Correct answer: Create a dedicated ServiceAccount for each application with minimal permissions

Explanation: Each application should have its own ServiceAccount with only the necessary permissions, following the principle of least privilege.

---

Question 24

What is a Network Policy with from and to?

1. A Network Policy without rules

2. A Network Policy that specifies the allowed sources (from) and destinations (to) for traffic

3. A deprecated Network Policy

4. A Network Policy for all Pods

Show explanation

Correct answer: A Network Policy that specifies the allowed sources (from) and destinations (to) for traffic

Explanation: from defines the allowed sources for incoming traffic, to defines the allowed destinations for outgoing traffic.

---

Question 25

What is the command to view ClusterRoleBindings?

1. kubectl get rolebindings

2. kubectl get clusterrolebindings

3. kubectl get global-bindings

4. kubectl list clusterrolebindings

Show explanation

Correct answer: kubectl get clusterrolebindings

Explanation: kubectl get clusterrolebindings displays all ClusterRoleBindings that apply to the entire cluster.

---

Question 26

What is a Role with apiGroups?

1. A Role without restrictions

2. A Role that specifies the Kubernetes API groups to which the permissions apply

3. A deprecated Role

4. A Role for all API groups

Show explanation

Correct answer: A Role that specifies the Kubernetes API groups to which the permissions apply

Explanation: apiGroups allows specifying which API groups are affected (for example: "", "apps", "networking.k8s.io").

---

Question 27

What is the difference between a Network Policy with and without rules?

1. No difference

2. Without rules, all traffic is blocked. With rules, only the specified traffic is allowed.

3. Without rules, everything is allowed

4. They are identical

Show explanation

Correct answer: Without rules, all traffic is blocked. With rules, only the specified traffic is allowed.

Explanation: By default, Network Policies block all traffic. Rules explicitly define which traffic is allowed (whitelist approach).

---

Question 28

What is a Role with verbs: ["*"]?

1. A Role without permissions

2. A Role that grants all actions (get, list, create, update, patch, delete, watch)

3. A deprecated Role

4. A Role with a single permission

Show explanation

Correct answer: A Role that grants all actions (get, list, create, update, patch, delete, watch)

Explanation: The wildcard "*" in verbs grants all possible actions on the specified resources, to be used with caution.

---

Question 29

What is the best practice for Network Policies?

1. Do not use Network Policies

2. Apply the principle of least privilege, allow only the necessary traffic

3. Allow all traffic

4. Use a single Network Policy for everything

Show explanation

Correct answer: Apply the principle of least privilege, allow only the necessary traffic

Explanation: Network Policies should follow the principle of least privilege, allowing only the strictly necessary traffic between Pods.

---

Question 30

What is the command to view the permissions of a ServiceAccount?

1. kubectl get permissions serviceaccount

2. kubectl describe serviceaccount [name] and kubectl get rolebindings,clusterrolebindings to see the bindings

3. kubectl show permissions serviceaccount

4. kubectl list permissions serviceaccount

Show explanation

Correct answer: kubectl describe serviceaccount [name] and kubectl get rolebindings,clusterrolebindings to see the bindings

Explanation: To view a ServiceAccount's permissions, examine the RoleBindings and ClusterRoleBindings that reference it, then the associated Roles/ClusterRoles.

---

Quiz Results

Congratulations on completing the Module 9 quiz!

Score:

• 25-30 correct answers: Excellent! You have mastered security and RBAC.
• 20-24 correct answers: Very good! Review the concepts where you had difficulties.
• 15-19 correct answers: Good! Review the chapters on RBAC and security.
• Less than 15: It is recommended to review the module before continuing.

---

Quiz created on: December 2024